Tracked changes to the vendor database and the tool.
Libera Suite by Paris-based Abilian is a free open-source office suite for Windows, macOS and Linux that runs locally, with no account or cloud. It is now also listed as a European alternative to Microsoft 365 and Google Workspace.
On narrow screens the text in 'Facts and evidence' was stacked one letter per line. The check label now sits below the value, so everything reads normally.
Many organisations use US services that were not yet in the knowledge base. This round adds 600 of them across 94 categories, with their origin, hosting and European alternatives. The knowledge base now lists 6,877 vendors.
Alongside the Cyber Resilience Act, every law in the 'Why this matters now' block now has its own explainer: NIS2, DORA, the CLOUD Act and FISA 702, GDPR with the Data Act, and the AI Act. Each page gives a timeline, what the law means when you choose software and cloud services, which questions to ask a vendor, frequently asked questions and the official sources, checked on 11 October 2026. The Cyber Resilience Act page now uses the new design.
Start with NIS2Vendors with the same score are no longer listed alphabetically but in an order that changes on every visit. The order by score stays the same. This way vendors later in the alphabet also reach the top, on category, country and open-source pages. On phones and tablets the menu now sits behind a menu button. Category pages without a booked sponsor show the banner of Accans, which sponsors the site in kind with hosting, domain names and development time.
On category pages the sponsor slot now sits right under the heading instead of after the introduction; its space is reserved from the start, so the page does not jump. Under "Cite this page" on the statistics page you copy the citation in one click and can share the page straight away. The header has a Sponsorship button, and the submit page explains how sponsorship gives you 12 months of extra visibility on a category of your choice.
Statistics, vendor, category and country pages and the changelog now have share buttons for Mastodon, LinkedIn, Bluesky, X and email, plus a copy-link button. The figure on European alternatives to US services can be shared on its own. The buttons are plain links: nothing loads from another network until you click. Submitting a vendor is now a button in the header.
Share the figureThe paid banner on category pages is now called sponsorship and is labelled "Sponsored". It still never affects a score or a position. The page, the order flow, the confirmation mails and the footer use the same wording, in all four languages.
The statistics page, the trends page, this changelog and the documentation now share the layout of the rest of the site: large figures, calmer tables and more readable documents. Every changelog entry now has its own link, also when several appeared on the same day.
The licence terms, the business data licence page, the contact page and the thank-you page after a donation now share the layout of the rest of the site. The business licence shows its price and mail button in a card of their own.
After paying, the order page shows the status in a clear card with a large download button. The whitelabel report builder has larger fields, the language choice next to the preparer's name and a count of the reports used next to the button.
The statistics page now shows for how many US services with European alternatives selected by us there is an alternative with a sovereignty score above 80, with a note on how it is counted.
See the figureEach report's order page now shows a summary with price, contents and the other variants next to the order form; on a phone the summary comes first. The form has larger fields and a clearer pay button.
AI assistants that ask for Markdown now get the vendor, category, country and open-source pages as clean text with scores, facts and links, straight from the knowledge base. robots.txt now states our policy: search engines and AI assistants may use the site to answer questions, but not to train AI models.
Sharing a page such as 'About', 'Map' or 'Contact' on LinkedIn or in a chat showed the home page's title and link. Every page now has its own title, description and link in that preview.
The site moves to eusovereigntyscore.eu. Existing links and bookmarks to digitalsovereignty.accans.com keep working: they forward to the same page on the new address.
The map counted a vendor listed in several categories once (Germany: 929), while the country page counts every listing (Germany: 1,006). The map now follows the country page, so both show the same number for every country.
The open-source overview now shows every category in one list with its number of open-source vendors. Each category page lists the vendors with their sovereignty score, sortable by score, A to Z or country.
Round eight adds 23 vendors in 4 categories, 8 of them European. The knowledge base now lists 6,277 vendors.
Round seven adds 927 vendors across 78 categories, 345 of them European. The knowledge base now lists 6,254 vendors.
Round six adds 338 vendors in 32 categories, 148 of them European. The knowledge base now lists 5,327 vendors.
Round five of the country-by-country sweep adds 265 vendors in 36 categories, 260 of them European. The knowledge base now lists 4,989 vendors.
A country-by-country sweep adds 293 vendors in 34 categories, 289 of them European. The knowledge base now lists 4,724 vendors.
Round three of the category sweep adds 154 vendors in 21 categories, 94 of them European. The knowledge base now lists 4,431 vendors.
Round two of the category sweep adds 260 vendors in 32 categories, 173 of them European. The knowledge base now lists 4,277 vendors.
A sweep across 48 categories fills gaps in the knowledge base, including 202 European providers. Every vendor has sources and an introduction in four languages.
53 email marketing platforms, with AGNITAS and other European providers as alternatives, and 52 AI agents, automation platforms and local AI apps. Each with sources and an introduction in four languages.
The footer and a few page titles now name only the EU Sovereignty Score; who runs the site is in the colophon and the line at the bottom of the page.
Every country page now shows all vendors from that country with their sovereignty score (0 = high exposure, 100 = sovereign), sortable by score, alphabet or category, plus an overview by category.
The map shows how many European vendors are headquartered in each country, with a panel for the chosen country and a list of every country. The map runs entirely on our own server: no request goes to an external map service.
The alternatives page now starts with one search box and popular searches. Below it, each category shows how many vendors are European, as a number and as a bar. The categories overview shows this for every category.
The About page now shows at a glance how the score works: five dimensions weighted 20% each, the scale from 0 (high exposure) to 100 (sovereign), how we check vendors and what the evidence labels mean.
