Updates

Fair order for equal scores, menu on mobile

Vendors with the same score are no longer listed alphabetically but in an order that changes on every visit. The order by score stays the same. This way vendors later in the alphabet also reach the top, on category, country and open-source pages. On phones and tablets the menu now sits behind a menu button. Category pages without a booked sponsor show the banner of Accans, which sponsors the site in kind with hosting, domain names and development time.

Sponsorship easier to find, citation in one click

On category pages the sponsor slot now sits right under the heading instead of after the introduction; its space is reserved from the start, so the page does not jump. Under "Cite this page" on the statistics page you copy the citation in one click and can share the page straight away. The header has a Sponsorship button, and the submit page explains how sponsorship gives you 12 months of extra visibility on a category of your choice.

Sharing, and submitting a vendor from the header

Statistics, vendor, category and country pages and the changelog now have share buttons for Mastodon, LinkedIn, Bluesky, X and email, plus a copy-link button. The figure on European alternatives to US services can be shared on its own. The buttons are plain links: nothing loads from another network until you click. Submitting a vendor is now a button in the header.

Advertising is now called sponsorship

The paid banner on category pages is now called sponsorship and is labelled "Sponsored". It still never affects a score or a position. The page, the order flow, the confirmation mails and the footer use the same wording, in all four languages.

Statistics, trends, changelog and documentation in the new design

The statistics page, the trends page, this changelog and the documentation now share the layout of the rest of the site: large figures, calmer tables and more readable documents. Every changelog entry now has its own link, also when several appeared on the same day.

Licence, contact and thank-you pages in the new design

The licence terms, the business data licence page, the contact page and the thank-you page after a donation now share the layout of the rest of the site. The business licence shows its price and mail button in a card of their own.

Order status and report builder in the new design

After paying, the order page shows the status in a clear card with a large download button. The whitelabel report builder has larger fields, the language choice next to the preparer's name and a count of the reports used next to the button.

New figure: European alternatives to US services

The statistics page now shows for how many US services with European alternatives selected by us there is an alternative with a sovereignty score above 80, with a note on how it is counted.

Order page in the new design

Each report's order page now shows a summary with price, contents and the other variants next to the order form; on a phone the summary comes first. The form has larger fields and a clearer pay button.

Easier to read for AI assistants

AI assistants that ask for Markdown now get the vendor, category, country and open-source pages as clean text with scores, facts and links, straight from the knowledge base. robots.txt now states our policy: search engines and AI assistants may use the site to answer questions, but not to train AI models.

Shared links show the right page

Sharing a page such as 'About', 'Map' or 'Contact' on LinkedIn or in a chat showed the home page's title and link. Every page now has its own title, description and link in that preview.

New address: eusovereigntyscore.eu

The site moves to eusovereigntyscore.eu. Existing links and bookmarks to digitalsovereignty.accans.com keep working: they forward to the same page on the new address.

Map and country pages count the same

The map counted a vendor listed in several categories once (Germany: 929), while the country page counts every listing (Germany: 1,006). The map now follows the country page, so both show the same number for every country.

Open-source pages in the new design

The open-source overview now shows every category in one list with its number of open-source vendors. Each category page lists the vendors with their sovereignty score, sortable by score, A to Z or country.

23 more vendors: web hosting, whiteboards and writing tools

Round eight adds 23 vendors in 4 categories, 8 of them European. The knowledge base now lists 6,277 vendors.

Over 6,000 vendors: 927 more across 78 categories

Round seven adds 927 vendors across 78 categories, 345 of them European. The knowledge base now lists 6,254 vendors.

338 more vendors: telephony, compliance, workflow, AI and hosting

Round six adds 338 vendors in 32 categories, 148 of them European. The knowledge base now lists 5,327 vendors.

265 more vendors: payments, marketing, fintech, healthcare and more

Round five of the country-by-country sweep adds 265 vendors in 36 categories, 260 of them European. The knowledge base now lists 4,989 vendors.

293 more vendors, mostly European: fintech, e-commerce, accounting and more

A country-by-country sweep adds 293 vendors in 34 categories, 289 of them European. The knowledge base now lists 4,724 vendors.

154 more vendors: streaming, booking, logistics and telephony

Round three of the category sweep adds 154 vendors in 21 categories, 94 of them European. The knowledge base now lists 4,431 vendors.

260 more vendors: IoT, identity, legal tech and more

Round two of the category sweep adds 260 vendors in 32 categories, 173 of them European. The knowledge base now lists 4,277 vendors.

363 more vendors: the catalogue passes 4,000

A sweep across 48 categories fills gaps in the knowledge base, including 202 European providers. Every vendor has sources and an introduction in four languages.

105 more vendors for email marketing and AI

53 email marketing platforms, with AGNITAS and other European providers as alternatives, and 52 AI agents, automation platforms and local AI apps. Each with sources and an introduction in four languages.

• Acumbamail
• Clever Elements
• Deployteq
• E-goi
• ELAINE
• eMarketeer
• Flexmail
• JUNE Online Marketing Cloud
• Laposta
• Mailingwork
• MailUp
• Manago AI
• NewsMAN
• Positive User
• Sana Agents
• Spotler SendPro
• Ui.Vision RPA

A quieter footer

The footer and a few page titles now name only the EU Sovereignty Score; who runs the site is in the colophon and the line at the bottom of the page.

Country pages with scores

Every country page now shows all vendors from that country with their sovereignty score (0 = high exposure, 100 = sovereign), sortable by score, alphabet or category, plus an overview by category.

New map of European software

The map shows how many European vendors are headquartered in each country, with a panel for the chosen country and a list of every country. The map runs entirely on our own server: no request goes to an external map service.

Searching alternatives and browsing categories

The alternatives page now starts with one search box and popular searches. Below it, each category shows how many vendors are European, as a number and as a bar. The categories overview shows this for every category.

Methodology on one clear page

The About page now shows at a glance how the score works: five dimensions weighted 20% each, the scale from 0 (high exposure) to 100 (sovereign), how we check vendors and what the evidence labels mean.

Submitting a vendor in three sections

The submission form is split into the product, optional evidence that speeds up the check, and your details. Beside it is what we check before a listing goes live, and that a listing cannot be bought.

New page for advertisers

The advertising page shows the price, the format, the number of slots per category, what an ad does and does not buy, and the house rules beside the booking form at a glance.

New support page

On the support page you choose an amount and see what your donation pays for. Below it are the other ways to support the tool. The donation bar at the bottom does not appear on this page.

Choosing vendors in the assessment is quicker

You now search the whole knowledge base at once, click the well-known vendors per category directly and always see your selection beside the list. From that selection you go straight to your score, or first to the optional context.

New pricing page

The pricing page shows the three report variants side by side, with what each one includes. Below them are the business licence and the option to support the knowledge base with a donation.

New assessment result page

The result shows your score with the five dimensions next to the heatmap per category, followed by the main risk factors and two European alternatives per vendor with their score. The report contains the remaining alternatives, the board questions and the migration path.

Category pages with scores and sorting

Every category page now shows each vendor's sovereignty score and lets you sort by most sovereign, A to Z or country. The non-European vendors in the category also show their score, with the number of European alternatives.

Vendor pages in the new design

Every vendor page now shows the sovereignty score at the top with its five dimensions and a short explanation for each, a facts table in which the key facts carry their evidence level, and the European alternatives, each with its own score.

New home page

The home page now shows a real example result (the demo stack, computed with the same model as the assessment), what the free assessment and the report give you, how our data is built and why it matters now.

New name: EU Sovereignty Score

The Digital Sovereignty Heatmap is now called EU Sovereignty Score, with a new logo, colours and typefaces. The tool, the knowledge base and the method stay the same.

