EU Sovereignty Score

Updates from May 26, 2026 to September 20, 2026

To the most recent updates

Why now: NIS2, DORA and CLOUD Act on the home page; 39 European vendors added

The home page explains why a sovereignty assessment matters now: NIS2 and DORA put vendor risk on your organisation, the CLOUD Act affects US vendors, and the GDPR and Data Act set requirements for data location and switching. The text about our verification now states exactly what we check, and verification is free for every vendor. Non-European vendor pages ask for missing European alternatives. In eleven thin categories 39 verified European vendors were added, from data platforms and AI assistants to planning, procurement and data governance.

Enterprise software: 9 new categories and 214 vendors

A check of 120+ common enterprise products (data platforms, ERP satellites, integration, network, security and infrastructure) showed 92 were missing and that BI, data platforms, data governance, planning, procurement, supply chain, process mining, network management and endpoint management had no category at all. They exist now, including 111 European counterparts with curated alternative lists. Every fact (headquarters, owner, hosting) was web-verified per vendor.

Added

  • Categories: Data Platform & Warehouse, Business Intelligence, Data Governance & MDM, Planning & EPM, Procurement & Spend Management, Supply Chain & Asset Management, Process Mining & RPA, Network & Firewall Management, Endpoint & Device Management.
  • 103 non-European incumbents, including Databricks, BigQuery, Redshift, Microsoft Fabric, Oracle Database, SQL Server, Power BI, Tableau, Qlik, Collibra, Informatica, Fivetran, Confluent, MuleSoft, Boomi, Coupa, Anaplan, Kinaxis, Blue Yonder, IBM Maximo, Windchill, UiPath, Automation Anywhere, Splunk, Microsoft Sentinel, Defender, SentinelOne, Zscaler, Netskope, Tenable, Qualys, Rapid7, Proofpoint, Mimecast, Delinea, Saviynt, FortiGate, FortiManager, Panorama, Check Point, Cisco Catalyst Center and ISE, Aruba, Juniper Mist, F5, NetScaler, Infoblox, BlueCat, Configuration Manager, Jamf, Workspace ONE, Hyper-V, OpenShift, Veeam, Commvault, Rubrik, NetApp, Dell PowerStore, SolarWinds, SCOM, Ansible, Puppet, Terraform, Control-M, Automic.
  • 111 European vendors as alternatives, including Exasol and Keboola (data), Luzmo, Board, Bissantz and Knowage (BI), Stibo Systems, DataGalaxy and Dawiso (governance), Axual, Alumio and HiveMQ (integration), Pigment, LucaNet and CCH Tagetik (EPM), Basware, Onventis and Esker (procurement), RELEX, Slimstock, ORTEC, Generix and Körber (supply chain), Celonis, QPR and Fluxicon (process mining), Stormshield, genua, LANCOM, Securepoint, OPNsense, MikroTik and EfficientIP (network), baramundi, Aagon, Relution and FileWave (endpoint), Heimdal, Outpost24, Holm Security, Nexus, Mailinblack, Libraesva, Omada and Systancia (security), SEP sesam, Atempo and Keepit (backup), Redwood, Rudder, CFEngine and JS7 (automation).

Changed

  • Snowflake and Exasol moved to Data Platform; Jedox to Planning & EPM and Toucan Toco to Business Intelligence (they sat under web analytics and were even shown as Google Analytics alternatives); Microsoft Intune to Endpoint & Device Management with a proper UEM alternatives list.
  • Foreign ownership recorded where the owner sits in a different country than the HQ, including Basware, Mercell, Medius and ORTEC (US), Pagero (Canada), Zeenea (India), Alcatel-Lucent Enterprise (China), macmon and EfficientIP (US), One Identity (US via Clearlake).

Fixed

  • SAP S/4HANA Cloud was recorded as US-based, US-only hosted and non-GDPR; it is a product of SAP SE (Walldorf) with EU data centres in Frankfurt, Amsterdam and St. Leon-Rot.

Submit a vendor and the 'verified by hand' mark

Missing a European vendor or spotted an error? Use the new Submit a vendor page, or the correction link on every vendor page. We verify every submission against public sources before it enters the knowledge base. That is now visible too: every vendor carries the 'verified by hand' mark and the About page explains what we check.

Choose your report variant right at the results

The assessment results now show the three report variants side by side, with who they are for and a recommendation. Your vendor selection is carried over to the order and the sample report can be viewed everywhere.

