LegalParticipantShape
type: NodeShape
target class: LegalParticipant
property:
  path: legalRegistrationNumber
  node: legalRegistrationNumberShape
  min count: 1
property:
  path: parentOrganization
  node: LegalParticipantShape
property:
  path: subOrganization
  node: LegalParticipantShape
property:
  path: headquarterAddress
  min count: 1
  node: PostalAddressShape
property:
  path: legalAddress
  min count: 1
  node: PostalAddressShape

legalRegistrationNumberShape
type: NodeShape
target class: legalRegistrationNumber
message: At least one of taxID, vatID, EUID, EORI or leiCode must be defined.
property:
  path: taxID
  datatype: string
  min length: 3
property:
  path: EUID
  datatype: string
  min length: 3
property:
  path: EORI
  datatype: string
  min length: 3
property:
  path: vatID
  datatype: string
  min length: 3
property:
  path: leiCode
  datatype: string
  min length: 3
or:
  path: taxID
  min count: 1
or:
  path: EUID
  min count: 1
or:
  path: EORI
  min count: 1
or:
  path: vatID
  min count: 1
or:
  path: leiCode
  min count: 1

PostalAddressShape
type: NodeShape
target class: headquarterAddress
target class: legalAddress
property:
  path: countrySubdivisionCode
  datatype: string
  min count: 1
  pattern: ^[A-Z]{2}-[A-Z0-9]{1,3}$
  flags: i
  message: an ISO 3166-2 format value is expected.

GaiaXTermsAndConditionsShape
type: NodeShape
target class: GaiaXTermsAndConditions
property:
  path: termsAndConditions
  datatype: string
  min count: 1
  has value: The PARTICIPANT signing the Self-Description agrees as follows: - to update its descriptions about any changes, be it technical, organizational, or legal - especially but not limited to contractual in regards to the indicated attributes present in the descriptions. The keypair used to sign Verifiable Credentials will be revoked where Gaia-X Association becomes aware of any inaccurate statements in regards to the claims which result in a non-compliance with the Trust Framework and policy rules defined in the Policy Rules and Labelling Document (PRLD).

DataAccountExportShape
type: NodeShape
target class: dataAccountExport
property:
  path: requestType
  datatype: string
  name: Request type
  min count: 1
  max count: 1
  in: API
  in: email
  in: webform
  in: unregisteredLetter
  in: registeredLetter
  in: supportCenter
property:
  path: accessType
  datatype: string
  name: Access type
  min count: 1
  max count: 1
  description: type of data support: digital, physical.
  in: digital
  in: physical
property:
  path: formatType
  datatype: string
  name: Format type
  min count: 1
  max count: 1
  pattern: ^\w+/[-+.\w]+$
  flags: i
  message: type of Media Types (formerly known as MIME types) as defined by the IANA.

SOTermsAndConditionsShape
type: NodeShape
target class: SOTermsAndConditions
property:
  path: URL
  name: URL
  description: a resolvable link to document
  min count: 1
  max count: 1
  datatype: string
property:
  path: hash
  name: hash
  min count: 1
  max count: 1
  description: sha256 hash of the above document.
  datatype: string

dependsOnExists
path: dependsOn
name: depends on
description: a resolvable link to the service offering self-description related to the service and that can exist independently of it.
min count: 1
node: ServiceOfferingShape
qualified value shape:
  class: ServiceOffering
qualified min count: 1

dependsOnNotExists
path: dependsOn
name: depends on
description: a resolvable link to the service offering self-description related to the service and that can exist independently of it.
max count: 0

aggregationOfExists
path: aggregationOf
name: aggregation of
description: a resolvable link to the resources self-description related to the service and that can exist independently of it.
min count: 1
qualified value shape:
  or:
    class: PhysicalResource
  or:
    class: VirtualResource
  or:
    class: DataResource
  or:
    class: SoftwareResource
qualified min count: 1

aggregationOfNotExists
path: aggregationOf
name: aggregation of
description: a resolvable link to the resources self-description related to the service and that can exist independently of it.
max count: 0

ServiceOfferingShape
type: NodeShape
target class: ServiceOffering
property:
  path: providedBy
  name: provided by
  description: a resolvable link to the participant self-description providing the service.
  min count: 1
  max count: 1
  node: LegalParticipant
property:
  path: termsAndConditions
  name: terms & conditions
  min count: 1
  description: a resolvable link to the service offering self-description related to the service and that can exist independently of it.
  node: SOTermsAndConditionsShape
property:
  path: policy
  name: policy
  min count: 1
  description: a list of policy expressed using a DSL (e.g., Rego or ODRL) (access control, throttling, usage, retention, …).
  datatype: string
property:
  path: dataProtectionRegime
  name: data protection regime
  description: a list of data protection regime
  in: GDPR2016
  in: LGPD2019
  in: PDPA2012
  in: CCPA2018
  in: VCDPA2021
  message: Refer to https://gaia-x.gitlab.io/policy-rules-committee/trust-framework/service_and_subclasses/#service-offering Personal Data Protection Regimes
  datatype: string
property:
  path: dataAccountExport
  name: data account export
  min count: 1
  description: list of methods to export data from your user’s account out of the service
  node: DataAccountExportShape
or:
  property: aggregationOfExists
or:
  property: aggregationOfNotExists
or:
  property: dependsOnExists
or:
  property: dependsOnNotExists

