staysin.eu analyses seven layers of a domain's infrastructure to determine whether data stays within European Union jurisdiction. This page explains exactly how each check works, how countries are determined, and how the final score is calculated.
The 27 member states of the European Union: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.
EEA countries (Norway, Iceland, Liechtenstein), Switzerland, and the United Kingdom are not counted as EU, even though some have GDPR-equivalent legislation or EU adequacy decisions. The United Kingdom, for instance, has enacted the Investigatory Powers Act 2016 which grants broad government surveillance powers similar in scope to the US CLOUD Act. The scope of staysin.eu is strictly EU membership.
Country determination follows a consistent two-tier approach across all checks:
The one exception is Server location, which always uses pure IP geolocation. This provides a complementary data point: where data physically travels, alongside the jurisdiction-based checks.
For each domain, staysin.eu runs the following checks. Each check is either scored (counts towards the verdict) or informational (displayed but excluded from scoring).
Resolves the domain's A/AAAA records to get the server IP address. Looks up the ASN and matches it against the provider database. If a known provider is found, the provider's registered country determines EU status. If no provider match exists, the IP geolocation country is used.
Queries NS records for the domain. Each nameserver hostname is first matched against known providers by name (e.g. a nameserver hostname containing a known provider's domain). If no hostname match, the nameserver IP is resolved and matched by ASN. Falls back to IP geolocation if no provider match exists.
Queries MX records. Same matching logic as DNS: hostname match first, then ASN match, then IP geolocation fallback. If no MX records exist, the item is neutral and excluded from scoring.
Detects CDNs through four methods (in priority order): HTTP response headers
(e.g. provider-specific headers), the Server header, CNAME records for the domain itself,
and CNAME records for asset subdomains.
CDN checks only produce a scored result when a provider is explicitly identified. If no CDN is detected, the item shows "None detected" and is excluded from scoring. There is no geolocation fallback for CDN because CDNs use anycast routing, making IP geolocation unreliable.
Geolocates the domain's primary IP address using the iptoasn.com database. Unlike other checks, this always uses pure IP geolocation without provider override. This captures where data physically travels, providing a counterpart to the jurisdiction-based Provider check.
A non-EU company hosting in an EU data centre will show as non-EU for Provider (jurisdiction) but EU for Server location (physical location). Both dimensions are relevant: jurisdiction determines legal obligations (e.g. CLOUD Act), while physical location determines where data actually resides (relevant for GDPR enforcement and data seizure).
Loads the website in a headless browser and captures all network requests to third-party domains. Each external host is resolved to an IP address, and the ASN is matched against the provider database to determine the operator and country. Same two-tier approach as the other checks: provider match preferred, IP geolocation as fallback.
Inspects the TLS certificate chain and identifies the Certificate Authority. Mapped to a country based on a curated list of well-known CAs. Always excluded from scoring because the CA's country does not determine where data flows.
Performs an RDAP lookup to identify the domain registrar and its country. The registrar is displayed with an EU/non-EU indicator but is excluded from scoring. The registrar is an administrative relationship that does not affect where data flows or is processed.
Additionally, staysin.eu collects and displays several purely informational items that are never scored: DNSSEC validation status, notable HTTP headers (X-Powered-By, Via, X-Cache), pre-consent cookies, and reverse DNS (PTR) records.
The sovereignty score is calculated from all scored items (infrastructure checks + detected external services):
Score = (EU items / total scored items) × 100
Items excluded from scoring: those marked as neutral (TLS, DNSSEC, headers, cookies, PTR), items with label "Registrar", and items where no provider could be detected ("Unknown", "None detected").
The final verdict follows strict rules:
Each scored item carries equal weight. A non-EU DNS provider has the same impact as a non-EU external service.