Vendor pages explain what the assessment does

Every vendor page now shows the sovereignty profile across five dimensions, explains why digital sovereignty matters with that vendor and what the free assessment delivers. The assessment button pre-selects the vendor in step 1.

Sample report and more compact free results

The results and the shop now link to a sample report, so you can see what the report contains before ordering. The free results show the two most relevant European alternatives per vendor; the rest are in the report.

Unrecognised applications help the knowledge base grow

If you paste an application list and the knowledge base does not know a name, that name is counted so we can add the missing vendors. Only the name is kept, no IP address, session or selection. This sits under the same telemetry toggle in the footer.

Board questions and migration path now in the report

The discussion questions for the board and the three-phase migration path are now part of the paid report and no longer shown on screen. The free results show the scores, the heatmap, the risk drivers and the European alternatives, and point to the report for the advice.

Order the report right above your results

After an assessment, the option to order the report now sits at the top of the results page, with what the report adds to what you see on screen and the price. The button at the bottom stays.

Annual product: ten whitelabel reports, at your own pace

The monthly cap on the annual product is gone. An access link now covers ten whitelabel reports within twelve months, each with its own vendor selection, whether you build them in one week or spread them over the year. Per report that is cheaper than the single report.

Changed

  • The access page shows how many of the ten reports have been used.
  • The 'Support this tool' buttons now sit directly under the header of every page instead of in the footer.

Annual product: whitelabel reports, at most 3 per month

The annual product has changed. Instead of a download of the full dataset, the access link now gives twelve months of access to the report builder, with at most three whitelabel reports per calendar month. The knowledgebase itself is not for sale on its own; that is what the business licence is for.

Changed

  • The access page shows how many reports were used this month; the counter resets on the first of the month.

Removed

  • Dataset download (ZIP with CSV and JSON) from the annual product.

Nine desktop and prosumer tools added

A pasted application list showed eight common tools missing. They are now in the knowledgebase with verified origin and ownership: Alfred (UK), BBEdit (US), Goodnotes (Hong Kong), Fing (Ireland, part of Belgium's Lansweeper), MacWhisper (Netherlands), OrbStack (US), Docker Desktop (US), Spark by Readdle and Tailscale (Canada).

Added

  • Goodnotes with European note-taking alternatives (Bear, Joplin, Anytype, Nextcloud Notes, CryptPad, Zettlr, Capacities, Carnet); Tailscale with NetBird and WireGuard as European mesh-VPN alternatives.
  • Fing records the majority stake in Lansweeper by the UK's Bridgepoint announced in July 2026 (closing expected by end of 2026).

Paste an application list into the assessment

Searching per category is a lot of work when you already have an inventory. On the vendor step you can now paste a list, for example an export from your asset or licence register. The tool recognises the names (including variants such as 'Office 365', 'MS Teams' or 'Azure AD'), lets you choose when several vendors match and shows what was not found. Everything happens in your browser; nothing is uploaded.

Added

  • 'Support this tool' buttons in the footer of every page.
  • 'Paste an application list' panel at the top of the vendor step, with three groups: recognised, several possibilities, not found. The same panel is in the report order form and in the report builder.

Changed

  • Printing the results page yields only the summary (score and maturity band); the full report is the paid product.

Order a report or the dataset: pay once, delivered immediately

The tool stays free. If you want to keep or forward a report, or use the dataset yourself, you can now order it: a dated report on your own vendor selection, the same report without Accans branding and under your own name, or twelve months of access to the current dataset with unlimited whitelabel reports. Payment is a one-off via Mollie; the download link and the invoice arrive automatically by e-mail. No account, no subscription.

Added

  • 'Report and dataset' page with the three products, the licence terms and the business data licence.
  • 'Order report' button on the assessment results: the selected vendors are carried into the order form.
  • Order status page that shows the download link by itself after payment, even if the e-mail does not arrive.
  • 'Support this tool': buttons for a one-off contribution via Mollie.

Search on /alternatives now finds every vendor; 454 European providers linked as alternatives

Searching the alternatives dashboard for Jottacloud returned 'no applications found' — although Jottacloud is in the knowledge base and is even listed as an alternative to Dropbox, Google Drive, iCloud and OneDrive. The search box only covered the 418 non-EU services, and only their Dutch description. It now searches all 1,912 vendors by name, description (NL and EN) and category. In addition, 521 European providers turned out to be linked nowhere as an alternative; 454 of them are now added, data-driven, to the lists of their non-EU counterparts.