The submission form is split into the product, optional evidence that speeds up the check, and your details. Beside it is what we check before a listing goes live, and that a listing cannot be bought.
The advertising page shows the price, the format, the number of slots per category, what an ad does and does not buy, and the house rules beside the booking form at a glance.
On the support page you choose an amount and see what your donation pays for. Below it are the other ways to support the tool. The donation bar at the bottom does not appear on this page.
You now search the whole knowledge base at once, click the well-known vendors per category directly and always see your selection beside the list. From that selection you go straight to your score, or first to the optional context.
The pricing page shows the three report variants side by side, with what each one includes. Below them are the business licence and the option to support the knowledge base with a donation.
The result shows your score with the five dimensions next to the heatmap per category, followed by the main risk factors and two European alternatives per vendor with their score. The report contains the remaining alternatives, the board questions and the migration path.
Every category page now shows each vendor's sovereignty score and lets you sort by most sovereign, A to Z or country. The non-European vendors in the category also show their score, with the number of European alternatives.
Every vendor page now shows the sovereignty score at the top with its five dimensions and a short explanation for each, a facts table in which the key facts carry their evidence level, and the European alternatives, each with its own score.
The home page now shows a real example result (the demo stack, computed with the same model as the assessment), what the free assessment and the report give you, how our data is built and why it matters now.
The Digital Sovereignty Heatmap is now called EU Sovereignty Score, with a new logo, colours and typefaces. The tool, the knowledge base and the method stay the same.
The sovereignty score has been flipped. 0 now means high exposure, 100 means sovereign; higher is better. Every score is mirrored (new = 100 − old), so the relative order and the assessment itself are unchanged.
Mailcoach, a Belgian email marketing platform, is now in the catalogue. In addition, a vendor page no longer shows a security.txt file once the expiry date in that file has passed.
During the CRA research we found vendors that have changed owner or website. That information is now up to date, each with sources.
The Cyber Resilience Act signals now also appear for all 81 vendors in the cybersecurity category, such as endpoint protection, firewalls, SIEM and identity management. They do not count towards the score.
The Cyber Resilience Act signals now also appear for 190 vendors of password managers, VPNs, operating systems, browsers, virtualisation and network equipment: the product types the CRA marks as important products. They do not count towards the score.
Switzerland is not an EU member, but the EU recognises Swiss data protection as adequate. Hosting in Switzerland therefore now scores between EU hosting and hosting outside Europe. Hosting in Norway, Iceland and Liechtenstein counts as EU, because the GDPR applies there directly.
The 37 vendors in the CMS category now show which CRA signals can be found publicly, such as a security.txt, a way to report vulnerabilities and a supported-versions policy. They do not count towards the score.
While writing the introductions we re-checked every vendor on the web. That surfaced over 800 outdated or incorrect records: headquarters, owners, licences, new product names and where data is stored.
A new page explains what the EU Cyber Resilience Act means when you buy software: the timeline, what vendors must do and what you can ask for from December 2027.
Vendors that no longer exist or were absorbed into another product have been removed; their old pages now redirect to the successor or to the category. Sixteen products with a new name or website have been updated.
yes.com and Verimi are no longer in the catalogue: both services have been or are being discontinued.
Fathom, Granola and Google AI Edge Foresight are now in the catalogue. As European alternatives to Fathom and Granola we list Sally, Noota, Leexi, Jamie and tl;dv.
The next round of introductions surfaced more outdated data. Xero is from New Zealand, Typeform from Spain and Zoho from India; over 40 services also offer storage in the EU.
While writing the introductions we re-checked the data. 91 US vendors were wrongly recorded as 'other' and now count as US; 16 services now show their EU hosting option.
Every category page now has a 150-220-word introduction; vendor pages are getting a 120-180-word introduction step by step, each checked against sources. While writing, we found that Slack, Zoom, Dropbox, OpenAI and Notion also offer data storage in the EU; their profiles now reflect that.
The Latvian work chat app BirdyChat has been renamed Balsio. The listing has been updated and re-verified; the old page redirects automatically.
Category pages now name the best-known non-European services they offer alternatives to (for example "Messaging: European alternatives to WhatsApp, Telegram and Messenger"). Every vendor page now links straight to all European vendors in its category, right below the alternatives.
A vendor self-submission, a Hungarian hospitality/booking platform, independently verified and added. The parent company, Verde Holding Kft., already has 5 other products in the catalogue — their listing is now also confirmed via the official Hungarian company register (OCCSZ), not just the company's own website.
A candidate list of European managed-database and DBaaS providers (35 names) independently verified: 7 new vendors (MySQL, Firebird SQL, SQLite, TiDB, Dragonfly, ScyllaDB, RethinkDB), the rest already catalogued or not genuine EU alternatives.
A data-platform/analytics candidate list (35 names) independently verified: 4 new vendors, and an incorrect existing record (TigerData/TimescaleDB) corrected — it was wrongly recorded as Swedish/EU with no cited source, when the company is actually headquartered in New York, US.
A second submitted CDP candidate list (35 names) independently verified: 13 new vendors, including two country corrections that moved a vendor from "non-EU" to "EU".
A sixth submitted candidate list (DNS privacy resolvers) independently verified: 6 new vendors, 19 rejected — often because a small individually-run service had since shut down or never existed.
A fifth submitted candidate list (data integration/ETL) independently verified: 13 new vendors, 32 rejected — most because they were already catalogued, sometimes under a different category.
A fourth submitted candidate list (cloud IaaS) independently verified: 16 new vendors spread across cloud-iaas, virtualization and network-infrastructure, 24 rejected as already catalogued or nonexistent.
Self-hostable and community-distributed open-source vendors were incorrectly scored as the worst possible case on data residency. Koko Analytics and Statify (WordPress plugins) have been removed from analytics: they aren't a standalone service.