The score now runs upwards: 100 is sovereign

The sovereignty score has been flipped. 0 now means high exposure, 100 means sovereign; higher is better. Every score is mirrored (new = 100 − old), so the relative order and the assessment itself are unchanged.

New: Mailcoach, and security.txt links disappear after their expiry date

Mailcoach, a Belgian email marketing platform, is now in the catalogue. In addition, a vendor page no longer shows a security.txt file once the expiry date in that file has passed.

• Mailcoach

Owner and website updated for five security vendors

During the CRA research we found vendors that have changed owner or website. That information is now up to date, each with sources.

• Libraesva
• CyberArk
• Venafi
• TheHive

CRA signals for cybersecurity vendors

The Cyber Resilience Act signals now also appear for all 81 vendors in the cybersecurity category, such as endpoint protection, firewalls, SIEM and identity management. They do not count towards the score.

• Greenbone
• Stormshield
• Myra Security
• Passbolt

CRA signals for password managers, VPNs, browsers and more

The Cyber Resilience Act signals now also appear for 190 vendors of password managers, VPNs, operating systems, browsers, virtualisation and network equipment: the product types the CRA marks as important products. They do not count towards the score.

• Bitwarden
• Mullvad VPN
• Debian
• Proxmox VE

Switzerland gets its own place in the data residency score

Switzerland is not an EU member, but the EU recognises Swiss data protection as adequate. Hosting in Switzerland therefore now scores between EU hosting and hosting outside Europe. Hosting in Norway, Iceland and Liechtenstein counts as EU, because the GDPR applies there directly.

• Infomaniak
• Proton
• Threema
• Tresorit

Pilot: Cyber Resilience Act signals for CMS vendors

The 37 vendors in the CMS category now show which CRA signals can be found publicly, such as a security.txt, a way to report vulnerabilities and a supported-versions policy. They do not count towards the score.

• TYPO3
• Drupal (self-host)
• WordPress (self-host)
• Umbraco

Over 800 vendor records corrected

While writing the introductions we re-checked every vendor on the web. That surfaced over 800 outdated or incorrect records: headquarters, owners, licences, new product names and where data is stored.

• Pipedrive
• Tricentis
• Wire
• EQS Group
• Youtrust (formerly Yousign)
• HashiCorp Vault

New: the Cyber Resilience Act explained

A new page explains what the EU Cyber Resilience Act means when you buy software: the timeline, what vendors must do and what you can ask for from December 2027.

Catalogue clean-up: 64 vendors removed, 16 updated

Vendors that no longer exist or were absorbed into another product have been removed; their old pages now redirect to the successor or to the category. Sixteen products with a new name or website have been updated.

• Vantor (formerly Maxar Intelligence)
• RIB BI+ (formerly datapine)
• Actian Data Intelligence Platform (formerly Zeenea)
• Wuunder (formerly Paazl)
• Lucen Track (formerly Timeneye)

Two discontinued identity services removed

yes.com and Verimi are no longer in the catalogue: both services have been or are being discontinued.

AI meeting note-takers added, with European alternatives

Fathom, Granola and Google AI Edge Foresight are now in the catalogue. As European alternatives to Fathom and Granola we list Sally, Noota, Leexi, Jamie and tl;dv.

• Fathom (AI notetaker)
• Granola
• Google AI Edge Foresight
• Sally
• Leexi
• Jamie
• tl;dv

More corrections: Xero, Typeform, Zoho and EU hosting for 40+ services

The next round of introductions surfaced more outdated data. Xero is from New Zealand, Typeform from Spain and Zoho from India; over 40 services also offer storage in the EU.

• Xero
• Typeform
• Zoho Workplace
• Workday
• Asana
• Airtable

Vendor data corrections: headquarters and hosting regions

While writing the introductions we re-checked the data. 91 US vendors were wrongly recorded as 'other' and now count as US; 16 services now show their EU hosting option.

• Wix
• GitHub
• Canva
• Mixpanel
• Segment (Twilio Segment)
• Google Drive

Extended introductions on category and vendor pages

Every category page now has a 150-220-word introduction; vendor pages are getting a 120-180-word introduction step by step, each checked against sources. While writing, we found that Slack, Zoom, Dropbox, OpenAI and Notion also offer data storage in the EU; their profiles now reflect that.

• Slack
• Zoom
• Dropbox
• OpenAI
• Notion

BirdyChat is now Balsio

The Latvian work chat app BirdyChat has been renamed Balsio. The listing has been updated and re-verified; the old page redirects automatically.

• Balsio

Category pages easier to find, and one click from every vendor to the whole category

Category pages now name the best-known non-European services they offer alternatives to (for example "Messaging: European alternatives to WhatsApp, Telegram and Messenger"). Every vendor page now links straight to all European vendors in its category, right below the alternatives.

Vendeglatas.hu added, register verification for Verde Holding Kft.

A vendor self-submission, a Hungarian hospitality/booking platform, independently verified and added. The parent company, Verde Holding Kft., already has 5 other products in the catalogue — their listing is now also confirmed via the official Hungarian company register (OCCSZ), not just the company's own website.

• Vendeglatas.hu
• időpontok
• Bizonylat
• Felhő
• Overit
• Podpisat

7 database vendors added

A candidate list of European managed-database and DBaaS providers (35 names) independently verified: 7 new vendors (MySQL, Firebird SQL, SQLite, TiDB, Dragonfly, ScyllaDB, RethinkDB), the rest already catalogued or not genuine EU alternatives.

• MySQL
• Firebird SQL
• SQLite
• TiDB
• Dragonfly (DragonflyDB)
• ScyllaDB
• RethinkDB

4 vendors added, TigerData record corrected

A data-platform/analytics candidate list (35 names) independently verified: 4 new vendors, and an incorrect existing record (TigerData/TimescaleDB) corrected — it was wrongly recorded as Swedish/EU with no cited source, when the company is actually headquartered in New York, US.

• Databend
• Apache Iceberg
• Milvus
• Incus

13 vendors added to customer-data-platform

A second submitted CDP candidate list (35 names) independently verified: 13 new vendors, including two country corrections that moved a vendor from "non-EU" to "EU".

• ContactPigeon
• NGDATA Lily
• Tracardi
• Optimove
• Tealium Customer Data Hub

6 DNS privacy resolvers added

A sixth submitted candidate list (DNS privacy resolvers) independently verified: 6 new vendors, 19 rejected — often because a small individually-run service had since shut down or never existed.

• UncensoredDNS (Censurfridns)
• Freifunk München DNS
• Dismail.de Secure DNS
• dnsmasq
• Stubby

13 vendors added across data integration and ETL

A fifth submitted candidate list (data integration/ETL) independently verified: 13 new vendors, 32 rejected — most because they were already catalogued, sometimes under a different category.

• TimeXtender
• Apache Spark
• Dagster
• Logstash
• AWS Glue

16 vendors added across cloud infrastructure

A fourth submitted candidate list (cloud IaaS) independently verified: 16 new vendors spread across cloud-iaas, virtualization and network-infrastructure, 24 rejected as already catalogued or nonexistent.

• Bleu
• Infomaniak Public Cloud
• oVirt
• KubeVirt
• Open vSwitch

Fixed a scoring bug for self-hosted software; removed 2 WordPress-only plugins

Self-hostable and community-distributed open-source vendors were incorrectly scored as the worst possible case on data residency. Koko Analytics and Statify (WordPress plugins) have been removed from analytics: they aren't a standalone service.

51 vendors added to analytics and AI security

5 web-verified community submissions (Verde Holding Kft., Hungary) and 46 new vendors in the analytics and ai-security categories, after independently verifying two submitted candidate lists.