Added

  • Search hits outside the dashboard list (European providers, or non-EU services without a list) appear as a card linking to the vendor page and the EU alternatives from the same category.
  • No result? You get a suggestion ('Did you mean …?'), a clear button and, with a category filter active, a button to search all categories.
  • A link to /en/alternatives?q=… pre-fills the search box, so search engines and colleagues can link straight to a query.
  • 57 non-EU services that had no alternatives list yet (including WordPress self-host, Hugging Face, Zulip, Grafana) now have one; the dashboard shows 475 services instead of 418.

Changed

  • Lists were completed with the European providers from the same category, up to 20 per list, fully European ownership and open source first. Helsing (defence AI) is deliberately not listed as an alternative.
  • The counters are clarified: the map counts EU-based vendors (one marker per vendor, products listed separately); the dashboard counts non-EU services with curated EU alternatives.

Fixed

  • HubSpot Content Hub (headquartered in Ireland) now records its US parent HubSpot Inc., and therefore ranks last in its alternatives lists.

Alternative lists caught up: 53 lists were missing European providers from their own category

Claude Code showed two European alternatives, yet clicking Mistral Code showed four. The cause: every catalogue expansion added European providers, but the hand-curated lists of the US incumbents did not grow with them — Claude Code named 2 of 5 European coding assistants, Twilio 1 of 7 European SMS APIs, Grammarly 1 of 5. All 53 lagging lists in small categories are now complete, with fully European ownership and open source listed first. A new automated check keeps them in step.

Fixed

  • Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Windsurf: now also JetBrains AI Assistant, Lurus Code and Poolside. Copilot/Claude (cowork): Delos, nexos.ai, Nextcloud Assistant, Noota. Twilio/Vonage: 46elks, Messente, seven, SMSAPI, TextMagic, tyntec. Grammarly: DeepL Write, Writefull, CKEditor, Surfer SEO. Plus captcha, consent, transactional email, error tracking, API management, DNS, registrars, fintech, helpdesk, database.

Stripe now under Payments (and no longer as an 'EU vendor'); CyberArk and osTicket corrected

Stripe sat under ERP & Finance with accounting packages as its 'alternatives', and a second Stripe entry registered the company as Irish — hence European. Stripe, Inc. is a US company (Delaware) dual-headquartered in San Francisco and Dublin; a European office does not make it a European vendor. There is now one Stripe under Payments, with fourteen European payment processors as alternatives. SumUp moves to Payments for the same reason. CyberArk showed two flags (US and UK): the company is American and has been part of Palo Alto Networks since February 2026. osTicket was European in one category and American in the other; its maker Enhancesoft is American. A new automated check requires entries of the same vendor to share the same origin.

Fixed

  • Stripe: one entry under Payments (US); the misleading 'Stripe (EU)' entry removed; alternatives are now European payment processors.
  • SumUp → Payments. CyberArk: both entries US (Palo Alto Networks). osTicket: both entries US (Enhancesoft) and no longer shown as an EU alternative.

Map: one pin per vendor, with all its categories

Vendors active in several categories — Adyen and Mollie (e-commerce and payments), TransIP and Combell (cloud, DNS and web hosting), Signicat — appeared two or three times on the map, because each category is its own record in the database. That is intentional for the alternative lists, but confusing on the map. The map now shows one pin per vendor per country; the country list and detail panel list all categories, with an active category filter first.

Changed

  • Map groups records per vendor and country; the subtitle count now reflects unique vendors.

Adyen and Mollie visible again as alternatives to Stripe; 29 alternative lists repaired

The May cleanup gave Adyen and Mollie two entries each (e-commerce and payments), moved Directus to the US and removed a duplicate Soffos entry — but 29 alternative lists still pointed at the old names and therefore silently hid those alternatives. That is repaired: Adyen and Mollie are back under Stripe, and Adyen was removed as an 'alternative' to accounting and ERP packages, where a payment processor does not belong. The two Adyen entries are intentional: one as the checkout layer for webshops, one as the processor for large merchants; the descriptions now make that distinction clear. A new automated check prevents lists from pointing at removed names again.