5 web-verified community submissions (Verde Holding Kft., Hungary) and 46 new vendors in the analytics and ai-security categories, after independently verifying two submitted candidate lists.
New EU vendors Storyteq, AtroDAM, Razuna, Phrasea, Comosoft LAGO, Sharedien, Picturepark, Sliplane, Platform.sh, anynines, lowcloud, DanubeData, Encore and Raynet One, plus international benchmarks. With this, the knowledge base reaches its 3,500-vendor target.
New EU vendors LingoHub, Gridly, Prompsit, Tilde, SimpleLocalize, Gingout, Pangea Global, eTranslation and PassSecurium, plus international benchmarks.
New EU vendors CERRIX, Swiss GRC, Enactia, Matproof, Copla, Actecil, Recruitis, Adeptiq, CVWarehouse, HROffice, Altamira Recruiting and HireHive, plus international benchmarks.
New EU vendors Pixelmator Pro, Cinema 4D, TVPaint, eYou, W Social, BeReal, CounterMail, CTemplar, Caliopen, Ligo, fynk, Contractify, Bigle Legal, Bind Legal, Bird, Spryng, LOX24 and PAFnow, plus dozens of international benchmarks.
New EU vendors A-Trust, TrustPro, Agrello, Oneflow, Subnoto, Paperless.io, SIGN8, inSign, Infomaniak kChat, Realtime Register, Webland, easyname, Northmill Bank, Rocker, Solaris, Saldo Bank, Wallester, Tinaba, Zen.com, VeloBank, ActivoBank and Tinybird, plus dozens of international benchmarks.
New EU vendors GBTEC, Tailent, Tebis, GRAITEC, HiCAD, Shapr3D, VariCAD, HIGHRESAUDIO, STAGE+, Klassik Radio Plus, HERE Technologies, Sinergise, Airbus Defence & Space, Mercateo, VORTAL, AddVue, Keelvar, Sana Learn, Scheer IMC, time4you, SoftDeCC, Sanoma Learning and Gility, plus dozens of international benchmarks.
New EU vendors Telebugs, UXCam, dunDNS, Alpega Group, AEB SE, PSI Logistics, PULPO WMS, Ehrhardt Partner Group, Logistics Reply, Davanti, Talkspirit, Jamespot, eXo Platform, Framasoft, Easiware, eDesk and IncludeOS, plus dozens of international benchmarks.
New EU vendors Cerascreen, F-Secure VPN, Avira Phantom VPN, PrivateVPN, Goose VPN, Everteam, Pydio Cells, DocLogix, Fabasoft, Woosmap and ViaMichelin, plus dozens of international benchmarks.
New EU vendors Livesignage, Cloudchipr, Meshcloud, Kontakt.io, Actility ThingPark and Royal TS, plus dozens of international benchmarks.
New EU vendors Sender, Cludo, Seznam, Calendesk and Feature Upvote, plus dozens of international benchmarks.
New EU vendors Piano, DNS.SB, LibreDNS, Ziteboard, Dastra and XTM Cloud, plus dozens of international benchmarks.
New EU vendors sms.to, Movavi, WorkIO, Xpert-Timer, Envirotech and Wolters Kluwer Enablon, plus dozens of international benchmarks.
New EU vendors ProcessMind, Exeura, KYP.ai, FeatBit, Confidence, TGGL and Key-Systems, plus dozens of international benchmarks.
New EU vendors Degoo, NordLocker and UrBackup, plus international benchmarks such as Mega, Cohesity and Macrium Reflect.
New EU vendors Haiilo, CatalystOne, Jobrad, Rydoo and Pluxee, plus the open-source benchmark TimeTrex.
New EU vendors Templafy, Dashlane and F-Secure ID Protection, plus benchmarks such as Apache JMeter and Keeper Security.
New EU vendor Linbit DRBD/LINSTOR, plus benchmarks such as Esri ArcGIS, Canvas LMS and Viber.
New EU vendors Perfect Privacy and PrivadoVPN, plus benchmarks such as Thriva and Procurify.
New EU vendor Remote Utilities, plus benchmarks such as Securiti, Fider and Archera.
New EU vendors Bucket (Reflag) and Cozero, plus benchmarks such as BrightSign and SparkPost.
New EU vendors ArangoDB, OrientDB, openDesk and Zensai, plus dozens of benchmarks across office-productivity, data-platform, database and elearning-tools.
New EU vendors Piwik PRO Tag Manager, TAGGRS, Whiteboard.fi and Sketchboard, plus benchmarks such as Apple Freeform and Zoom Phone.
New EU vendors Jamendo and Acronis True Image, plus benchmarks such as AWS IoT Core and Baidu.
New EU vendors 360Learning and LearnUpon, plus benchmarks such as Greenhouse and WPS Office.
New EU vendors Legora, Lunar and Sumeria, plus benchmarks such as NinjaOne and Calendly.
The site is now also reachable via /de and /fr. Translation of the full vendor catalogue follows over the coming days.
New EU vendors EcoVadis, Sustainalytics, Scribens, Reverso and Elastic Email, plus benchmarks such as Firebolt and NoviSign.
New EU vendors Ensighten, econda, Klaxoon and ISL Online, plus benchmarks such as Raygun, Splashtop and DevCycle.
3 EU vendors (Shinken, collectd, SmokePing) and 21 non-EU additions, including New Relic, Honeycomb and ThousandEyes.
The open-source page now shows categories collapsed and in alphabetical order, and each category now has its own page listing its open-source vendors.