• Mindgard
• Contentsquare
• Smartlook
• GoatCounter
• Koko Analytics

27 vendors added — knowledge base reaches 3,500

New EU vendors Storyteq, AtroDAM, Razuna, Phrasea, Comosoft LAGO, Sharedien, Picturepark, Sliplane, Platform.sh, anynines, lowcloud, DanubeData, Encore and Raynet One, plus international benchmarks. With this, the knowledge base reaches its 3,500-vendor target.

• Storyteq
• AtroDAM
• Platform.sh
• Encore
• Raynet One

13 vendors added across 2 categories

New EU vendors LingoHub, Gridly, Prompsit, Tilde, SimpleLocalize, Gingout, Pangea Global, eTranslation and PassSecurium, plus international benchmarks.

• Tilde
• eTranslation
• PassSecurium

18 vendors added across 2 categories

New EU vendors CERRIX, Swiss GRC, Enactia, Matproof, Copla, Actecil, Recruitis, Adeptiq, CVWarehouse, HROffice, Altamira Recruiting and HireHive, plus international benchmarks.

• CERRIX
• Matproof
• Adeptiq
• HireHive

72 vendors added across 6 categories

New EU vendors Pixelmator Pro, Cinema 4D, TVPaint, eYou, W Social, BeReal, CounterMail, CTemplar, Caliopen, Ligo, fynk, Contractify, Bigle Legal, Bind Legal, Bird, Spryng, LOX24 and PAFnow, plus dozens of international benchmarks.

• Pixelmator Pro
• eYou
• Caliopen
• fynk
• Bird
• Workfellow

53 vendors added across 6 categories

New EU vendors A-Trust, TrustPro, Agrello, Oneflow, Subnoto, Paperless.io, SIGN8, inSign, Infomaniak kChat, Realtime Register, Webland, easyname, Northmill Bank, Rocker, Solaris, Saldo Bank, Wallester, Tinaba, Zen.com, VeloBank, ActivoBank and Tinybird, plus dozens of international benchmarks.

• A-Trust
• Oneflow
• Rocker
• Zen (Zen.com)
• Tinybird

65 vendors added across 6 categories

New EU vendors GBTEC, Tailent, Tebis, GRAITEC, HiCAD, Shapr3D, VariCAD, HIGHRESAUDIO, STAGE+, Klassik Radio Plus, HERE Technologies, Sinergise, Airbus Defence & Space, Mercateo, VORTAL, AddVue, Keelvar, Sana Learn, Scheer IMC, time4you, SoftDeCC, Sanoma Learning and Gility, plus dozens of international benchmarks.

• GBTEC Work Orchestrator
• Shapr3D
• HIGHRESAUDIO
• HERE Technologies
• Keelvar
• Sana Learn

46 vendors added across 6 categories

New EU vendors Telebugs, UXCam, dunDNS, Alpega Group, AEB SE, PSI Logistics, PULPO WMS, Ehrhardt Partner Group, Logistics Reply, Davanti, Talkspirit, Jamespot, eXo Platform, Framasoft, Easiware, eDesk and IncludeOS, plus dozens of international benchmarks.

• Telebugs
• Alpega Group
• eXo Platform
• Easiware
• IncludeOS

52 vendors added across 6 categories

New EU vendors Cerascreen, F-Secure VPN, Avira Phantom VPN, PrivateVPN, Goose VPN, Everteam, Pydio Cells, DocLogix, Fabasoft, Woosmap and ViaMichelin, plus dozens of international benchmarks.

• Cerascreen
• PrivateVPN
• Fabasoft
• Woosmap

44 vendors added across 5 categories

New EU vendors Livesignage, Cloudchipr, Meshcloud, Kontakt.io, Actility ThingPark and Royal TS, plus dozens of international benchmarks.

• Livesignage
• Cloudchipr
• Royal TS

43 vendors added, knowledge base passes 3,100

New EU vendors Sender, Cludo, Seznam, Calendesk and Feature Upvote, plus dozens of international benchmarks.

• Sender
• Cludo
• Seznam

45 vendors added across 6 categories

New EU vendors Piano, DNS.SB, LibreDNS, Ziteboard, Dastra and XTM Cloud, plus dozens of international benchmarks.

• Piano
• DNS.SB
• Dastra

50 vendors added, knowledge base passes 3,000

New EU vendors sms.to, Movavi, WorkIO, Xpert-Timer, Envirotech and Wolters Kluwer Enablon, plus dozens of international benchmarks.

• sms.to
• Movavi
• Envirotech

47 vendors added across 6 categories

New EU vendors ProcessMind, Exeura, KYP.ai, FeatBit, Confidence, TGGL and Key-Systems, plus dozens of international benchmarks.

• ProcessMind
• FeatBit
• Key-Systems

18 vendors added across backup and cloud storage

New EU vendors Degoo, NordLocker and UrBackup, plus international benchmarks such as Mega, Cohesity and Macrium Reflect.

• Degoo
• NordLocker
• UrBackup

6 vendors added across 2 categories

New EU vendors Haiilo, CatalystOne, Jobrad, Rydoo and Pluxee, plus the open-source benchmark TimeTrex.

• Haiilo
• CatalystOne
• Jobrad

18 vendors added across 5 categories

New EU vendors Templafy, Dashlane and F-Secure ID Protection, plus benchmarks such as Apache JMeter and Keeper Security.

• Templafy
• Dashlane
• F-Secure ID Protection

17 vendors added across 5 categories

New EU vendor Linbit DRBD/LINSTOR, plus benchmarks such as Esri ArcGIS, Canvas LMS and Viber.

• Linbit DRBD/LINSTOR
• Canvas LMS
• Viber

12 vendors added across 3 categories

New EU vendors Perfect Privacy and PrivadoVPN, plus benchmarks such as Thriva and Procurify.

• Perfect Privacy
• PrivadoVPN

12 vendors added across 5 categories

New EU vendor Remote Utilities, plus benchmarks such as Securiti, Fider and Archera.

• Remote Utilities
• Securiti
• Fider

11 vendors added across 5 categories

New EU vendors Bucket (Reflag) and Cozero, plus benchmarks such as BrightSign and SparkPost.

• Bucket (Reflag)
• Cozero

49 vendors added across 4 categories

New EU vendors ArangoDB, OrientDB, openDesk and Zensai, plus dozens of benchmarks across office-productivity, data-platform, database and elearning-tools.

• ArangoDB
• OrientDB
• openDesk
• Zensai

10 vendors added across 4 categories

New EU vendors Piwik PRO Tag Manager, TAGGRS, Whiteboard.fi and Sketchboard, plus benchmarks such as Apple Freeform and Zoom Phone.

• Piwik PRO Tag Manager
• TAGGRS
• Whiteboard.fi
• Sketchboard

17 vendors added across 5 categories

New EU vendors Jamendo and Acronis True Image, plus benchmarks such as AWS IoT Core and Baidu.

• Jamendo
• Acronis True Image
• AWS IoT Core
• Baidu

17 vendors added across 5 categories

New EU vendors 360Learning and LearnUpon, plus benchmarks such as Greenhouse and WPS Office.

• 360Learning
• LearnUpon
• Greenhouse
• WPS Office

16 vendors added across 5 categories

New EU vendors Legora, Lunar and Sumeria, plus benchmarks such as NinjaOne and Calendly.

• Legora
• Lunar
• Sumeria
• NinjaOne
• Calendly

German and French added as new languages

The site is now also reachable via /de and /fr. Translation of the full vendor catalogue follows over the coming days.

20 vendors added across 5 categories

New EU vendors EcoVadis, Sustainalytics, Scribens, Reverso and Elastic Email, plus benchmarks such as Firebolt and NoviSign.