Fixed

  • Stripe → Adyen and Mollie restored; Collabora Online → SoftMaker Office restored; Adyen removed from 15 ERP/accounting lists, Directus (US) from 11 CMS lists.
  • Mollie, TransIP and Combell are deliberately listed in several categories (checkout vs. payment processing; cloud vs. DNS vs. web hosting); their descriptions now make that distinction clear. TransIP, like Combell, is part of team.blue (Hg Capital, UK) — now recorded as such.

New ESG & Sustainability category, plus Vanta, Norm Ai and Sumsub with EU alternatives

With the CSRD, ever more European organisations must report on sustainability, and that business data deserves a European home. The new ESG & Sustainability category holds eleven European providers — including osapiens (Mannheim), Sweep, Greenly, Plan A, Tanso, Normative, Position Green, Coolset, Ecochain, IntegrityNext and Prewave — alongside US incumbents Workiva and Watershed with curated alternatives. Compliance-automation vendors Vanta and Norm Ai (US) were added with European alternatives such as Secfix, Kertos, Compleye and Cyberday, and KYC provider Sumsub (London) with Fourthline, Veriff, Ondato, iDenfy, WebID, Klippa and Signicat. IDnow is listed with the note that it has been US-owned since 2025.

Added

  • ESG & Sustainability category (13 providers, 11 European).
  • Compliance & GRC: Vanta, Norm Ai (US) + Secfix, Kertos, Compleye, Cyberday (EU).
  • Identity/KYC: Sumsub (GB) + Fourthline, Veriff, Ondato, iDenfy, WebID, Klippa, Signicat, IDnow (US-owned since 2025).
  • New personal category Health & DNA: Superpower, Function Health, Evvy, Maximus, 23andMe, AncestryDNA, Nebula (US) and MyHeritage (IL, US-owned) with European alternatives Neko Health, Werlabs, Blodkollen, Kry/Livi, Lykon, Aware, GoSpring, Dante Labs, tellmeGen and 24Genetics. Health data is a special category under the GDPR — jurisdiction matters most here. Oura is deliberately absent: legally American since February 2026.

Community trends are now on by default (opt-out)

The anonymous counters behind Community trends were doubly off until now: both the operator and the visitor had to enable them, leaving the page with barely any data. Measuring is now on by default. Nothing changes in what is counted: aggregated totals only, no personal data, no IP addresses, no cookies, and small groups are merged (k-anonymity). If you prefer not to take part, switch it off in the footer; that choice is remembered in your browser.

Changed

  • Telemetry is opt-out instead of double opt-in; the footer now states explicitly that data is shared and how to switch it off.

Change review: 88 new EU providers, 2 ownership changes, 3 licence corrections

A targeted review with parallel agents and a news scan mapped what changed since summer — not what was already there. Ownership: Aleph Alpha merged into Canada's Cohere; Brevo is now held by a UK/US private-equity consortium. Licences: MongoDB (SSPL) and n8n (Sustainable Use License) are source-available, not open source, and are now recorded consistently. No new open→closed licence changes were found — the trend actually reversed. The sweep across all 78 categories added 88 European providers over two passes, focused on the 2026 sovereign-cloud wave (Clarence, S3NS, DEEP, Lyceum), eIDAS 2.0 identity (Duna, Ver.iD, Sybol), digital asset management (9) and the EuroStack office initiative Euro-Office. One candidate was deliberately rejected after verification (Passwork: Russian ties despite Spanish registration).

Added

  • Sovereign cloud: Clarence (LU, air-gapped, EC Cloud III), S3NS (FR, Thales — on Google technology, stated explicitly), DEEP/POST Luxembourg (LU), Lyceum (DE, GPU cloud).
  • Euro-Office (EuroStack consortium, open source), Twake (LINAGORA), Wero (EPI, European payment scheme), BirdyChat (LV, DMA-interoperable messenger), NymVPN (CH), Mave and Jet-Stream (NL, video).
  • Identity & legal: Duna, Ver.iD (NL), Sybol (ES), Engity (DE), Bayshore and LawX (DE). Compliance: Formalize (DK). Payments: Flatpay (DK). CRM/marketing: Folk (FR), Splio (FR), Keila (DE).
  • Digital asset management (9): Mediaflow (SE), Kontainer (DK), Pixelboxx, ATAMYA, pixx.io, DALIM (DE), Tedial (ES), Hyphen-Italia (IT), Filecamp (CH). Also: Kreezalid, Synera, involve.me, Uniqkey, Mirro, SilentShield, Messente, seven, 46elks and Airtable (US, Italian acquisition pending).
  • Second pass over the thinly-searched categories (47, from curated EU directories): uptime monitoring was a blind spot — Hyperping (FR), Oh Dear (BE), UptimeRobot (SK), Checkly, Uptrace, Statuspal, Uptimia, Monibot (DE), Phare (EE), PingPing (NL), Testomato (CZ), Odown (FI), updown.io (FR), Semonto (BE) and GlitchTip (DE, error tracking). Hosting: cloudscale.ch, Servebolt (NO), T Cloud (Telekom), Virtua.Cloud, Clouding (ES), HostPress, TimmeHosting. Analytics: fusedeck, digistats (CH), Sitesights, Alceris (DE), Stormly (NL), tinylytics (PL), Analyzati (ES). Also: EmailConnect, Timing, timr, Cryptee, Impossible Cloud, Intercolo, Cubbit, Calligra Suite, Capacities, smasi, Notefox, BlueSpice, OpenNebula, Automatisch, elastic.io, next layer, Buddy and Radicle.