7 EU vendors (including Novulo, Thinkwise and OpenLowCode) and 20 non-EU additions, including Microsoft Power Apps, Bubble and Webflow. Also corrected the Screenbird description again after vendor follow-up.
7 EU vendors (including Talentia Software, Perdoo and SAP Analytics Cloud) and 9 non-EU additions, including open-source OLAP engines and benchmarks like OneStream and Prophix.
Two vendor self-submissions, independently re-verified: UseClick (Germany, cookie-free link analytics) and Hourtick (Denmark, time tracking for people and AI agents). The submission form now also optionally asks for a privacy-policy and DPA link.
3 EU vendors (Dawex, Dataedo, Data Contract CLI) and 26 non-EU additions, including open-source catalogs like DataHub and Apache Atlas and benchmarks like Precisely and BigID.
CrossEngage (Germany, part of Spotler Group) and three non-EU additions: Census, Zingg and GrowthLoop.
Usercentrics, Cookiebot and consentmanager.net were catalogued twice (also under cybersecurity/compliance-grc) — now cleaned up. Also 8 new vendors, including Cookie-Script, Sirdata and Tarteaucitron.js.
5 new EU vendors (incl. Knot DNS, Knot Resolver, Varnish Cache, Traefik) and 11 non-EU open-source building blocks and benchmarks (incl. BIND9, CoreDNS, Envoy Proxy, Akamai, Fastly).
5 new EU vendors (incl. Atmosvere, ALTCHA Sentinel, mosparo) and 6 non-EU additions including Radware Bot Manager (Israel — not the US, as often assumed).
Removed Combell, Hostnet, OVH DNS and TransIP from CDN, DNS & Domains — their DNS is only bundled on top of hosting/domain registration, and they were already correctly catalogued under their own category. Moved Openprovider and WEDOS to Domain Registrars and Web Hosting respectively.
6 new open-source BI tools (incl. Apache Superset, Metabase, Lightdash) and 4 non-EU benchmarks (Palantir Foundry, Sisense, Sigma Computing, Domo).
13 new self-hosted mail server/groupware tools (incl. Postfix, Dovecot, Mail-in-a-Box, CipherMail), 2 new French email services (Mailo, Ecomail) and 3 non-EU benchmarks (Zoho Mail, Amazon WorkMail, Fastmail). Also: corrected the Screenbird description — its US sub-processors do process narrowly-scoped customer data.
11 new vendors in API Management (incl. Ory Oathkeeper, Zuplo, Hoppscotch), 14 in BPM & Workflow (incl. Temporal, Apache Airflow, Prefect) and 3 new browsers (Ecosia, DuckDuckGo Browser). The knowledge base now stands at 2,531 vendors.
12 new vendors in AI Coding (including Aider, Cline, Tabby and Goose) and 2 in AI (llama.cpp, LiteLLM). Qodo was incorrectly listed as 'EU' in the supplied list — independently checked: Tel Aviv, Israel.
Moved Map and About to the footer (already listed there), renamed Reports to Pricing, and added a dedicated Donate button. On the support page, the donation amounts now sit right under the intro instead of below three paragraphs of explanation.
A customer pointed out that Screenbird's hosting location was wrongly scored as 'mixed'. While checking this, we found the scoring engine itself didn't recognise a specific EU country's own code (like 'DE') as EU hosting — fixed for every vendor, with no data changes needed. Also corrected Mindbreeze and Explain Everything based on their own privacy policies.
Added 20 more verified vendors, including Kaleyra (Italian HQ, but owned by India's Tata Communications — a good example of why we track HQ and parent company separately) and FDN DNS (a French nonprofit DNS resolver).
Filled out the 10 categories with the fewest vendors (from enterprise search to testing/QA) with 87 verified, real vendors — including Elasticsearch, Datafari, ConfigCat, AB Tasty, Kameleoon, DataDome and TestRail as EU alternatives.
After checking a list of 30 AI-agent/cowork tools: 16 genuine gaps filled (including Connic and 2501.ai as EU alternatives), and three doubtful names (Stenwrite, OpenAI Operator, MultiOn) deliberately left out after independent verification.
Round 14: 24 corrections, including InterSystems and Infobip (headquarters turned out to be elsewhere than recorded) and Informatica (now owned by Salesforce after an $8B acquisition).
A dedicated page explaining why the tool stays free, why we depend on donations, and what your contribution actually funds.
Major addition after comparing the catalogue against three external lists of well-known enterprise software, customer data platforms and AI-security tools: 82 missing vendors added, including Oracle CX Cloud, SugarCRM, HashiCorp Vault and a range of customer data platforms and AI red-teaming tools.
Round 13: 31 corrections, including Hexagon Geospatial (now part of the newly independent Octave after a spin-off) and the familiar US-country/wrong-region-code inconsistency found five more times.
Round 12: 18 corrections, including Ghost (headquarters turned out to be Singapore, not the UK) and four community open-source projects wrongly marked "vendor-hosted".
Round 11: 18 corrections, including eleven community open-source projects wrongly marked "vendor-hosted", and Garden.io (headquarters turned out to be Germany, with an Israeli parent company since its 2024 acquisition).
Round 10: 15 corrections, including Erxes (headquarters turned out to be California, not Mongolia), Evernote and Etherpad (both had their controlling entity's country confused with their own headquarters), and three community open-source projects.
Round 9: 11 corrections, including the same internal inconsistency found five more times (a US country paired with the wrong region code) and four community open-source projects wrongly marked "vendor-hosted".
Round 8: 16 corrections. Biggest catch: Debian's legal entity is US-based, not German, and the "Dutch" Deel listing turned out to be a local office — the real headquarters is San Francisco. Also seven community open-source projects wrongly marked "vendor-hosted".
