Compliance assessment

1. What was assessed

This page records the position of the PACT toolkit against the two standards that matter for a European data space: participant identity and trust (Gaia-X Trust Framework) and the exchange of offers, agreements and data (Data Space Protocol). Each claim is dated and rests on an archived run or a signed document.

2. Interoperability

The Data Space Protocol implementation was exercised against the official Eclipse DSP Technology Compatibility Kit in pinned, archived runs, and re-run live after the peer-authentication hardening of this release.

• Executable checks: 65 of 65 green in the archived runs (2026-10-07/08) and in the live re-run (2026-10-14).
• Harness: isolated, network-restricted, one container per role.
• Artifacts: logs, run identifiers and harness configuration archived with the release.

3. Trust framework readiness

• Readiness matrix: 8 met · 0 missing (state of 2026-10-14).
• In progress: the compliance credential issued by the external compliance engine.
• Declared external: the institutional trust anchor (qualified TSP / eIDAS).

4. What is verified per exchange

Organisation identity is validated against public business registries before a participant is admitted. Credentials are schema-validated against the official registry shapes, and revocation is supported through a status list, so a compromised identity can be withdrawn without rebuilding the ecosystem. Every agreement and every release of access is signed and retained.

5. Known limitations

We publish the gaps as readily as the passes:

• The compliance credential depends on an external compliance engine that is still being onboarded.
• The institutional trust anchor is provided by the customer’s qualified trust service provider.
• Conformance is demonstrated against the published kit version; a new major protocol revision requires a new run.

6. Obtaining the full assessment

The complete pack — archived runs, readiness matrix, security assessment, dependency and licence inventory, and the claims registry that maps each statement to its source — is shared with customers and evaluators on request, under the confidentiality terms of the engagement.

Request the compliance assessment pack