Changed

  • Aleph Alpha: owner → Canada (merger with Cohere, April 2026). Brevo, Brevo CRM and Newsletter2Go: owner → Oakley Capital (UK) / General Atlantic (US), late 2025.
  • MongoDB and n8n (2 entries) no longer recorded as open source: SSPL and the Sustainable Use License are source-available, not OSI-approved — consistent with CockroachDB, Sentry and MinIO.
  • ONLYOFFICE: Workspace Cloud discontinued (2 March 2026), DocSpace continues. Aiven: Cassandra, AlloyDB Omni and Dragonfly discontinued.

Ownership audit: 16 jurisdiction fixes and 8 new EU vendors

A web-verified, multi-agent review (Haiku 4.5) surfaced misclassified vendors. Fifteen EU/EFTA-based providers (incl. APPUiO, Bacula Systems, Locize, Efecte, KrakenD, Sygic, Hornetsecurity, Connective, Talend, Transifex, Henchman, Homerun, Pixlr, Tails, Dinero) were wrongly flagged as 'outside the EU' — their region is corrected to EU, with the actual foreign parent recorded separately (the signal that matters for the US CLOUD Act). Payload CMS is now marked as a US provider. FortKnoxster was removed after pivoting to crypto. Eight new EU providers were added in thinly-covered categories.

Added

  • Eight new EU providers: Poolside (FR, AI coding), Noota (FR, AI cowork), Better Stack (CZ, error tracking), TRUENDO (AT, consent), DNS4EU (CZ, privacy DNS), MailerSend (LT, transactional email), Giskard (FR, open-source AI testing) and Black Forest Labs (DE, AI).

Removed

  • FortKnoxster removed — acquired by SYS Labs (Canada) and pivoted to crypto (SuperDapp); no longer an identity product.

Fixed

  • Region corrected from 'outside EU' to EU for 15 EU/EFTA-based providers; foreign owners (US/UK/AU/MY) are recorded separately via ultimate_parent_country rather than via the region.
  • Payload CMS classified as a US provider (US HQ, owned by Figma).

Passbolt corrected (LU) and added to password-manager category

Passbolt was already in the catalogue under cybersecurity, but with the wrong jurisdiction (FR instead of LU) and an overly terse description. It is a Luxembourg-based open-source credential manager (AGPL-3.0) by Passbolt SA, aimed at IT and DevOps teams. Alongside the correction, a second entry was created under password-manager so users looking for an EU alternative to 1Password, Bitwarden, LastPass or RoboForm now find Passbolt there directly.

Added

  • Passbolt as a second entry under password-manager (alongside the existing cybersecurity entry), linked as an alternative to 1Password, Bitwarden, LastPass and RoboForm.

Fixed

  • Passbolt: HQ corrected from FR to LU (Passbolt SA, Belvaux, Luxembourg), AGPL-3.0 license made explicit, description expanded.

Gap analysis round 2: 75 new EU vendors across 40 categories

Systematic scan of the remaining business categories in two blocks of twenty, using Haiku finders and Sonnet verify. The catalogue now lists 1,771 vendors. Includes Elastic (NL, apparently never recorded as a database), Kestra (FR, workflow orchestration), Lovable (SE, AI development), Haystack/deepset (DE, open-source RAG), Snom (DE, VoIP), TSplus (FR, remote desktop), Graphisoft ArchiCAD (HU, CAD), Bacula Systems (CH, backup), Rebelle (SK, natural-media design), Locize (CH, developer TMS), seven previously missing European form/survey tools (AidaForm, easyfeedback, Edkimo, empirio, Crowdtech, QUESTIONSTAR, SmartSurvey), and esign alternatives Penneo (DK) and Buypass (NO).