PhysicalResource
type: NodeShape
closed: false
description: A Physical resource is, but not limited to, a datacenter, a bare-metal service, a warehouse, a plant. Those are entities that have a weight and position in physical space.
name: Physical Resource
property:
  datatype: string
  description: A free text description of the entity.
  max count: 1
  name: description
  order: 7
  path: description
property:
  class: LegalParticipant
  description: A list of resolvable links to Gaia-X Credentials of participant manufacturing the resource.
  name: manufactured by
  node kind: IRI
  order: 2
  path: manufacturedBy
property:
  description: A resolvable link of resources related to the resource and that can exist independently of it.
  name: aggregation of
  or:
    class: VirtualResource
  or:
    class: PhysicalResource
  order: 5
  path: aggregationOf
property:
  class: Address
  description: A list of physical locations.
  min count: 0
  node: Address
  order: 3
  path: locationAddress
property:
  datatype: string
  description: a list of physical GPS in ISO 6709:2008/Cor 1:2009 format.
  min count: 0
  order: 4
  path: location
property:
  class: LegalParticipant
  description: A list of resolvable links to Gaia-X Credentials of participant owning the resource.
  name: owned by
  node kind: IRI
  order: 1
  path: ownedBy
property:
  class: LegalParticipant
  description: A list of resolvable links to Gaia-X Credentials of participants maintaining the resource in operational condition and thus having physical access to it.
  min count: 1
  name: maintained by
  node kind: IRI
  order: 0
  path: maintainedBy
property:
  datatype: string
  description: A human readable name of the entity.
  max count: 1
  name: name
  order: 6
  path: name

VirtualResource
type: NodeShape
closed: false
description: It represents static data in any form and necessary information such as dataset, configuration file, license, keypair, an AI model, neural network weights, etc.
name: Virtual Resource
property:
  datatype: string
  description: A free text description of the entity.
  max count: 1
  name: description
  order: 5
  path: description
property:
  datatype: string
  description: A human readable name of the entity.
  max count: 1
  name: name
  order: 4
  path: name
property:
  datatype: string
  description: A list of policy expressed using a DSL (e.g., Rego or ODRL) (access control, throttling, usage, retention, ...). If there is no specified usage policy constraints on the VirtualResource, the policy should express a simple default: allow intent
  min count: 1
  order: 2
  path: policy
property:
  description: A resolvable link of resources related to the resource and that can exist independently of it.
  name: aggregation of
  or:
    class: VirtualResource
  or:
    class: PhysicalResource
  order: 3
  path: aggregationOf
property:
  description: A list of SPDX identifiers or URL to document.
  min count: 1
  or:
    in: 0BSD
    in: AAL
    in: Abstyles
    in: AdaCore-doc
    in: Adobe-2006
    in: Adobe-Glyph
    in: ADSL
    in: AFL-1.1
    in: AFL-1.2
    in: AFL-2.0
    in: AFL-2.1
    in: AFL-3.0
    in: Afmparse
    in: AGPL-1.0-only
    in: AGPL-1.0-or-later
    in: AGPL-3.0-only
    in: AGPL-3.0-or-later
    in: Aladdin
    in: AMDPLPA
    in: AML
    in: AMPAS
    in: ANTLR-PD
    in: ANTLR-PD-fallback
    in: Apache-1.0
    in: Apache-1.1
    in: Apache-2.0
    in: APAFML
    in: APL-1.0
    in: App-s2p
    in: APSL-1.0
    in: APSL-1.1
    in: APSL-1.2
    in: APSL-2.0
    in: Arphic-1999
    in: Artistic-1.0
    in: Artistic-1.0-cl8
    in: Artistic-1.0-Perl
    in: Artistic-2.0
    in: ASWF-Digital-Assets-1.0
    in: ASWF-Digital-Assets-1.1
    in: Baekmuk
    in: Bahyph
    in: Barr
    in: Beerware
    in: Bitstream-Charter
    in: Bitstream-Vera
    in: BitTorrent-1.0
    in: BitTorrent-1.1
    in: blessing
    in: BlueOak-1.0.0
    in: Boehm-GC
    in: Borceux
    in: Brian-Gladman-3-Clause
    in: BSD-1-Clause
    in: BSD-2-Clause
    in: BSD-2-Clause-Patent
    in: BSD-2-Clause-Views
    in: BSD-3-Clause
    in: BSD-3-Clause-Attribution
    in: BSD-3-Clause-Clear
    in: BSD-3-Clause-LBNL
    in: BSD-3-Clause-Modification
    in: BSD-3-Clause-No-Military-License
    in: BSD-3-Clause-No-Nuclear-License
    in: BSD-3-Clause-No-Nuclear-License-2014
    in: BSD-3-Clause-No-Nuclear-Warranty
    in: BSD-3-Clause-Open-MPI
    in: BSD-4-Clause
    in: BSD-4-Clause-Shortened
    in: BSD-4-Clause-UC
    in: BSD-4.3RENO
    in: BSD-4.3TAHOE
    in: BSD-Advertising-Acknowledgement
    in: BSD-Attribution-HPND-disclaimer
    in: BSD-Protection
    in: BSD-Source-Code
    in: BSL-1.0
    in: BUSL-1.1
    in: bzip2-1.0.6
    in: C-UDA-1.0
  or:
    datatype: string
  order: 1
  path: license
property:
  description: A list of copyright owners either as a free form string or as resolvable link to Gaia-X Credential of participants. A copyright owner is a person or organization that has the right to exploit the resource. Copyright owner does not necessarily refer to the author of the resource, who is a natural person and may differ from copyright owner.
  min count: 1
  name: copyright owned by
  or:
    class: LegalParticipant
  or:
    datatype: string
  order: 0
  path: copyrightOwnedBy