• EcoVadis
• Sustainalytics
• Scribens
• Reverso
• Elastic Email

14 vendors added across 5 categories

New EU vendors Ensighten, econda, Klaxoon and ISL Online, plus benchmarks such as Raygun, Splashtop and DevCycle.

• Ensighten
• econda
• Klaxoon
• ISL Online
• Raygun
• DevCycle

24 vendors added: Networking & Monitoring

3 EU vendors (Shinken, collectd, SmokePing) and 21 non-EU additions, including New Relic, Honeycomb and ThousandEyes.

• Shinken
• collectd
• SmokePing
• New Relic
• Honeycomb
• ThousandEyes

Open-source page: collapsible per category, with its own pages

The open-source page now shows categories collapsed and in alphabetical order, and each category now has its own page listing its open-source vendors.

27 vendors added: Low-code & No-code

7 EU vendors (including Novulo, Thinkwise and OpenLowCode) and 20 non-EU additions, including Microsoft Power Apps, Bubble and Webflow. Also corrected the Screenbird description again after vendor follow-up.

• Novulo
• Thinkwise
• OpenLowCode
• Microsoft Power Apps
• Bubble
• Webflow
• Screenbird

16 vendors added: Performance Management / EPM

7 EU vendors (including Talentia Software, Perdoo and SAP Analytics Cloud) and 9 non-EU additions, including open-source OLAP engines and benchmarks like OneStream and Prophix.

• Talentia Software
• Perdoo
• SAP Analytics Cloud
• OneStream Software
• Prophix Software
• Apache Pinot

Community submissions: UseClick and Hourtick added

Two vendor self-submissions, independently re-verified: UseClick (Germany, cookie-free link analytics) and Hourtick (Denmark, time tracking for people and AI agents). The submission form now also optionally asks for a privacy-policy and DPA link.

• UseClick
• Hourtick

29 vendors added: Data Governance & Metadata Management

3 EU vendors (Dawex, Dataedo, Data Contract CLI) and 26 non-EU additions, including open-source catalogs like DataHub and Apache Atlas and benchmarks like Precisely and BigID.

• Dawex
• Dataedo
• Data Contract CLI
• DataHub
• Apache Atlas
• Precisely (Data Integrity)
• BigID

4 vendors added: Customer Data Platforms

CrossEngage (Germany, part of Spotler Group) and three non-EU additions: Census, Zingg and GrowthLoop.

• CrossEngage
• Census
• Zingg
• GrowthLoop

Consent management cleaned up and 8 vendors added

Usercentrics, Cookiebot and consentmanager.net were catalogued twice (also under cybersecurity/compliance-grc) — now cleaned up. Also 8 new vendors, including Cookie-Script, Sirdata and Tarteaucitron.js.

• Usercentrics
• Cookie-Script
• Sirdata CMP
• Tarteaucitron.js
• Kodex (KIProtect)

16 vendors added: CDN, DNS & Domains

5 new EU vendors (incl. Knot DNS, Knot Resolver, Varnish Cache, Traefik) and 11 non-EU open-source building blocks and benchmarks (incl. BIND9, CoreDNS, Envoy Proxy, Akamai, Fastly).

• Knot DNS
• NSD
• Varnish Cache
• Traefik Proxy
• Envoy Proxy

11 vendors added: Captcha & Bot Detection

5 new EU vendors (incl. Atmosvere, ALTCHA Sentinel, mosparo) and 6 non-EU additions including Radware Bot Manager (Israel — not the US, as often assumed).

• Atmosvere
• ALTCHA Sentinel
• mosparo
• CaptchaService (Stad München)
• Radware Bot Manager

CDN/DNS category cleaned up: hosters and registrars removed

Removed Combell, Hostnet, OVH DNS and TransIP from CDN, DNS & Domains — their DNS is only bundled on top of hosting/domain registration, and they were already correctly catalogued under their own category. Moved Openprovider and WEDOS to Domain Registrars and Web Hosting respectively.

10 vendors added: Business Intelligence

6 new open-source BI tools (incl. Apache Superset, Metabase, Lightdash) and 4 non-EU benchmarks (Palantir Foundry, Sisense, Sigma Computing, Domo).

• Apache Superset
• Metabase
• Lightdash
• Cube
• Domo

18 vendors added: business email & groupware

13 new self-hosted mail server/groupware tools (incl. Postfix, Dovecot, Mail-in-a-Box, CipherMail), 2 new French email services (Mailo, Ecomail) and 3 non-EU benchmarks (Zoho Mail, Amazon WorkMail, Fastmail). Also: corrected the Screenbird description — its US sub-processors do process narrowly-scoped customer data.

• Postfix
• Dovecot
• CipherMail
• Mailo
• Screenbird

28 vendors added: API management, BPM & workflow, browsers

11 new vendors in API Management (incl. Ory Oathkeeper, Zuplo, Hoppscotch), 14 in BPM & Workflow (incl. Temporal, Apache Airflow, Prefect) and 3 new browsers (Ecosia, DuckDuckGo Browser). The knowledge base now stands at 2,531 vendors.

• Ory Oathkeeper
• Temporal
• Apache Airflow
• Ecosia Browser
• DuckDuckGo Browser

Past 2,500 vendors: 14 AI coding tools added

12 new vendors in AI Coding (including Aider, Cline, Tabby and Goose) and 2 in AI (llama.cpp, LiteLLM). Qodo was incorrectly listed as 'EU' in the supplied list — independently checked: Tel Aviv, Israel.

• Aider
• Cline
• Tabby
• Goose
• llama.cpp

Cleaner navigation, clear Donate button added

Moved Map and About to the footer (already listed there), renamed Reports to Pricing, and added a dedicated Donate button. On the support page, the donation amounts now sit right under the intro instead of below three paragraphs of explanation.

Score bug fixed: an EU country's own code was wrongly read as non-EU

A customer pointed out that Screenbird's hosting location was wrongly scored as 'mixed'. While checking this, we found the scoring engine itself didn't recognise a specific EU country's own code (like 'DE') as EU hosting — fixed for every vendor, with no data changes needed. Also corrected Mindbreeze and Explain Everything based on their own privacy policies.

• Mindbreeze
• Explain Everything
• Screenbird

20 more vendors: domain registrars, SMS, DNS privacy and more

Added 20 more verified vendors, including Kaleyra (Italian HQ, but owned by India's Tata Communications — a good example of why we track HQ and parent company separately) and FDN DNS (a French nonprofit DNS resolver).

• Kaleyra
• FDN DNS
• Mailjet
• Blue Prism (SS&C)
• OVH Domains
• IONOS Domains

87 new vendors across the 10 thinnest categories

Filled out the 10 categories with the fewest vendors (from enterprise search to testing/QA) with 87 verified, real vendors — including Elasticsearch, Datafari, ConfigCat, AB Tasty, Kameleoon, DataDome and TestRail as EU alternatives.

• Elasticsearch
• Datafari
• Mindbreeze
• Collaboard
• Explain Everything
• ConfigCat
• AB Tasty
• Kameleoon
• DataDome
• TestRail
• Klaro
• OpenCost
• Selenium
• Appium

16 new AI-agent vendors added

After checking a list of 30 AI-agent/cowork tools: 16 genuine gaps filled (including Connic and 2501.ai as EU alternatives), and three doubtful names (Stenwrite, OpenAI Operator, MultiOn) deliberately left out after independent verification.

• Connic
• 2501.ai
• PhariaAI
• CrewAI
• AutoGen
• LangGraph
• Dify
• OpenHands
• SuperAGI
• PraisonAI
• Openwork
• Omnigent
• Rowboat
• VoltAgent
• Microsoft Copilot Studio
• Adept AI

Source re-verification, round 14: 60 vendors

Round 14: 24 corrections, including InterSystems and Infobip (headquarters turned out to be elsewhere than recorded) and Informatica (now owned by Salesforce after an $8B acquisition).