Added

  • Databases and data: Elastic (NL, AGPLv3-restored), Kestra (FR, Apache-2.0 orchestrator).
  • Remote desktop & VoIP: TSplus (FR), RealVNC (GB), Snom (DE), Equada (DE), Nomado (BE), Voiped Telecom (NL).
  • GIS & CAD: Oslandia (FR, open source), OPENGIS.ch (CH), Coexya (FR), Eurosense (BE), Pix4D (CH), Lutra Consulting (GB), Graphisoft ArchiCAD (HU), Graebert ARES (DE), ELITECAD (AT), Cadwork (CH), Leica Geosystems (CH).
  • Compliance, GRC & HR: DataGuard (DE), Orbiq (DE), EuroComply (PT), Talentech (NO), Eploy (GB), Vouch (NO), Breathe HR (GB), Ubisecure (FI).
  • Scheduling, time-tracking & low-code: Calenso (CH), Cronofy (GB), Reservio (CZ), Agendize (FR), solidtime (AT, open source), Time Cockpit (AT), timeBuzzer (DE), WeWeb (FR), Cerberus Testing (FR, open source).
  • AI & design: Lovable (SE), Haystack/deepset (DE, open source), Rebelle (SK), ArtFlow (PL).
  • Backup & translation: Bacula Systems (CH, AGPLv3), Xopero (PL), Locize (CH), Apertium (ES, open source), Protemos (UA).
  • Forms & surveys: AidaForm, Edkimo, empirio.ai, easyfeedback, QUESTIONSTAR (all DE), Crowdtech (NL), SmartSurvey (GB) — this category was chronically under-supplied with EU alternatives.
  • Marketing, esign & CMS: Omnisend (LT), AGNITAS (DE, open source), Membrain (SE), Quarticon (PL), sproof (AT), Commfides (NO), Penneo (DK), Buypass (NO), Jahia (CH), Microweber (BG, open source), Roadiz (FR, open source).
  • Other: Beckhoff Automation (DE, IoT), KEBA (AT, IoT), Joker.com (DE, domain registrar), Tine 2.0 (DE, email/groupware), APPUiO (CH, virtualization), Keelearning (DE, LMS), Hornbill (GB, ITSM), Linphone (FR, open source collaboration), SendRec (RO, open source collaboration), Elestio (IE, DevOps), World4You (AT, webhosting), Coolhousing (CZ, webhosting).

Gap analysis: 21 new EU vendors added in the thinnest categories

Targeted gap scan on the twelve categories with the fewest EU alternatives. Twenty new vendors added, plus Otobo as a second open-source OTRS fork. Includes sovereign AI workspaces (Delos in Paris, nexos.ai in Vilnius, Nextcloud Assistant), captcha alternatives to reCAPTCHA (Private Captcha from Estonia, Captcha.eu from Austria, Myra EU CAPTCHA from Munich), writing tools (DeepL Write, Writefull, ProWritingAid, CKEditor), API management (Frends from Finland, Locoia from Germany, STOA from France), and transactional email (AhaSend from the Netherlands, MessageFlow from Poland).

Added

  • AI Cowork: Delos (FR, sovereign French AI workspace platform), nexos.ai (LT, founded by Nord Security founders), Nextcloud Assistant (DE, open source, self-host).
  • Writing tools: DeepL Write (DE), Writefull (NL, academic), ProWritingAid (GB), Surfer SEO (PL), CKEditor (PL, open source).
  • API Management: Frends (FI), Locoia (DE), STOA (FR, open source).
  • CAPTCHA: Private Captcha (EE), Myra EU CAPTCHA (DE), Captcha.eu (AT) — all GDPR-compliant and cookieless.
  • SMS API: tyntec (DE, Tier-1 CPaaS). Digital Signage: ScreenCom (NL). Consent Management: Cookie Information (DK). AI Coding: Lurus Code (DE). Transactional Email: AhaSend (NL), MessageFlow (PL). ITSM: Otobo (DE, second active OTRS fork alongside Znuny).