SoftwareResource
type: NodeShape
closed: false
description: It represents static data in any form and necessary information such as dataset, configuration file, license, keypair, an AI model, neural network weights, etc.
name: Virtual Resource
property:
  datatype: string
  description: A free text description of the entity.
  max count: 1
  name: description
  order: 5
  path: description
property:
  datatype: string
  description: A human readable name of the entity.
  max count: 1
  name: name
  order: 4
  path: name
property:
  datatype: string
  description: A list of policy expressed using a DSL (e.g., Rego or ODRL) (access control, throttling, usage, retention, ...). If there is no specified usage policy constraints on the VirtualResource, the policy should express a simple default: allow intent
  min count: 1
  order: 2
  path: policy
property:
  description: A resolvable link of resources related to the resource and that can exist independently of it.
  name: aggregation of
  or:
    class: VirtualResource
  or:
    class: PhysicalResource
  order: 3
  path: aggregationOf
property:
  description: A list of SPDX identifiers or URL to document.
  min count: 1
  or:
    in: 0BSD
    in: AAL
    in: Abstyles
    in: AdaCore-doc
    in: Adobe-2006
    in: Adobe-Glyph
    in: ADSL
    in: AFL-1.1
    in: AFL-1.2
    in: AFL-2.0
    in: AFL-2.1
    in: AFL-3.0
    in: Afmparse
    in: AGPL-1.0-only
    in: AGPL-1.0-or-later
    in: AGPL-3.0-only
    in: AGPL-3.0-or-later
    in: Aladdin
    in: AMDPLPA
    in: AML
    in: AMPAS
    in: ANTLR-PD
    in: ANTLR-PD-fallback
    in: Apache-1.0
    in: Apache-1.1
    in: Apache-2.0
    in: APAFML
    in: APL-1.0
    in: App-s2p
    in: APSL-1.0
    in: APSL-1.1
    in: APSL-1.2
    in: APSL-2.0
    in: Arphic-1999
    in: Artistic-1.0
    in: Artistic-1.0-cl8
    in: Artistic-1.0-Perl
    in: Artistic-2.0
    in: ASWF-Digital-Assets-1.0
    in: ASWF-Digital-Assets-1.1
    in: Baekmuk
    in: Bahyph
    in: Barr
    in: Beerware
    in: Bitstream-Charter
    in: Bitstream-Vera
    in: BitTorrent-1.0
    in: BitTorrent-1.1
    in: blessing
    in: BlueOak-1.0.0
    in: Boehm-GC
    in: Borceux
    in: Brian-Gladman-3-Clause
    in: BSD-1-Clause
    in: BSD-2-Clause
    in: BSD-2-Clause-Patent
    in: BSD-2-Clause-Views
    in: BSD-3-Clause
    in: BSD-3-Clause-Attribution
    in: BSD-3-Clause-Clear
    in: BSD-3-Clause-LBNL
    in: BSD-3-Clause-Modification
    in: BSD-3-Clause-No-Military-License
    in: BSD-3-Clause-No-Nuclear-License
    in: BSD-3-Clause-No-Nuclear-License-2014
    in: BSD-3-Clause-No-Nuclear-Warranty
    in: BSD-3-Clause-Open-MPI
    in: BSD-4-Clause
    in: BSD-4-Clause-Shortened
    in: BSD-4-Clause-UC
    in: BSD-4.3RENO
    in: BSD-4.3TAHOE
    in: BSD-Advertising-Acknowledgement
    in: BSD-Attribution-HPND-disclaimer
    in: BSD-Protection
    in: BSD-Source-Code
    in: BSL-1.0
    in: BUSL-1.1
    in: bzip2-1.0.6
    in: C-UDA-1.0
  or:
    datatype: string
  order: 1
  path: license
property:
  description: A list of copyright owners either as a free form string or as resolvable link to Gaia-X Credential of participants. A copyright owner is a person or organization that has the right to exploit the resource. Copyright owner does not necessarily refer to the author of the resource, who is a natural person and may differ from copyright owner.
  min count: 1
  name: copyright owned by
  or:
    class: LegalParticipant
  or:
    datatype: string
  order: 0
  path: copyrightOwnedBy