Two Dutch vendors added after a community submission: Screenbird (digital signage) and Voronai (customer data platform). Both independently verified, not taken on the vendor's word alone.
Round 7: 18 corrections. Biggest catch: CyberArk is headquartered in Israel, not the US (acquired by Palo Alto Networks in February). Also CrateDB (US, not Austria) and five community open-source projects wrongly marked "vendor-hosted".
The categories page listed categories sorted by EU-vendor count. Now sorted alphabetically instead, by the name as shown on screen.
Round 6: 9 corrections, including an incorrect UK parent on three Combell listings and on Complianz (team.blue, actually Belgian) and Concourse CI (correctly a distributed open-source project, not a company with a headquarters).
The badge now appears everywhere you browse vendors: the alternatives dashboard (rows, expanded alternatives, search results) and the map's vendor pop-up too.
The badge already appeared on vendor pages and in the report; now it shows next to every vendor on category and country pages too, so you can scan a whole list at a glance.
Right under every vendor's name there is now one clear mark: EU sovereign, self-host/open source, EU-hosted with a non-EU parent, or non-EU. The same badge now also appears in the paid report's vendor table.
Round 5: 11 corrections, including CiviCRM and Checkly (both actually US, not Belgium/Germany), Checkmk (no US parent at all — it's stayed German-owned throughout its history), and two open-source projects (Ceph, CapRover) wrongly marked "vendor-hosted".
Round 4: 13 corrections, including Blomp (US, not UK), two "self-host" listings (BookStack, Cachet) that used a generic EU placeholder despite a real registered company behind them, and three open-source projects (Blocky, BRouter, BookWyrm) wrongly marked "vendor-hosted" instead of distributed open source.
Round 3: the next 60 vendors checked. 5 corrections, including two missing parent companies (Auth0/Okta, Aware Health/Aeon) and two internal inconsistencies (a US headquarters paired with the wrong region code). A not-yet-completed acquisition (Bahnhof/Telenor) was deliberately left unrecorded.
Round 2 of the ongoing re-verification pass: the next 59 vendors (alphabetically) checked against independent sources. 7 corrections, including Anytype (Berlin, not Switzerland), AppFlowy (Singapore, not the US), and Alpine Linux (reclassified as an open-source project with no fixed headquarters). A premature merger (Aleph Alpha/Cohere) was removed from the data since it hasn't closed yet.
We've started an ongoing re-verification pass across the whole catalogue: 93% of vendors had a check date but no actual source behind it. Round 1 checked the first 60 (alphabetically) against independent sources and found 8 corrections (e.g. 4me turns out to be US-based, not Dutch) plus one duplicate (About You Cloud/Commerce = SCAYLE), now merged.
Every vendor page and report now shows whether the European Commission has found the headquarters country's data protection adequate — a real, citable EU legal fact. The US deliberately does not get a simple yes/no: the EU-US Data Privacy Framework only covers individually certified companies, so that status is marked separately as "conditional".
The previous update noted that Customer Data Platform, FinOps and Product Feedback had zero European vendors. Targeted European research found nine after all: Upvoty, Featurebase, Sleekplan and ProductLift (product feedback), Holori and Cycloid (FinOps), and Mediarithmics, Zeotap and Commanders Act (Customer Data Platform).
After a systematic review of our 90 categories, six missing software types turned up: Customer Data Platform, Feature Flags & Experimentation, FinOps, Enterprise Search, Product Feedback and Digital Whiteboards. 25 new vendors were added, and targeted research for European AI-security vendors surfaced Giskard (France) and Lakera (Switzerland). Along the way, two duplicate entries were caught and removed before going live.
AI security tools (prompt-injection defence, AI red-teaming, AI governance) are a fast-growing market that wasn't in our knowledge base yet. We've added 22 vendors — every fact independently checked, never taken at face value. One vendor from the source turned out to be just a coming-soon page and was deliberately left out; another's obvious domain turned out to belong to a completely different company.
euBackups (a German backup service for MSPs and businesses, built on Acronis, with backups stored in Germany) was submitted by the vendor itself. Before adding it, we independently checked every fact against their own legal notice, privacy policy and data processing agreement — never taking the submission at face value.
Vendor pages have shown badges like "Confirmed in registry" or "Vendor-stated" for a while — but nowhere explained what they actually mean. The "About this tool" page now spells out all four labels in plain language.
A vendor's "ultimate parent company" has been in our data for a while but was never actually shown anywhere — now fixed. For Sitecore Content Hub, the full ownership chain has also been researched and added.
For 103 vendors, the CSA STAR certification is no longer just "vendor-stated" but confirmed against the official CSA STAR registry — linking to its own registry entry instead of the vendor's generic page.
Established which network serves each vendor's website via a DNS lookup, for 2,216 of 2,227 vendors — the first evidence type that doesn't rely on anything the vendor itself publishes. Note: this is about the website, often behind a CDN, not necessarily where the service or data is actually hosted.
Every compliance field and certification now shows explicitly how it was established — today that's honestly always "vendor-stated", since that's what the research has done so far. The paid report shows compliance evidence for the first time.
Researched the next 200 most-recommended vendors again, including several previously-rejected vendors that came back this round with new, better evidence. One rejection rule in the merge script turned out too narrow (it only checked one field while the same bad page reappeared under a different field) and has been broadened.
Researched the next 200 most-recommended vendors again. In the process we found a bug in the merge script that had left three fields we had reported as rejected (Codefresh, Teamhood, Checkmk) quietly live ever since their own rounds. Fixed, and existing installations will pick this up automatically.
