← Infrastructure analysis

Digital sovereignty

Which FTSE 100 companies rely on a US-controlled company for their DNS, domain registrar, TLS certificate, primary web host and inbound mail — and which don't. "US-controlled" means ultimate corporate ownership, not the registration jurisdiction of the specific entity or hostname observed: a subsidiary like Google Ireland or DigiCert Ireland Limited still counts as American.

Not one of the 100 FTSE 100 companies avoids US-controlled infrastructure entirely.

By category

Each category scored independently: US-controlled if any observed vendor in that category traces to a US-owned company, non-US only if every observed vendor is confidently otherwise, unresolved where a vendor couldn't be confidently attributed, and not observed where OSIC has no data for that category yet — mainly TLS issuer and hosting, which need a completed site crawl.

Closest to fully sovereign

All 100 companies

US-controlled Non-US Unresolved Not observed

Methodology & caveats

Ultimate corporate ownership is judged from public information at the time of this snapshot, not a definitive corporate-ownership record. Three calls worth knowing about:

• Incapsula / Imperva — every ASN record still literally reads "Incapsula Inc, US". It's stale: Imperva was acquired by France's Thales Group, completed December 2023. Scored non-US here.
• Sectigo Limited — the certificate-issuing entity is UK-registered (the old Comodo CA), but Sectigo's operating HQ and majority ownership (Certares/Haveli, both US private equity) are American. Scored US, medium confidence.
• Mimecast — UK-incorporated, taken private in 2022 by Permira (UK/pan-European PE). Scored non-US despite a long US operating history.

A company's overall score counts only categories confirmed non-US — an unresolved vendor or a category with no data yet counts as zero, the same as a confirmed-US category. It is never counted as sovereignty by default. See the full vendor classification table for exactly how each vendor was scored.