InstantiatedVirtualResource
type: NodeShape
closed: false
description: An Instantiated Virtual Resource is an instance from a Virtual Resource, and is a running resource exposing endpoints such as, and not limited to, a running process, an online API, a network connection, a virtual machine, a container, an operating system.
name: Instantiated Virtual Resource
property:
  class: LegalParticipant
  description: A list of participant maintaining the resource in operational condition.
  min count: 1
  name: maintained by
  node kind: IRI
  order: 0
  path: maintainedBy
property:
  description: A resource where the process is located (physical server, datacenter, availability zone, …).
  min count: 1
  max count: 1
  name: hosted on
  or:
    class: VirtualResource
  or:
    class: PhysicalResource
  or:
    class: DataResource
  or:
    class: SoftwareResource
  order: 1
  path: hostedOn
property:
  description: A virtual resource (normally a software resource) this process is an instance of.
  min count: 1
  max count: 1
  name: instance of
  or:
    class: VirtualResource
  or:
    class: DataResource
  or:
    class: SoftwareResource
  order: 2
  path: instanceOf
property:
  class: LegalParticipant
  description: A list of participant with contractual relation with the resource.
  name: tenant owned by
  node kind: IRI
  order: 3
  path: tenantOwnedBy
property:
  class: ServiceAccessPoint
  description: A list of Service Access Point which can be an endpoint as a mean to access and interact with the resource.
  min count: 1
  name: service access point
  node kind: IRI
  order: 4
  path: serviceAccessPoint

ServiceAccessPoint
type: NodeShape
closed: false
description: A service access point is an identifying label for network endpoints used in the OSI model. The format below doesn’t represent all possible service access point types.
name: Service Access Point
property:
  path: name
  datatype: string
  max count: 1
  order: 0
property:
  path: host
  datatype: string
  max count: 1
  order: 1
property:
  path: protocol
  datatype: string
  order: 2
property:
  path: version
  datatype: string
  max count: 1
  order: 3
property:
  path: port
  datatype: string
  order: 4
property:
  path: openAPI
  datatype: string
  order: 5

DataResource
type: NodeShape
closed: false
description: A data resource is extending the DCAT-3 Dataset class and primarily refers to an analytical dataset exposed via one or more InstantiatedVirtualResource service access points.
name: Data Resource
property:
  datatype: string
  description: A free text description of the entity.
  max count: 1
  name: description
  order: 5
  path: description
property:
  datatype: string
  description: A human readable name of the entity.
  max count: 1
  name: name
  order: 4
  path: name
property:
  datatype: string
  description: A list of policy expressed using a DSL (e.g., Rego or ODRL) (access control, throttling, usage, retention, ...). If there is no specified usage policy constraints on the VirtualResource, the policy should express a simple default: allow intent
  min count: 1
  order: 2
  path: policy
property:
  description: A resolvable link of resources related to the resource and that can exist independently of it.
  name: aggregation of
  or:
    class: VirtualResource
  or:
    class: PhysicalResource
  or:
    class: DataResource
  order: 3
  path: aggregationOf
property:
  description: A list of SPDX identifiers or URL to document.
  min count: 1
  or:
    in: 0BSD
    in: AAL
    in: Abstyles
    in: AdaCore-doc
    in: Adobe-2006
    in: Adobe-Glyph
    in: ADSL
    in: AFL-1.1
    in: AFL-1.2
    in: AFL-2.0
    in: AFL-2.1
    in: AFL-3.0
    in: Afmparse
    in: AGPL-1.0-only
    in: AGPL-1.0-or-later
    in: AGPL-3.0-only
    in: AGPL-3.0-or-later
    in: Aladdin
    in: AMDPLPA
    in: AML
    in: AMPAS
    in: ANTLR-PD
    in: ANTLR-PD-fallback
    in: Apache-1.0
    in: Apache-1.1
    in: Apache-2.0
    in: APAFML
    in: APL-1.0
    in: App-s2p
    in: APSL-1.0
    in: APSL-1.1
    in: APSL-1.2
    in: APSL-2.0
    in: Arphic-1999
    in: Artistic-1.0
    in: Artistic-1.0-cl8
    in: Artistic-1.0-Perl
    in: Artistic-2.0
    in: ASWF-Digital-Assets-1.0
    in: ASWF-Digital-Assets-1.1
    in: Baekmuk
    in: Bahyph
    in: Barr
    in: Beerware
    in: Bitstream-Charter
    in: Bitstream-Vera
    in: BitTorrent-1.0
    in: BitTorrent-1.1
    in: blessing
    in: BlueOak-1.0.0
    in: Boehm-GC
    in: Borceux
    in: Brian-Gladman-3-Clause
    in: BSD-1-Clause
    in: BSD-2-Clause
    in: BSD-2-Clause-Patent
    in: BSD-2-Clause-Views
    in: BSD-3-Clause
    in: BSD-3-Clause-Attribution
    in: BSD-3-Clause-Clear
    in: BSD-3-Clause-LBNL
    in: BSD-3-Clause-Modification
    in: BSD-3-Clause-No-Military-License
    in: BSD-3-Clause-No-Nuclear-License
    in: BSD-3-Clause-No-Nuclear-License-2014
    in: BSD-3-Clause-No-Nuclear-Warranty
    in: BSD-3-Clause-Open-MPI
    in: BSD-4-Clause
    in: BSD-4-Clause-Shortened
    in: BSD-4-Clause-UC
    in: BSD-4.3RENO
    in: BSD-4.3TAHOE
    in: BSD-Advertising-Acknowledgement
    in: BSD-Attribution-HPND-disclaimer
    in: BSD-Protection
    in: BSD-Source-Code
    in: BSL-1.0
    in: BUSL-1.1
    in: bzip2-1.0.6
    in: C-UDA-1.0
  or:
    datatype: string
  order: 1
  path: license
property:
  description: A list of copyright owners either as a free form string or as resolvable link to Gaia-X Credential of participants. A copyright owner is a person or organization that has the right to exploit the resource. Copyright owner does not necessarily refer to the author of the resource, who is a natural person and may differ from copyright owner.
  min count: 1
  name: copyright owned by
  or:
    class: LegalParticipant
  or:
    datatype: string
  order: 0
  path: copyrightOwnedBy
property:
  class: LegalParticipant
  description: a resolvable link to the participant self-description legally enabling the data usage.
  name: produced by
  node kind: IRI
  min count: 1
  max count: 1
  order: 2
  path: producedBy
property:
  class: ServiceOffering
  description: A resolvable link to the data exchange component that exposes the data resource.
  min count: 1
  name: exposed through
  node kind: IRI
  path: exposedThrough
property:
  datatype: dateTime
  description: date time in ISO 8601 format after which data is obsolete.
  name: obsolete date time
  min count: 0
  max count: 1
  path: obsoleteDateTime
property:
  datatype: dateTime
  description: date time in ISO 8601 format after which data is expired and shall be deleted.
  name: expiration date time
  min count: 0
  max count: 1
  path: expirationDateTime
property:
  datatype: boolean
  description: Whether the service contains Personal Identifiable Informations.
  name: contains PII
  min count: 1
  max count: 1
  path: containsPII

