MYRTUS and Gaia-X

Verifiable trust across the computing continuum

The MYRTUS continuum brings together computing clusters run by different organisations at different sites. Before a new cluster joins, it should be possible to check, in a verifiable way, who operates it and whether it meets a common set of rules. MYRTUS has explored how the Gaia-X Trust Framework can support this step, and has developed a proof-of-concept compliance service designed to run when a cluster joins the federation.

The Gaia-X Trust Framework

Gaia-X aims to bring together cloud and data services from many providers, built on different standards and architectures, and make them work together securely. Trust is the foundation of such a federation: participants must prove who they are, and their claims about security and compliance must be checkable by anyone.

The Gaia-X Trust Framework makes these claims transparent and verifiable. Each claim is a W3C Verifiable Credential, a digitally signed statement in which any change invalidates the signature. Compliance rules are often written in the Shape Constraint Language (SHACL), so a validation engine can check credentials against them automatically. The framework defines three trust levels, each building on the previous one:

MYRTUS proof of concept

Basic

Verified legal identity of the organisation and a signed self-description, for every Gaia-X participant.

Substantial

Stronger security and data protection controls, with evidence of certifications such as GDPR compliance or ISO 27001.

High

Maximum assurance on sovereignty, including headquarters in the EU, restrictions on non-EU access and external audits.

The MYRTUS rules

The proof of concept works at the basic trust level, the most stable and best-supported part of the framework. MYRTUS has formalised its own rules as SHACL shapes, applied to three Gaia-X credentials of the organisation that operates a cluster. Together, they check that the organisation has a registration number, a VAT number and addresses in the European Union, and that it refers to the Gaia-X Terms and Conditions.

Legal person

  • At least one registration number
  • Headquarters address in an EU member state
  • Legal address in an EU member state

Terms and conditions

  • A reference to the Gaia-X Terms and Conditions, identified by their hash

VAT ID

  • A VAT identification number
  • A country code of an EU member state

How the compliance check works

The compliance service is built on the Gaia-X Danube framework and is designed to be used during cluster onboarding. Since the check takes place when a cluster joins the federation, it could apply to any cluster, whatever its layer in the continuum.

  1. Verify

    The cluster's credentials are submitted as a signed Verifiable Presentation. The signature is checked with the public key of the issuer and the claims are decoded.

  2. Validate

    The verified claims are evaluated against the MYRTUS SHACL rules on the Danube platform. If they match, the candidate cluster is accepted as compliant.

  3. Report

    The service issues a compliance report, itself a signed Verifiable Credential, which can be used to show that the cluster meets the MYRTUS rules.

A contribution to the Gaia-X ecosystem

The MYRTUS validation rules have been integrated into the Gaia-X Danube framework as an extension of its compliance validation. Through the Danube compliance dispatcher, MYRTUS is available as a provider that users can select to validate their credentials. The rules are therefore potentially available beyond the project, to the wider Gaia-X ecosystem and to other organisations that want to apply them in their own compliance processes.

Looking ahead

The same approach could grow with the framework. Credentials attesting GDPR compliance or ISO 27001 certification, which correspond to the higher Gaia-X trust levels, could be taken into account before deploying a task or transferring data, for example to keep sensitive data on nodes in a given jurisdiction.

MYRTUS in the Gaia-X community

Since the start of the project, MYRTUS partners have followed and contributed to the Gaia-X community. SOFTEAM took part in the plenary sessions of the Gaia-X Hub France, ArubaKube presented Liqo at the Gaia-X Summit 2024, and TNO presented the MYRTUS compliance service at the Gaia-X Summit 2025 and at Gaia-X Tech-X 2026.

Contact us