• Hostnet
• Huly
• i3D.net
• Ibexa DXP
• iDEAL / Wero
• IFS Cloud
• ILIAS
• Immich
• Infobip
• Informatica
• Ingenico
• Inkscape
• Input App
• Insights
• InterSystems
• Hubzilla
• Hugging Face

New page: support this tool

A dedicated page explaining why the tool stays free, why we depend on donations, and what your contribution actually funds.

82 new vendors added

Major addition after comparing the catalogue against three external lists of well-known enterprise software, customer data platforms and AI-security tools: 82 missing vendors added, including Oracle CX Cloud, SugarCRM, HashiCorp Vault and a range of customer data platforms and AI red-teaming tools.

• 2021.AI GRACE
• ActionIQ
• Adobe Real-Time CDP
• Adobe Workfront
• Alteryx
• Amperity
• Apache Unomi
• Arthur AI (Arthur Shield)
• Atlassian Bamboo (Data Center)
• AWS Systems Manager
• Basecamp (37signals)
• Box
• Braze
• CalypsoAI
• Dayforce (Ceridian)
• Check Point Harmony
• Cisco XDR
• Creatio
• Custobar
• Datatrics
• Deepchecks
• Descartes Systems Group
• Dialpad
• Domino Data Lab
• Dynamics 365 Customer Insights
• E2open
• Evidently AI
• Five9
• Freshsales
• Garak
• Genesys Cloud CX
• GEP SMART
• Gorgias
• GrowthBook
• Guardrails AI
• HashiCorp Vault
• Hightouch
• Hyland OnBase
• IBM Db2
• IBM FileNet
• Infor Nexus
• Intercom
• Jaggaer
• JFrog Artifactory
• Jitsu
• Laserfiche
• Llama Guard
• Mistral Shieldstral
• NeMo Guardrails
• Oracle CX Cloud
• Oracle Eloqua
• Oracle Procurement Cloud
• Oracle SCM Cloud
• Oracle Service Cloud
• Oracle Unity CDP
• PagerDuty
• Paylocity
• Planview
• Proactis
• Project Asago
• Promptfoo
• Protect AI
• PyRIT
• Relay42
• RingCentral
• Rippling
• Salesforce Data Cloud
• Salesforce Pardot
• SAS Viya
• Smartsheet
• Snowplow
• Squeezely
• SugarCRM
• Talkdesk
• TaoQ AI
• ThoughtSpot
• TIBCO Spotfire
• Tipalti
• UKG Pro
• Veeva Vault
• Wiz AI-SPM
• Zoho Desk

Source re-verification, round 13: 60 vendors

Round 13: 31 corrections, including Hexagon Geospatial (now part of the newly independent Octave after a spin-off) and the familiar US-country/wrong-region-code inconsistency found five more times.

• GRASS GIS
• Grav
• Gravitee.io
• Graylog
• Gripp
• Grist
• Apache Guacamole
• Hack The Box
• Haystack
• HedgeDoc
• Heimdal
• Henchman
• Hexagon Geospatial
• HeyForm
• hide.me
• Hive
• Horde

Source re-verification, round 12: 60 vendors

Round 12: 18 corrections, including Ghost (headquarters turned out to be Singapore, not the UK) and four community open-source projects wrongly marked "vendor-hosted".

• PrivIQ
• GeoNode
• GeoServer
• Forminit
• Ghost
• GIMP
• Giskard
• Gitea
• GNOME Web
• GNU Social
• GoToSocial
• Grafana Labs

Source re-verification, round 11: 60 vendors

Round 11: 18 corrections, including eleven community open-source projects wrongly marked "vendor-hosted", and Garden.io (headquarters turned out to be Germany, with an Israeli parent company since its 2024 acquisition).

Source re-verification, round 10: 60 vendors

Round 10: 15 corrections, including Erxes (headquarters turned out to be California, not Mongolia), Evernote and Etherpad (both had their controlling entity's country confused with their own headquarters), and three community open-source projects.

Source re-verification, round 9: 60 vendors

Round 9: 11 corrections, including the same internal inconsistency found five more times (a US country paired with the wrong region code) and four community open-source projects wrongly marked "vendor-hosted".

Source re-verification, round 8: 60 vendors

Round 8: 16 corrections. Biggest catch: Debian's legal entity is US-based, not German, and the "Dutch" Deel listing turned out to be a local office — the real headquarters is San Francisco. Also seven community open-source projects wrongly marked "vendor-hosted".

2 new vendors: Screenbird and Voronai

Two Dutch vendors added after a community submission: Screenbird (digital signage) and Voronai (customer data platform). Both independently verified, not taken on the vendor's word alone.

Source re-verification, round 7: 60 vendors

Round 7: 18 corrections. Biggest catch: CyberArk is headquartered in Israel, not the US (acquired by Palo Alto Networks in February). Also CrateDB (US, not Austria) and five community open-source projects wrongly marked "vendor-hosted".

Categories now sorted alphabetically

The categories page listed categories sorted by EU-vendor count. Now sorted alphabetically instead, by the name as shown on screen.

Source re-verification, round 6: 60 vendors

Round 6: 9 corrections, including an incorrect UK parent on three Combell listings and on Complianz (team.blue, actually Belgian) and Concourse CI (correctly a distributed open-source project, not a company with a headquarters).

Sovereignty badge now on the map and alternatives dashboard too

The badge now appears everywhere you browse vendors: the alternatives dashboard (rows, expanded alternatives, search results) and the map's vendor pop-up too.

Sovereignty badge now on category and country pages too

The badge already appeared on vendor pages and in the report; now it shows next to every vendor on category and country pages too, so you can scan a whole list at a glance.

Sovereignty badge on vendor pages and the report

Right under every vendor's name there is now one clear mark: EU sovereign, self-host/open source, EU-hosted with a non-EU parent, or non-EU. The same badge now also appears in the paid report's vendor table.

Source re-verification, round 5: 60 vendors

Round 5: 11 corrections, including CiviCRM and Checkly (both actually US, not Belgium/Germany), Checkmk (no US parent at all — it's stayed German-owned throughout its history), and two open-source projects (Ceph, CapRover) wrongly marked "vendor-hosted".

Source re-verification, round 4: 60 vendors

Round 4: 13 corrections, including Blomp (US, not UK), two "self-host" listings (BookStack, Cachet) that used a generic EU placeholder despite a real registered company behind them, and three open-source projects (Blocky, BRouter, BookWyrm) wrongly marked "vendor-hosted" instead of distributed open source.

Source re-verification, round 3: 60 vendors

Round 3: the next 60 vendors checked. 5 corrections, including two missing parent companies (Auth0/Okta, Aware Health/Aeon) and two internal inconsistencies (a US headquarters paired with the wrong region code). A not-yet-completed acquisition (Bahnhof/Telenor) was deliberately left unrecorded.

Source re-verification, round 2: 59 vendors

Round 2 of the ongoing re-verification pass: the next 59 vendors (alphabetically) checked against independent sources. 7 corrections, including Anytype (Berlin, not Switzerland), AppFlowy (Singapore, not the US), and Alpine Linux (reclassified as an open-source project with no fixed headquarters). A premature merger (Aleph Alpha/Cohere) was removed from the data since it hasn't closed yet.

Full-catalogue source re-verification begins (round 1: 60 vendors)

We've started an ongoing re-verification pass across the whole catalogue: 93% of vendors had a check date but no actual source behind it. Round 1 checked the first 60 (alphabetically) against independent sources and found 8 corrections (e.g. 4me turns out to be US-based, not Dutch) plus one duplicate (About You Cloud/Commerce = SCAYLE), now merged.