Address
type: NodeShape
closed: false
description: Full address of the entity.
ignored properties: type
property:
  datatype: string
  description: String of a street-address
  max count: 1
  order: 3
  path: postal-code
property:
  datatype: string
  description: the street address of a postal address
  max count: 1
  order: 2
  path: street-address
property:
  description: Country code in ISO 3166-1 alpha2, alpha-3 or numeric format.
  max count: 1
  min count: 1
  or:
    in: AF
    in: EG
    in: AX
    in: AL
    in: DZ
    in: VI
    in: UM
    in: AS
    in: AD
    in: AO
    in: AI
    in: AQ
    in: AG
    in: GQ
    in: SY
    in: AR
    in: AM
    in: AW
    in: AZ
    in: ET
    in: AU
    in: BS
    in: BH
    in: BD
    in: BB
    in: BE
    in: BZ
    in: BJ
    in: BM
    in: BT
    in: VE
    in: BQ
    in: BA
    in: BW
    in: BV
    in: BR
    in: VG
    in: IO
    in: BN
    in: BG
    in: BF
    in: BI
    in: CV
    in: CL
    in: CN
    in: CK
    in: CR
    in: CI
    in: CW
    in: DK
    in: CD
    in: KP
    in: LA
    in: DE
    in: DM
    in: DO
    in: DJ
    in: EC
    in: MK
    in: SV
    in: ER
    in: EE
    in: FK
    in: FO
    in: FJ
    in: FI
    in: FM
    in: FR
    in: TF
    in: GF
    in: PF
    in: GA
    in: GM
    in: GE
    in: GH
    in: GI
    in: GD
    in: GR
    in: GL
    in: GP
  or:
    in: AFG
    in: ALA
    in: ALB
    in: DZA
    in: ASM
    in: AND
    in: AGO
    in: AIA
    in: ATA
    in: ATG
    in: ARG
    in: ARM
    in: ABW
    in: AUS
    in: AUT
    in: AZE
    in: BHS
    in: BHR
    in: BGD
    in: BRB
    in: BLR
    in: BEL
    in: BLZ
    in: BEN
    in: BMU
    in: BTN
    in: BOL
    in: BES
    in: BIH
    in: BWA
    in: BVT
    in: BRA
    in: IOT
    in: BRN
    in: BGR
    in: BFA
    in: BDI
    in: KHM
    in: CMR
    in: CAN
    in: CPV
    in: CYM
    in: CAF
    in: TCD
    in: CHL
    in: CHN
    in: CXR
    in: CCK
    in: COL
    in: COM
    in: COG
    in: COD
    in: COK
    in: CRI
    in: CIV
    in: HRV
    in: CUB
    in: CUW
    in: CYP
    in: CZE
    in: DNK
    in: DJI
    in: DMA
    in: DOM
    in: ECU
    in: EGY
    in: SLV
    in: GNQ
    in: ERI
    in: EST
    in: ETH
    in: FLK
    in: FRO
    in: FJI
    in: FIN
    in: FRA
    in: GUF
    in: PYF
    in: ATF
    in: GAB
  or:
    in: 4
    in: 818
    in: 248
    in: 008
    in: 10
    in: 850
    in: 581
    in: 14
    in: 16
    in: 20
    in: 660
    in: 8
    in: 028
    in: 226
    in: 760
    in: 26
    in: 41
    in: 231
    in: 30
    in: 36
    in: 048
    in: 40
    in: 42
    in: 46
    in: 084
    in: 204
    in: 48
    in: 52
    in: 58
    in: 60
    in: 62
    in: 092
    in: 086
    in: 854
    in: 108
    in: 132
    in: 152
    in: 156
    in: 184
    in: 188
    in: 384
    in: 531
    in: 208
    in: 180
    in: 408
    in: 418
    in: 276
    in: 212
    in: 214
    in: 262
    in: 218
    in: 807
    in: 222
    in: 232
    in: 233
    in: 238
    in: 234
    in: 242
    in: 246
    in: 583
    in: 250
    in: 260
    in: 254
    in: 258
    in: 266
    in: 270
    in: 268
    in: 288
    in: 292
    in: 308
    in: 300
    in: 304
    in: 312
    in: 316
    in: 320
    in: 831
    in: 324
    in: 624
    in: 328
    in: 332
  order: 0
  path: countryCode