Researched the next 200 most-recommended vendors again. In the process we found that a bug in the merge script had silently skipped one 20-vendor research batch per round ever since round 2. Fixed, and every previously missed round was re-checked with the same rigor and added.
Added a separate Contact page for press, collaboration and other general enquiries — distinct from the vendor submission page. Linked from the footer.
Researched the next 200 most-recommended vendors again. Manual review removed six loose links that turned out not to be real evidence (among them a bare link overview instead of actual content, a data processing agreement belonging to a separate sibling product, and a page that only incidentally contained the word "security" in a menu). For Internxt, the combined legal page was partly legitimate: the security and subprocessor content was genuinely there, but the DPA and EU-hosting claims were not.
A reader flagged that Aiven runs on any cloud platform. That's correct: Aiven offers free region selection across six cloud platforms (AWS, Google Cloud, Azure, DigitalOcean, OVH, UpCloud) in over 100 regions worldwide. The catalogue's cloud-iaas record for Aiven wrongly said "EU hosting only"; this has been corrected to EU, US and APAC.
A reader flagged a contradiction on edgeContinuum's page: it said "closed source and hosted by the vendor", while the vendor actually runs on infrastructure the customer controls. Investigation found this affected 68 vendors in the catalogue, and not just the text — the key-management and source/runtime scores also didn't account for self-hosting. Both have been corrected.
Reviewed which software visitors type in during an assessment that the catalogue was still missing. Added: Affinity Photo (photo editing, UK/owned by Australia's Canva — catalogued as a recognisable non-EU vendor so EU alternatives can be shown), Ollama (locally-run open AI language models, open source) and Peakto (French photo catalogue management, a strong EU-owned find). Two other candidates turned out to be out of scope (physical alarm security) or already present under a different name (an Israeli, now US-owned, security company).
Added via the submission form: edgeContinuum, a Spanish cloud orchestration platform for self-managed virtual machines, Kubernetes and PostgreSQL, also suited to on-premises and air-gapped environments. Independently verified before adding (it was a self-submission by the vendor): category corrected to 'cloud-iaas' and the hosted-in-the-EU claim was not carried over for lack of hard evidence.
Researched the next 200 most-recommended vendors again. This round, eight loose links were removed that turned out, on manual review, not to be real evidence (among them an install page, a vendor's own homepage, and a marketing page about cybersecurity services rather than the vendor's own security policy). A reader flagged missing DPA evidence for BigBlueButton; that has been added.
Researched the next 200 most-recommended vendors again. This round's page-context review found no false certification claims, but caught eight loose links that only coincidentally contained a keyword without being real evidence (among them a review-site name misread as "trust", and two vendors where every field pointed to the same generic terms-of-service page); those were removed before the data was merged.
Researched the next 200 most-recommended vendors again, same method as the previous three rounds. Both certification claims in this round turned out, on manual review, to be a direct, first-person claim by the vendor itself (CELUM and elastic.io, both ISO/IEC 27001) and were kept.
Researched the next 200 most-recommended vendors, same method and rigor as the previous two rounds: every link was fetched and checked for content. Two certification claims were rejected after manual review: CrateDB's claim pointed to a different vendor's (Keboola) security page, and Kontainer's page only mentioned controls "based on" ISO 27001 and SOC 2, not its own certificate.
An attentive reader pointed out that TYPO3 GmbH (Düsseldorf, Germany) is the commercial arm, while ownership and governance of TYPO3 CMS — including the trademark — sits with the TYPO3 Association, registered in Baar (ZG), Switzerland. The country has been corrected to Switzerland and the classification to EFTA.
Following the first round (the largest cloud, SaaS and security vendors), compliance evidence has been extended to the 96 next vendors most often shown as European alternatives. Same method: every link was fetched and checked for content, and every certification claim was read in page context before inclusion — two claims were rejected here because they referred to a hosting partner's certification (AWS) or to contract text that only "commits to comply with" rather than showing the vendor's own certificate.
Vendor pages now show a Compliance evidence block linking to the vendor's own public documents: the data processing agreement (DPA), the subprocessor list, the security page or trust center, the page describing EU hosting and the page listing certifications such as ISO/IEC 27001, SOC 2, SecNumCloud or HDS. We only record what we actually found on the vendor's site; every link was fetched and checked for content on the check date. A missing link means not found publicly, not not compliant.
An application landscape of a large organisation was compared with the knowledge base: of 81 tools named, 17 were already listed, 40 are now added and 24 were deliberately left out (internal or unverifiable names, network functions, or telecom BSS without a fitting category). Every new record carries its check date and the public sources that substantiate jurisdiction, ownership, data location and the GDPR data-processing agreement, so the page can feed a DORA or NIS2 third-party file.
Every page is now built ahead of time and served directly instead of rendered per visit. Vendor pages repeat less boilerplate and link to their category page. The English homepage carries the tool's English name. The shop, the statistics page and the changelog have cleaner structured data; llms.txt is linked from the footer.
Every category page now explains in two sentences what data flows through it and what to check in a vendor, shows the date of the last check and points to related categories. Non-European vendors state their number of EU alternatives. Shorter page titles and a page-specific preview when shared on social media.
The overview of all categories now explains how we count and what "European" means, with the date of the last check and links to the methodology and the statistics. Each category now names its total. Sharing a page on LinkedIn or Mastodon shows the right title and link; the sitemap reports the real verification date per page.
New overview pages: per category every European vendor with country, owner and open-source status, plus the non-European vendors with their alternatives; per country every vendor by category with a note on the legal position. The statistics page shows the current knowledge base figures, including verification coverage, with a citation line.
Every vendor page now shows when the record was last checked and, for records since September 2026, the public sources used. The About page and the footer state explicitly what keeps us independent: no money from vendors, no sponsored listings, no paid labels and no affiliate links.