EU adequacy-decision status now shown on every vendor page

Every vendor page and report now shows whether the European Commission has found the headquarters country's data protection adequate — a real, citable EU legal fact. The US deliberately does not get a simple yes/no: the EU-US Data Privacy Framework only covers individually certified companies, so that status is marked separately as "conditional".

9 European vendors close three categories with no EU options

The previous update noted that Customer Data Platform, FinOps and Product Feedback had zero European vendors. Targeted European research found nine after all: Upvoty, Featurebase, Sleekplan and ProductLift (product feedback), Holori and Cycloid (FinOps), and Mediarithmics, Zeotap and Commanders Act (Customer Data Platform).

Six new categories and more European AI-security vendors

After a systematic review of our 90 categories, six missing software types turned up: Customer Data Platform, Feature Flags & Experimentation, FinOps, Enterprise Search, Product Feedback and Digital Whiteboards. 25 new vendors were added, and targeted research for European AI-security vendors surfaced Giskard (France) and Lakera (Switzerland). Along the way, two duplicate entries were caught and removed before going live.

New "AI Security" category with 22 verified vendors

AI security tools (prompt-injection defence, AI red-teaming, AI governance) are a fast-growing market that wasn't in our knowledge base yet. We've added 22 vendors — every fact independently checked, never taken at face value. One vendor from the source turned out to be just a coming-soon page and was deliberately left out; another's obvious domain turned out to belong to a completely different company.

euBackups added

euBackups (a German backup service for MSPs and businesses, built on Acronis, with backups stored in Germany) was submitted by the vendor itself. Before adding it, we independently checked every fact against their own legal notice, privacy policy and data processing agreement — never taking the submission at face value.

Explanation of our four verification labels added to "About this tool"

Vendor pages have shown badges like "Confirmed in registry" or "Vendor-stated" for a while — but nowhere explained what they actually mean. The "About this tool" page now spells out all four labels in plain language.

Ownership chain and ultimate parent company now shown on the vendor page

A vendor's "ultimate parent company" has been in our data for a while but was never actually shown anywhere — now fixed. For Sitecore Content Hub, the full ownership chain has also been researched and added.

Certifications cross-checked against an independent registry (CSA STAR)

For 103 vendors, the CSA STAR certification is no longer just "vendor-stated" but confirmed against the official CSA STAR registry — linking to its own registry entry instead of the vendor's generic page.

Technical hosting signal: independent evidence, not sourced from the vendor

Established which network serves each vendor's website via a DNS lookup, for 2,216 of 2,227 vendors — the first evidence type that doesn't rely on anything the vendor itself publishes. Note: this is about the website, often behind a CDN, not necessarily where the service or data is actually hosted.

Provenance badges on compliance evidence, now also in the PDF report

Every compliance field and certification now shows explicitly how it was established — today that's honestly always "vendor-stated", since that's what the research has done so far. The paid report shows compliance evidence for the first time.

Compliance evidence extended to 580 vendors (round 10)

Researched the next 200 most-recommended vendors again, including several previously-rejected vendors that came back this round with new, better evidence. One rejection rule in the merge script turned out too narrow (it only checked one field while the same bad page reappeared under a different field) and has been broadened.

Compliance evidence extended to 561 vendors (round 9) — plus a fix for three earlier rejections that had silently failed

Researched the next 200 most-recommended vendors again. In the process we found a bug in the merge script that had left three fields we had reported as rejected (Codefresh, Teamhood, Checkmk) quietly live ever since their own rounds. Fixed, and existing installations will pick this up automatically.

Compliance evidence extended to 540 vendors (round 8) — plus a fix that backfills earlier rounds

Researched the next 200 most-recommended vendors again. In the process we found that a bug in the merge script had silently skipped one 20-vendor research batch per round ever since round 2. Fixed, and every previously missed round was re-checked with the same rigor and added.

New: Contact page

Added a separate Contact page for press, collaboration and other general enquiries — distinct from the vendor submission page. Linked from the footer.

Compliance evidence extended to 520 vendors (round 7)

Researched the next 200 most-recommended vendors again. Manual review removed six loose links that turned out not to be real evidence (among them a bare link overview instead of actual content, a data processing agreement belonging to a separate sibling product, and a page that only incidentally contained the word "security" in a menu). For Internxt, the combined legal page was partly legitimate: the security and subprocessor content was genuinely there, but the DPA and EU-hosting claims were not.

Fix: Aiven does not host exclusively in the EU

A reader flagged that Aiven runs on any cloud platform. That's correct: Aiven offers free region selection across six cloud platforms (AWS, Google Cloud, Azure, DigitalOcean, OVH, UpCloud) in over 100 regions worldwide. The catalogue's cloud-iaas record for Aiven wrongly said "EU hosting only"; this has been corrected to EU, US and APAC.

Fix: self-hostable vendors were incorrectly scored as "hosted by the vendor"

A reader flagged a contradiction on edgeContinuum's page: it said "closed source and hosted by the vendor", while the vendor actually runs on infrastructure the customer controls. Investigation found this affected 68 vendors in the catalogue, and not just the text — the key-management and source/runtime scores also didn't account for self-hosting. Both have been corrected.

Three new vendors: Affinity Photo, Ollama, Peakto

Reviewed which software visitors type in during an assessment that the catalogue was still missing. Added: Affinity Photo (photo editing, UK/owned by Australia's Canva — catalogued as a recognisable non-EU vendor so EU alternatives can be shown), Ollama (locally-run open AI language models, open source) and Peakto (French photo catalogue management, a strong EU-owned find). Two other candidates turned out to be out of scope (physical alarm security) or already present under a different name (an Israeli, now US-owned, security company).

New vendor: edgeContinuum (Spain)

Added via the submission form: edgeContinuum, a Spanish cloud orchestration platform for self-managed virtual machines, Kubernetes and PostgreSQL, also suited to on-premises and air-gapped environments. Independently verified before adding (it was a self-submission by the vendor): category corrected to 'cloud-iaas' and the hosted-in-the-EU claim was not carried over for lack of hard evidence.

Compliance evidence extended to 471 vendors (round 6)

Researched the next 200 most-recommended vendors again. This round, eight loose links were removed that turned out, on manual review, not to be real evidence (among them an install page, a vendor's own homepage, and a marketing page about cybersecurity services rather than the vendor's own security policy). A reader flagged missing DPA evidence for BigBlueButton; that has been added.

Compliance evidence extended to 410 vendors (round 5)

Researched the next 200 most-recommended vendors again. This round's page-context review found no false certification claims, but caught eight loose links that only coincidentally contained a keyword without being real evidence (among them a review-site name misread as "trust", and two vendors where every field pointed to the same generic terms-of-service page); those were removed before the data was merged.

Compliance evidence extended to 344 vendors (round 4)

Researched the next 200 most-recommended vendors again, same method as the previous three rounds. Both certification claims in this round turned out, on manual review, to be a direct, first-person claim by the vendor itself (CELUM and elastic.io, both ISO/IEC 27001) and were kept.

Compliance evidence extended to 270 vendors (round 3)

Researched the next 200 most-recommended vendors, same method and rigor as the previous two rounds: every link was fetched and checked for content. Two certification claims were rejected after manual review: CrateDB's claim pointed to a different vendor's (Keboola) security page, and Kontainer's page only mentioned controls "based on" ISO 27001 and SOC 2, not its own certificate.

Correction: TYPO3's headquarters is the TYPO3 Association in Switzerland, not the German commercial arm

An attentive reader pointed out that TYPO3 GmbH (Düsseldorf, Germany) is the commercial arm, while ownership and governance of TYPO3 CMS — including the trademark — sits with the TYPO3 Association, registered in Baar (ZG), Switzerland. The country has been corrected to Switzerland and the classification to EFTA.