LegitimateInterest
type: NodeShape
property:
  path: legalBasis
  name: legal basis
  description: Reasons to process PII as detailed in your personal data protection regime
  min count: 1
  max count: 1
  datatype: string
property:
  path: dataProtectionContact
  name: data protection contact
  min count: 1
  max count: 1
  description: an URL pointing to a contact form or an emailaddress.
  datatype: string

ServiceOfferingLabelShape
type: NodeShape
target class: ServiceOfferingLabelLevel1
property:
  or:
    node: ServiceOfferingShape
    class: ServiceOffering
  path: assignedTo
  name: Assigned to
  description: a resolvable link to the service offering self-description to which label level is assigned to.
  min count: 1
  max count: 1
property:
  path: criteria
  name: Criteria
  description: Gaia-X Policy Rules and Labelling Criteria for Providers
  min count: 1
  max count: 1
  node: ServiceOfferingCriteriaShape

ServiceOfferingCriteriaShape
type: NodeShape
target class: ServiceOfferingCriteria
property:
  path: P1.1.1
  name: Criterion P1.1.1
  description: The Provider shall offer the ability to establish a legally binding act. This legally binding act shall be documented.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.1.2
  name: Criterion P1.1.2
  description: The Provider shall have an option for each legally binding act to be governed by EU/EEA/Member State law.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.1.3
  name: Criterion P1.1.3
  description: The Provider shall clearly identify for which parties the legal act is binding.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.1.4
  name: Criterion P1.1.4
  description: The Provider shall ensure that the legally binding act covers the entire provision of the Service Offering.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.1
  name: Criterion P1.2.1
  description: The Provider shall ensure there are specific provisions regarding service interruptions and business continuity (e.g., by means of a service level agreement), Provider’s bankruptcy or any other reason by which the Provider may cease to exist in law.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.2
  name: Criterion P1.2.2
  description: The Provider shall ensure there are provisions governing the rights of the parties to use the service and any Customer Data therein.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.3
  name: Criterion P1.2.3
  description: The Provider shall ensure there are provisions governing changes, regardless of their kind.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.4
  name: Criterion P1.2.4
  description: The Provider shall ensure there are provisions governing aspects regarding copyright or any other intellectual property rights.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.5
  name: Criterion P1.2.5
  description: The Provider shall declare the location of the processing of any Customer Data at urban area level.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.6
  name: Criterion P1.2.6
  description: The Provider shall explain how information about subcontractors and related Customer Data localization will be communicated.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.7
  name: Criterion P1.2.7
  description: The Provider shall communicate to the Customer where the applicable jurisdiction(s) of subcontractors will be.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.8
  name: Criterion P1.2.8
  description: The Provider shall include in the contract the contact details where Customer may address any queries regarding the Service Offering and the contract.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.9
  name: Criterion P1.2.9
  description: The Provider shall adopt the Gaia-X Trust Framework, by which Customers may verify Provider’s Service Offering.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.2.10
  name: Criterion P1.2.10
  description: The Provider shall provide transparency on the environmental impact of the Service Offering provided
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.3.1
  name: Criterion P1.3.1
  description: Service Offering shall include a policy using a common Domain-Specific Language (DSL) to describe Permissions, Requirements and Constraints.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.3.2
  name: Criterion P1.3.2
  description: Service Offering requires being operated by Service Offering Provider with a verified identity.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.3.3
  name: Criterion P1.3.3
  description: Service Offering must provide a conformant self-description.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.3.4
  name: Criterion P1.3.4
  description: Self-Description attributes need to be consistent across linked Self-Descriptions.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P1.3.5
  name: Criterion P1.3.5
  description: The Provider shall ensure that the Consumer uses a verified identity provided by the Federator.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.1.1
  name: Criterion P2.1.1
  description: The Provider shall offer the ability to establish a contract under Union or EU/EEA/Member State law and specifically addressing GDPR requirements.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.1.2
  name: Criterion P2.1.2
  description: The Provider shall define the roles and responsibilities of each party.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.1.3
  name: Criterion P2.1.3
  description: The Provider shall clearly define the technical and organizational measures in accordance with the roles and responsibilities of the parties, including an adequate level of detail.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.1
  name: Criterion P2.2.1
  description: The Provider shall be ultimately bound to instructions of the Customer.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.2
  name: Criterion P2.2.2
  description: The Provider shall clearly define how Customer may instruct, including by electronic means such as configuration tools or APIs.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.3
  name: Criterion P2.2.3
  description: The Provider shall clearly define if and to which extent third country transfer will take place.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.4
  name: Criterion P2.2.4
  description: The Provider shall clearly define if and to the extent third country transfers will take place, and by which means of Chapter V GDPR these transfers will be protected.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.5
  name: Criterion P2.2.5
  description: The Provider shall clearly define if and to which extent sub-processors will be involved.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.6
  name: Criterion P2.2.6
  description: The Provider shall clearly define if and to the extent sub-processors will be involved, and the measures that are in place regarding sub-processors management.
  max count: 1
  min count: 1
  node: CriteriaResponseShape
property:
  path: P2.2.7
  name: Criterion P2.2.7
  description: The Provider shall define the audit rights for the Customer.
  max count: 1
  min count: 1
  node: CriteriaResponseShape