The home page explains why a sovereignty assessment matters now: NIS2 and DORA put vendor risk on your organisation, the CLOUD Act affects US vendors, and the GDPR and Data Act set requirements for data location and switching. The text about our verification now states exactly what we check, and verification is free for every vendor. Non-European vendor pages ask for missing European alternatives. In eleven thin categories 39 verified European vendors were added, from data platforms and AI assistants to planning, procurement and data governance.
A check of 120+ common enterprise products (data platforms, ERP satellites, integration, network, security and infrastructure) showed 92 were missing and that BI, data platforms, data governance, planning, procurement, supply chain, process mining, network management and endpoint management had no category at all. They exist now, including 111 European counterparts with curated alternative lists. Every fact (headquarters, owner, hosting) was web-verified per vendor.
Missing a European vendor or spotted an error? Use the new Submit a vendor page, or the correction link on every vendor page. We verify every submission against public sources before it enters the knowledge base. That is now visible too: every vendor carries the 'verified by hand' mark and the About page explains what we check.
The assessment results now show the three report variants side by side, with who they are for and a recommendation. Your vendor selection is carried over to the order and the sample report can be viewed everywhere.
Every vendor page now shows the sovereignty profile across five dimensions, explains why digital sovereignty matters with that vendor and what the free assessment delivers. The assessment button pre-selects the vendor in step 1.
The results and the shop now link to a sample report, so you can see what the report contains before ordering. The free results show the two most relevant European alternatives per vendor; the rest are in the report.
If you paste an application list and the knowledge base does not know a name, that name is counted so we can add the missing vendors. Only the name is kept, no IP address, session or selection. This sits under the same telemetry toggle in the footer.
The discussion questions for the board and the three-phase migration path are now part of the paid report and no longer shown on screen. The free results show the scores, the heatmap, the risk drivers and the European alternatives, and point to the report for the advice.
After an assessment, the option to order the report now sits at the top of the results page, with what the report adds to what you see on screen and the price. The button at the bottom stays.
The monthly cap on the annual product is gone. An access link now covers ten whitelabel reports within twelve months, each with its own vendor selection, whether you build them in one week or spread them over the year. Per report that is cheaper than the single report.
The annual product has changed. Instead of a download of the full dataset, the access link now gives twelve months of access to the report builder, with at most three whitelabel reports per calendar month. The knowledgebase itself is not for sale on its own; that is what the business licence is for.
A pasted application list showed eight common tools missing. They are now in the knowledgebase with verified origin and ownership: Alfred (UK), BBEdit (US), Goodnotes (Hong Kong), Fing (Ireland, part of Belgium's Lansweeper), MacWhisper (Netherlands), OrbStack (US), Docker Desktop (US), Spark by Readdle and Tailscale (Canada).
Searching per category is a lot of work when you already have an inventory. On the vendor step you can now paste a list, for example an export from your asset or licence register. The tool recognises the names (including variants such as 'Office 365', 'MS Teams' or 'Azure AD'), lets you choose when several vendors match and shows what was not found. Everything happens in your browser; nothing is uploaded.
The tool stays free. If you want to keep or forward a report, or use the dataset yourself, you can now order it: a dated report on your own vendor selection, the same report without Accans branding and under your own name, or twelve months of access to the current dataset with unlimited whitelabel reports. Payment is a one-off via Mollie; the download link and the invoice arrive automatically by e-mail. No account, no subscription.
Searching the alternatives dashboard for Jottacloud returned 'no applications found' — although Jottacloud is in the knowledge base and is even listed as an alternative to Dropbox, Google Drive, iCloud and OneDrive. The search box only covered the 418 non-EU services, and only their Dutch description. It now searches all 1,912 vendors by name, description (NL and EN) and category. In addition, 521 European providers turned out to be linked nowhere as an alternative; 454 of them are now added, data-driven, to the lists of their non-EU counterparts.
Claude Code showed two European alternatives, yet clicking Mistral Code showed four. The cause: every catalogue expansion added European providers, but the hand-curated lists of the US incumbents did not grow with them — Claude Code named 2 of 5 European coding assistants, Twilio 1 of 7 European SMS APIs, Grammarly 1 of 5. All 53 lagging lists in small categories are now complete, with fully European ownership and open source listed first. A new automated check keeps them in step.
Stripe sat under ERP & Finance with accounting packages as its 'alternatives', and a second Stripe entry registered the company as Irish — hence European. Stripe, Inc. is a US company (Delaware) dual-headquartered in San Francisco and Dublin; a European office does not make it a European vendor. There is now one Stripe under Payments, with fourteen European payment processors as alternatives. SumUp moves to Payments for the same reason. CyberArk showed two flags (US and UK): the company is American and has been part of Palo Alto Networks since February 2026. osTicket was European in one category and American in the other; its maker Enhancesoft is American. A new automated check requires entries of the same vendor to share the same origin.
Vendors active in several categories — Adyen and Mollie (e-commerce and payments), TransIP and Combell (cloud, DNS and web hosting), Signicat — appeared two or three times on the map, because each category is its own record in the database. That is intentional for the alternative lists, but confusing on the map. The map now shows one pin per vendor per country; the country list and detail panel list all categories, with an active category filter first.
The May cleanup gave Adyen and Mollie two entries each (e-commerce and payments), moved Directus to the US and removed a duplicate Soffos entry — but 29 alternative lists still pointed at the old names and therefore silently hid those alternatives. That is repaired: Adyen and Mollie are back under Stripe, and Adyen was removed as an 'alternative' to accounting and ERP packages, where a payment processor does not belong. The two Adyen entries are intentional: one as the checkout layer for webshops, one as the processor for large merchants; the descriptions now make that distinction clear. A new automated check prevents lists from pointing at removed names again.