Compliance evidence extended to 197 vendors (round 2: the most recommended)

Following the first round (the largest cloud, SaaS and security vendors), compliance evidence has been extended to the 96 next vendors most often shown as European alternatives. Same method: every link was fetched and checked for content, and every certification claim was read in page context before inclusion — two claims were rejected here because they referred to a hosting partner's certification (AWS) or to contract text that only "commits to comply with" rather than showing the vendor's own certificate.

Compliance evidence per vendor: DPA, subprocessors, security page, EU hosting and certifications

Vendor pages now show a Compliance evidence block linking to the vendor's own public documents: the data processing agreement (DPA), the subprocessor list, the security page or trust center, the page describing EU hosting and the page listing certifications such as ISO/IEC 27001, SOC 2, SecNumCloud or HDS. We only record what we actually found on the vendor's site; every link was fetched and checked for content on the check date. A missing link means not found publicly, not not compliant.

40 vendors from an enterprise application landscape added, each with sources and a check date

An application landscape of a large organisation was compared with the knowledge base: of 81 tools named, 17 were already listed, 40 are now added and 24 were deliberately left out (internal or unverifiable names, network functions, or telecom BSS without a fitting category). Every new record carries its check date and the public sources that substantiate jurisdiction, ownership, data location and the GDPR data-processing agreement, so the page can feed a DORA or NIS2 third-party file.

Faster pages, less repetition on vendor pages and product data in the shop

Every page is now built ahead of time and served directly instead of rendered per visit. Vendor pages repeat less boilerplate and link to their category page. The English homepage carries the tool's English name. The shop, the statistics page and the changelog have cleaner structured data; llms.txt is linked from the footer.

Category pages: why the category matters, related categories and check date

Every category page now explains in two sentences what data flows through it and what to check in a vendor, shows the date of the last check and points to related categories. Non-European vendors state their number of EU alternatives. Shorter page titles and a page-specific preview when shared on social media.

Category overview: how we count, and better discoverability

The overview of all categories now explains how we count and what "European" means, with the date of the last check and links to the methodology and the statistics. Each category now names its total. Sharing a page on LinkedIn or Mastodon shows the right title and link; the sitemap reports the real verification date per page.

Software by category and by country, and knowledge base statistics

New overview pages: per category every European vendor with country, owner and open-source status, plus the non-European vendors with their alternatives; per country every vendor by category with a note on the legal position. The statistics page shows the current knowledge base figures, including verification coverage, with a citation line.

Check date and sources per vendor; independence statement

Every vendor page now shows when the record was last checked and, for records since September 2026, the public sources used. The About page and the footer state explicitly what keeps us independent: no money from vendors, no sponsored listings, no paid labels and no affiliate links.

Why now: NIS2, DORA and CLOUD Act on the home page; 39 European vendors added

The home page explains why a sovereignty assessment matters now: NIS2 and DORA put vendor risk on your organisation, the CLOUD Act affects US vendors, and the GDPR and Data Act set requirements for data location and switching. The text about our verification now states exactly what we check, and verification is free for every vendor. Non-European vendor pages ask for missing European alternatives. In eleven thin categories 39 verified European vendors were added, from data platforms and AI assistants to planning, procurement and data governance.

Enterprise software: 9 new categories and 214 vendors

A check of 120+ common enterprise products (data platforms, ERP satellites, integration, network, security and infrastructure) showed 92 were missing and that BI, data platforms, data governance, planning, procurement, supply chain, process mining, network management and endpoint management had no category at all. They exist now, including 111 European counterparts with curated alternative lists. Every fact (headquarters, owner, hosting) was web-verified per vendor.

Submit a vendor and the 'verified by hand' mark

Missing a European vendor or spotted an error? Use the new Submit a vendor page, or the correction link on every vendor page. We verify every submission against public sources before it enters the knowledge base. That is now visible too: every vendor carries the 'verified by hand' mark and the About page explains what we check.

Choose your report variant right at the results

The assessment results now show the three report variants side by side, with who they are for and a recommendation. Your vendor selection is carried over to the order and the sample report can be viewed everywhere.

Vendor pages explain what the assessment does

Every vendor page now shows the sovereignty profile across five dimensions, explains why digital sovereignty matters with that vendor and what the free assessment delivers. The assessment button pre-selects the vendor in step 1.

Sample report and more compact free results

The results and the shop now link to a sample report, so you can see what the report contains before ordering. The free results show the two most relevant European alternatives per vendor; the rest are in the report.

Unrecognised applications help the knowledge base grow

If you paste an application list and the knowledge base does not know a name, that name is counted so we can add the missing vendors. Only the name is kept, no IP address, session or selection. This sits under the same telemetry toggle in the footer.

Board questions and migration path now in the report

The discussion questions for the board and the three-phase migration path are now part of the paid report and no longer shown on screen. The free results show the scores, the heatmap, the risk drivers and the European alternatives, and point to the report for the advice.

Order the report right above your results

After an assessment, the option to order the report now sits at the top of the results page, with what the report adds to what you see on screen and the price. The button at the bottom stays.

Annual product: ten whitelabel reports, at your own pace

The monthly cap on the annual product is gone. An access link now covers ten whitelabel reports within twelve months, each with its own vendor selection, whether you build them in one week or spread them over the year. Per report that is cheaper than the single report.

Annual product: whitelabel reports, at most 3 per month

The annual product has changed. Instead of a download of the full dataset, the access link now gives twelve months of access to the report builder, with at most three whitelabel reports per calendar month. The knowledgebase itself is not for sale on its own; that is what the business licence is for.

Nine desktop and prosumer tools added

A pasted application list showed eight common tools missing. They are now in the knowledgebase with verified origin and ownership: Alfred (UK), BBEdit (US), Goodnotes (Hong Kong), Fing (Ireland, part of Belgium's Lansweeper), MacWhisper (Netherlands), OrbStack (US), Docker Desktop (US), Spark by Readdle and Tailscale (Canada).

Paste an application list into the assessment

Searching per category is a lot of work when you already have an inventory. On the vendor step you can now paste a list, for example an export from your asset or licence register. The tool recognises the names (including variants such as 'Office 365', 'MS Teams' or 'Azure AD'), lets you choose when several vendors match and shows what was not found. Everything happens in your browser; nothing is uploaded.

Order a report or the dataset: pay once, delivered immediately

The tool stays free. If you want to keep or forward a report, or use the dataset yourself, you can now order it: a dated report on your own vendor selection, the same report without Accans branding and under your own name, or twelve months of access to the current dataset with unlimited whitelabel reports. Payment is a one-off via Mollie; the download link and the invoice arrive automatically by e-mail. No account, no subscription.

Search on /alternatives now finds every vendor; 454 European providers linked as alternatives

Searching the alternatives dashboard for Jottacloud returned 'no applications found' — although Jottacloud is in the knowledge base and is even listed as an alternative to Dropbox, Google Drive, iCloud and OneDrive. The search box only covered the 418 non-EU services, and only their Dutch description. It now searches all 1,912 vendors by name, description (NL and EN) and category. In addition, 521 European providers turned out to be linked nowhere as an alternative; 454 of them are now added, data-driven, to the lists of their non-EU counterparts.

Alternative lists caught up: 53 lists were missing European providers from their own category

Claude Code showed two European alternatives, yet clicking Mistral Code showed four. The cause: every catalogue expansion added European providers, but the hand-curated lists of the US incumbents did not grow with them — Claude Code named 2 of 5 European coding assistants, Twilio 1 of 7 European SMS APIs, Grammarly 1 of 5. All 53 lagging lists in small categories are now complete, with fully European ownership and open source listed first. A new automated check keeps them in step.