CriteriaResponseShape
type: NodeShape
target class: CriteriaResponse
property:
  path: response
  name: Response
  in: Confirm
  in: Deny
  in: Not applicable
  min count: 1
  max count: 1
property:
  path: reason
  name: Optional reason when not applicable
  datatype: string
  max count: 1
property:
  path: evidence
  name: Evidence
  max count: 1
  node: CriteriaEvidenceShape

CriteriaEvidenceShape
type: NodeShape
target class: CriteriaEvidence
property:
  path: website
  name: Website
  description: Link to website to complete evidence information
  datatype: string
  max count: 1
property:
  path: https://registry.lab.gaia-x.eu/development/api/trusted-shape-registry/v1/shapes/jsonld/trustframework#pdf
  name: Attestation PDF
  description: Link to attestation PDF to complete evidence information
  datatype: string
  max count: 1

datatype: string
description: GPS in ISO 6709:2008/Cor 1:2009 format.
max count: 1
order: 1
path: gps

datatype: string
description: The v:locality property specifies the locality (e.g., city) of a postal address.
max count: 1
order: 4
path: locality

path: P2.3.1
name: Criterion P2.3.1
description: In case of a joint controllership, the Provider shall ensure an arrangement pursuant to Art. 26 (1) GDPR is in place.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P2.3.2
name: Criterion P2.3.2
description: In case of a joint controllership, at a minimum, the Provider shall ensure that the very essence of such agreement is communicated to data subjects.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P2.3.3
name: Criterion P2.3.3
description: In case of a joint controllership, the Provider shall publish a point of contact for data subjects.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.1
name: Criterion P3.1.1
description: Organization of information security: Plan, implement, maintain and continuously improve the information security framework within the organisation.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.2
name: Criterion P3.1.2
description: Information Security Policies: Provide a global information security policy, derived into policies and procedures regarding security requirements and to support business requirements.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.3
name: Criterion P3.1.3
description: Risk Management: Ensure that risks related to information security are properly identified, assessed, and treated, and that the residual risk is acceptable to the CSP.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.4
name: Criterion P3.1.4
description: Human Resources: Ensure that employees understand their responsibilities, are aware of their responsibilities with regard to information security, and that the organisation’s assets are protected in the event of changes in responsibilities or termination.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.5
name: Criterion P3.1.5
description: Asset Management: Identify the organisation’s own assets and ensure an appropriate level of protection throughout their lifecycle.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.6
name: Criterion P3.1.6
description: Physical Security: Prevent unauthorised physical access and protect against theft, damage, loss and outage of operations.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.7
name: Criterion P3.1.7
description: Operational Security: Ensure proper and regular operation, including appropriate measures for planning and monitoring capacity, protection against malware, logging and monitoring events, and dealing with vulnerabilities, malfunctions and failures.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.8
name: Criterion P3.1.8
description: Identity, Authentication and access control management: Limit access to information and information processing facilities.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.9
name: Criterion P3.1.9
description: Cryptography and Key management: Ensure appropriate and effective use of cryptography to protect the confidentiality, authenticity or integrity of information.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.10
name: Criterion P3.1.10
description: Communication Security: Ensure the protection of information in networks and the corresponding information processing systems.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.11
name: Criterion P3.1.11
description: Portability and Interoperability: The CSP shall provide a means by which a customer can obtain their stored customer data, and provide documentation on how (where appropriate, through documented API’s) the CSC can obtain the stored data at the end of the contractual relationship and shall document how the data will be securely deleted from the Cloud Service Provider in what timeframe.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.12
name: Criterion P3.1.12
description: Change and Configuration Management: Ensure that changes and configuration actions to information systems guarantee the security of the delivered cloud service.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.13
name: Criterion P3.1.13
description: Development of Information systems: Ensure information security in the development cycle of information systems.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.14
name: Criterion P3.1.14
description: Procurement Management: Ensure the protection of information that suppliers of the CSP can access and monitor the agreed services and security requirements.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.15
name: Criterion P3.1.15