With the CSRD, ever more European organisations must report on sustainability, and that business data deserves a European home. The new ESG & Sustainability category holds eleven European providers — including osapiens (Mannheim), Sweep, Greenly, Plan A, Tanso, Normative, Position Green, Coolset, Ecochain, IntegrityNext and Prewave — alongside US incumbents Workiva and Watershed with curated alternatives. Compliance-automation vendors Vanta and Norm Ai (US) were added with European alternatives such as Secfix, Kertos, Compleye and Cyberday, and KYC provider Sumsub (London) with Fourthline, Veriff, Ondato, iDenfy, WebID, Klippa and Signicat. IDnow is listed with the note that it has been US-owned since 2025.
The anonymous counters behind Community trends were doubly off until now: both the operator and the visitor had to enable them, leaving the page with barely any data. Measuring is now on by default. Nothing changes in what is counted: aggregated totals only, no personal data, no IP addresses, no cookies, and small groups are merged (k-anonymity). If you prefer not to take part, switch it off in the footer; that choice is remembered in your browser.
A targeted review with parallel agents and a news scan mapped what changed since summer — not what was already there. Ownership: Aleph Alpha merged into Canada's Cohere; Brevo is now held by a UK/US private-equity consortium. Licences: MongoDB (SSPL) and n8n (Sustainable Use License) are source-available, not open source, and are now recorded consistently. No new open→closed licence changes were found — the trend actually reversed. The sweep across all 78 categories added 88 European providers over two passes, focused on the 2026 sovereign-cloud wave (Clarence, S3NS, DEEP, Lyceum), eIDAS 2.0 identity (Duna, Ver.iD, Sybol), digital asset management (9) and the EuroStack office initiative Euro-Office. One candidate was deliberately rejected after verification (Passwork: Russian ties despite Spanish registration).
A web-verified, multi-agent review (Haiku 4.5) surfaced misclassified vendors. Fifteen EU/EFTA-based providers (incl. APPUiO, Bacula Systems, Locize, Efecte, KrakenD, Sygic, Hornetsecurity, Connective, Talend, Transifex, Henchman, Homerun, Pixlr, Tails, Dinero) were wrongly flagged as 'outside the EU' — their region is corrected to EU, with the actual foreign parent recorded separately (the signal that matters for the US CLOUD Act). Payload CMS is now marked as a US provider. FortKnoxster was removed after pivoting to crypto. Eight new EU providers were added in thinly-covered categories.
Passbolt was already in the catalogue under cybersecurity, but with the wrong jurisdiction (FR instead of LU) and an overly terse description. It is a Luxembourg-based open-source credential manager (AGPL-3.0) by Passbolt SA, aimed at IT and DevOps teams. Alongside the correction, a second entry was created under password-manager so users looking for an EU alternative to 1Password, Bitwarden, LastPass or RoboForm now find Passbolt there directly.
Systematic scan of the remaining business categories in two blocks of twenty, using Haiku finders and Sonnet verify. The catalogue now lists 1,771 vendors. Includes Elastic (NL, apparently never recorded as a database), Kestra (FR, workflow orchestration), Lovable (SE, AI development), Haystack/deepset (DE, open-source RAG), Snom (DE, VoIP), TSplus (FR, remote desktop), Graphisoft ArchiCAD (HU, CAD), Bacula Systems (CH, backup), Rebelle (SK, natural-media design), Locize (CH, developer TMS), seven previously missing European form/survey tools (AidaForm, easyfeedback, Edkimo, empirio, Crowdtech, QUESTIONSTAR, SmartSurvey), and esign alternatives Penneo (DK) and Buypass (NO).
Targeted gap scan on the twelve categories with the fewest EU alternatives. Twenty new vendors added, plus Otobo as a second open-source OTRS fork. Includes sovereign AI workspaces (Delos in Paris, nexos.ai in Vilnius, Nextcloud Assistant), captcha alternatives to reCAPTCHA (Private Captcha from Estonia, Captcha.eu from Austria, Myra EU CAPTCHA from Munich), writing tools (DeepL Write, Writefull, ProWritingAid, CKEditor), API management (Frends from Finland, Locoia from Germany, STOA from France), and transactional email (AhaSend from the Netherlands, MessageFlow from Poland).
Reviewed 1,223 vendors that were skipped in the previous audit using a cheaper overnight loop (Sonnet 4.6, split across six ticks): 78 confirmed findings, of which 67 changes applied. Includes new ownership structures (Harvest to Bending Spoons IT, MailerLite to Vercom PL, Fondy to TBC Bank GB, MariaDB commercial arm to K1 US, PAYONE under Worldline FR), licence rug-pulls from open source to source-available (CapRover, Chatwoot, Invoice Ninja, OpenKM, Planka, Rasa, TheHive), and removals (legacy SchildiChat Desktop, standalone Sofort, Juke, iRedMail Easy).
All 1,700 records reviewed via a layered agent swarm: 320 changes applied, including 153 ownership corrections, 73 headquarters corrections, 39 removals of discontinued or absorbed products, and 17 licence changes where formerly open-source projects moved to source-available or proprietary.
Twenty DAM vendors added — from OpenText, Adobe and Cloudinary to European alternatives such as WoodWing, Bynder, CELUM and Fotoware — with verified ownership structures and hosting regions.
Nine records with incorrect headquarters information corrected, 27 new European vendors added, and the schema extended with sovereignty metadata so each vendor's positioning is explicit and honest.
Read ADR-001 on EU provenance