Stripe now under Payments (and no longer as an 'EU vendor'); CyberArk and osTicket corrected

Stripe sat under ERP & Finance with accounting packages as its 'alternatives', and a second Stripe entry registered the company as Irish — hence European. Stripe, Inc. is a US company (Delaware) dual-headquartered in San Francisco and Dublin; a European office does not make it a European vendor. There is now one Stripe under Payments, with fourteen European payment processors as alternatives. SumUp moves to Payments for the same reason. CyberArk showed two flags (US and UK): the company is American and has been part of Palo Alto Networks since February 2026. osTicket was European in one category and American in the other; its maker Enhancesoft is American. A new automated check requires entries of the same vendor to share the same origin.

Map: one pin per vendor, with all its categories

Vendors active in several categories — Adyen and Mollie (e-commerce and payments), TransIP and Combell (cloud, DNS and web hosting), Signicat — appeared two or three times on the map, because each category is its own record in the database. That is intentional for the alternative lists, but confusing on the map. The map now shows one pin per vendor per country; the country list and detail panel list all categories, with an active category filter first.

Adyen and Mollie visible again as alternatives to Stripe; 29 alternative lists repaired

The May cleanup gave Adyen and Mollie two entries each (e-commerce and payments), moved Directus to the US and removed a duplicate Soffos entry — but 29 alternative lists still pointed at the old names and therefore silently hid those alternatives. That is repaired: Adyen and Mollie are back under Stripe, and Adyen was removed as an 'alternative' to accounting and ERP packages, where a payment processor does not belong. The two Adyen entries are intentional: one as the checkout layer for webshops, one as the processor for large merchants; the descriptions now make that distinction clear. A new automated check prevents lists from pointing at removed names again.

New ESG & Sustainability category, plus Vanta, Norm Ai and Sumsub with EU alternatives

With the CSRD, ever more European organisations must report on sustainability, and that business data deserves a European home. The new ESG & Sustainability category holds eleven European providers — including osapiens (Mannheim), Sweep, Greenly, Plan A, Tanso, Normative, Position Green, Coolset, Ecochain, IntegrityNext and Prewave — alongside US incumbents Workiva and Watershed with curated alternatives. Compliance-automation vendors Vanta and Norm Ai (US) were added with European alternatives such as Secfix, Kertos, Compleye and Cyberday, and KYC provider Sumsub (London) with Fourthline, Veriff, Ondato, iDenfy, WebID, Klippa and Signicat. IDnow is listed with the note that it has been US-owned since 2025.

Community trends are now on by default (opt-out)

The anonymous counters behind Community trends were doubly off until now: both the operator and the visitor had to enable them, leaving the page with barely any data. Measuring is now on by default. Nothing changes in what is counted: aggregated totals only, no personal data, no IP addresses, no cookies, and small groups are merged (k-anonymity). If you prefer not to take part, switch it off in the footer; that choice is remembered in your browser.

Change review: 88 new EU providers, 2 ownership changes, 3 licence corrections

A targeted review with parallel agents and a news scan mapped what changed since summer — not what was already there. Ownership: Aleph Alpha merged into Canada's Cohere; Brevo is now held by a UK/US private-equity consortium. Licences: MongoDB (SSPL) and n8n (Sustainable Use License) are source-available, not open source, and are now recorded consistently. No new open→closed licence changes were found — the trend actually reversed. The sweep across all 78 categories added 88 European providers over two passes, focused on the 2026 sovereign-cloud wave (Clarence, S3NS, DEEP, Lyceum), eIDAS 2.0 identity (Duna, Ver.iD, Sybol), digital asset management (9) and the EuroStack office initiative Euro-Office. One candidate was deliberately rejected after verification (Passwork: Russian ties despite Spanish registration).

Ownership audit: 16 jurisdiction fixes and 8 new EU vendors

A web-verified, multi-agent review (Haiku 4.5) surfaced misclassified vendors. Fifteen EU/EFTA-based providers (incl. APPUiO, Bacula Systems, Locize, Efecte, KrakenD, Sygic, Hornetsecurity, Connective, Talend, Transifex, Henchman, Homerun, Pixlr, Tails, Dinero) were wrongly flagged as 'outside the EU' — their region is corrected to EU, with the actual foreign parent recorded separately (the signal that matters for the US CLOUD Act). Payload CMS is now marked as a US provider. FortKnoxster was removed after pivoting to crypto. Eight new EU providers were added in thinly-covered categories.

Passbolt corrected (LU) and added to password-manager category

Passbolt was already in the catalogue under cybersecurity, but with the wrong jurisdiction (FR instead of LU) and an overly terse description. It is a Luxembourg-based open-source credential manager (AGPL-3.0) by Passbolt SA, aimed at IT and DevOps teams. Alongside the correction, a second entry was created under password-manager so users looking for an EU alternative to 1Password, Bitwarden, LastPass or RoboForm now find Passbolt there directly.

Gap analysis round 2: 75 new EU vendors across 40 categories

Systematic scan of the remaining business categories in two blocks of twenty, using Haiku finders and Sonnet verify. The catalogue now lists 1,771 vendors. Includes Elastic (NL, apparently never recorded as a database), Kestra (FR, workflow orchestration), Lovable (SE, AI development), Haystack/deepset (DE, open-source RAG), Snom (DE, VoIP), TSplus (FR, remote desktop), Graphisoft ArchiCAD (HU, CAD), Bacula Systems (CH, backup), Rebelle (SK, natural-media design), Locize (CH, developer TMS), seven previously missing European form/survey tools (AidaForm, easyfeedback, Edkimo, empirio, Crowdtech, QUESTIONSTAR, SmartSurvey), and esign alternatives Penneo (DK) and Buypass (NO).

Gap analysis: 21 new EU vendors added in the thinnest categories

Targeted gap scan on the twelve categories with the fewest EU alternatives. Twenty new vendors added, plus Otobo as a second open-source OTRS fork. Includes sovereign AI workspaces (Delos in Paris, nexos.ai in Vilnius, Nextcloud Assistant), captcha alternatives to reCAPTCHA (Private Captcha from Estonia, Captcha.eu from Austria, Myra EU CAPTCHA from Munich), writing tools (DeepL Write, Writefull, ProWritingAid, CKEditor), API management (Frends from Finland, Locoia from Germany, STOA from France), and transactional email (AhaSend from the Netherlands, MessageFlow from Poland).

Second audit pass: 67 corrections on vendors skipped in the previous round

Reviewed 1,223 vendors that were skipped in the previous audit using a cheaper overnight loop (Sonnet 4.6, split across six ticks): 78 confirmed findings, of which 67 changes applied. Includes new ownership structures (Harvest to Bending Spoons IT, MailerLite to Vercom PL, Fondy to TBC Bank GB, MariaDB commercial arm to K1 US, PAYONE under Worldline FR), licence rug-pulls from open source to source-available (CapRover, Chatwoot, Invoice Ninja, OpenKM, Planka, Rasa, TheHive), and removals (legacy SchildiChat Desktop, standalone Sofort, Juke, iRedMail Easy).

Full audit of acquisitions, ownership and licences

All 1,700 records reviewed via a layered agent swarm: 320 changes applied, including 153 ownership corrections, 73 headquarters corrections, 39 removals of discontinued or absorbed products, and 17 licence changes where formerly open-source projects moved to source-available or proprietary.

New category: Digital Asset Management

Twenty DAM vendors added — from OpenText, Adobe and Cloudinary to European alternatives such as WoodWing, Bynder, CELUM and Fotoware — with verified ownership structures and hosting regions.

Vendor database cleaned up and expanded

Nine records with incorrect headquarters information corrected, 27 new European vendors added, and the schema extended with sovereignty metadata so each vendor's positioning is explicit and honest.