description: Incident Management: Ensure a consistent and comprehensive approach to the capture, assessment, communication and escalation of security incidents.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.16
name: Criterion P3.1.16
description: Business Continuity: Plan, implement, maintain and test procedures and measures for business continuity and emergency management.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.17
name: Criterion P3.1.17
description: Compliance: Avoid non-compliance with legal, regulatory, self-imposed or contractual information security and compliance requirements.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.18
name: Criterion P3.1.18
description: User documentation: Provide up-to-date information on the secure configuration and known vulnerabilities of the cloud service for cloud customers.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.19
name: Criterion P3.1.19
description: Dealing with information requests from government agencies: Ensure appropriate handling of government investigation requests for legal review, information to cloud customers, and limitation of access to or disclosure of Customer Data.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P3.1.20
name: Criterion P3.1.20
description: Product safety and security: Provide appropriate mechanisms for cloud customers to enable product safety and security.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P4.1.1
name: Criterion P4.1.1
description: The Provider shall implement practices for facilitating the switching of Providers and the porting of Customer Data in a structured, commonly used and machine-readable format including open standard formats where required or requested by the Customer.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P4.1.2
name: Criterion P4.1.2
description: The Provider shall ensure pre-contractual information exists, with sufficiently detailed, clear and transparent information regarding the processes of Customer Data portability, technical requirements, timeframes and charges that apply in case a professional user wants to switch to another Provider or port Customer Data back to its own IT systems.
max count: 1
min count: 1
node: CriteriaResponseShape

path: P5.1.1
name: Criterion P5.1.1
description: For Label Level 2, the Provider shall provide the option that all Customer Data are processed and stored exclusively in EU/EEA.
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.2
name: Criterion P5.1.2
description: For Label Level 3, the Provider shall process and store all Customer Data exclusively in the EU/EEA.
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.3
name: Criterion P5.1.3
description: For Label Level 3, where the Provider or subcontractor is subject to legal obligations to transmit or disclose Customer Data on the basis of a non-EU/EEA statutory order, the Provider shall have verified safeguards in place to ensure that any access request is compliant with EU/EEA/Member State law.
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.4
name: Criterion P5.1.4
description: For Label Level 3, the Provider’s registered head office, headquarters and main establishment shall be established in a Member State of the EU/EEA.
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.5
name: Criterion P5.1.5
description: For Label Level 3, Shareholders in the Provider, whose registered head office, headquarters and main establishment are not established in a Member State of the EU/EEA shall not, directly or indirectly, individually or jointly, hold control of the CSP. Control is defined as the ability of a natural or legal person to exercise decisive influence directly or indirectly on the CSP through one or more intermediate entities, de jure or de facto. (cf. Council Regulation No 139/2004 and Commission Consolidated Jurisdictional Notice under Council Regulation (EC) No 139/2004 for illustrations of decisive control).
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.6
name: Criterion P5.1.6
description: For Label Level 3, in the event of recourse by the Provider, in the context of the services provided to the Customer, to the services of a third-party company - including a subcontractor - whose registered head office, headquarters and main establishment is outside of the European Union or who is owned or controlled directly or indirectly by another third-party company registered outside the EU/EEA, the third-party company shall have no access over the Customer Data nor access and identity management for the services provided to the Customer. The Provider, including any of its sub-processor, shall push back any request received from non-European authorities to obtain communication of Customer Data relating to European Customers, except if request is made in execution of a court judgment or order that is valid and compliant under Union law and applicable Member States law as provided by Article 48 GDPR.
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.1.7
name: Criterion P5.1.7
description: For Label Level 3, the Provider must maintain continuous operating autonomy for all or part of the services it provides. The concept of operating autonomy shall be understood as the ability to maintain the provision of the cloud computing service by drawing on the provider’s own skills or by using adequate alternatives
max count: 1
min count: 0
node: CriteriaResponseShape

path: P5.2.1
name: Criterion P5.2.1
description: The Provider shall not access Customer Data unless authorized by the Customer or when the access is in accordance with EU/EEA/Member State law.
max count: 1
min count: 1
node: CriteriaResponseShape