Second audit pass: 67 corrections on vendors skipped in the previous round

Reviewed 1,223 vendors that were skipped in the previous audit using a cheaper overnight loop (Sonnet 4.6, split across six ticks): 78 confirmed findings, of which 67 changes applied. Includes new ownership structures (Harvest to Bending Spoons IT, MailerLite to Vercom PL, Fondy to TBC Bank GB, MariaDB commercial arm to K1 US, PAYONE under Worldline FR), licence rug-pulls from open source to source-available (CapRover, Chatwoot, Invoice Ninja, OpenKM, Planka, Rasa, TheHive), and removals (legacy SchildiChat Desktop, standalone Sofort, Juke, iRedMail Easy).

Changed

  • 42 new ownership corrections for vendors whose parent had moved to a different jurisdiction — including Nets → Nexi (IT), Nmbrs → Visma (NO), SnelStart → EG (DE), Magnolia → GENUI (DE), Roundcube → mailbox.org (DE), Signaturit → Namirial (IT), SMSAPI → LINK Mobility (NO), Sympa → US, Tidal → US, Topicus Healthcare → CA.
  • 10 headquarters corrections (SigNoz was mis-classified as DE, actually US; Vendure is Vienna, not Prague; Corteza is IE, not SI; Quire is TW; NoMachine is LU; WEDOS relocated CZ → LU).
  • 10 licence changes: CapRover, Chatwoot, Invoice Ninja, OpenKM, OTRS, OXID eSales, Planka, Rasa and TheHive lost open-source status (Fair Use, custom EULA or open-core with commercial core). Descriptions updated with the date and nature of the licence change.
  • Rebrand corrections: Gardener (SAP) → Gardener (NeoNephos Foundation), Lectora (eLearning Brothers) → Lectora (ELB Learning), Restorepoint → Skylar Compliance, MobilePay + Vipps → single 'Vipps MobilePay' entry, myLoc → myLoc a WIIT Company, Trilium Notes → Trilium Notes (TriliumNext), windream → dataglobal.

Removed

  • 5 vendors removed due to discontinuation, absorption or duplication: SchildiChat Desktop (now 'legacy'), Sofort as standalone (folded into Klarna), JUKE (Talpa discontinued the service), iRedMail Easy (hosted version), MobilePay (merged into Vipps).

Full audit of acquisitions, ownership and licences

All 1,700 records reviewed via a layered agent swarm: 320 changes applied, including 153 ownership corrections, 73 headquarters corrections, 39 removals of discontinued or absorbed products, and 17 licence changes where formerly open-source projects moved to source-available or proprietary.

Changed

  • 153 ultimate parents and EU classifications updated — e.g. DocuWare (owned by Ricoh, JP), DomainFactory (owned by GoDaddy, US), Doxis/SER Group (TA Associates majority, US), Dokobit (folded into Signicat, NO/EEA).
  • 73 headquarters corrections including Dynatrace and Bruker (operational HQ moved to the US) and Duplicati (incorporating entity Duplicati Inc is US-based).
  • 26 product rebrands applied: Doxis4 → Doxis, HubSpot CMS → HubSpot Content Hub, All 4 → Channel 4, Bugsnag → SmartBear Insight Hub, Byte → Hypernode, and more.

Removed

  • 39 vendors removed that have shut down or been absorbed: Boxcryptor (assets to Dropbox, closed January 2023), BullGuard (NortonLifeLock, phased out), Buttercup (project ended June 2025), Hotjar (merged into Contentsquare, July 2025), BrutX (streaming closed 2022), ZenMate (absorbed into CyberGhost), Reaction Commerce (ended), Pootle (closed May 2023) and 31 others. Platform.sh also removed in favour of its successor Upsun.

Fixed

  • 17 projects previously marked as open source corrected to open-core or proprietary: Airbyte (ELv2), Anytype, Cal.com (AGPL → commercial licences for enterprise), Camunda, CockroachDB (BSL), Directus (BSL), FusionAuth, Kopano, Meilisearch (commercial clauses), MinIO (AGPLv3 but recalibrated), Mirth Connect, NocoDB, ONLYOFFICE, Proton Pass, Sentry (FSL), Talend, Chartbrew.

New category: Digital Asset Management

Twenty DAM vendors added — from OpenText, Adobe and Cloudinary to European alternatives such as WoodWing, Bynder, CELUM and Fotoware — with verified ownership structures and hosting regions.

Added

  • Digital Asset Management (DAM) category with 20 vendors: European options WoodWing (NL), Bynder (NL), CELUM (AT), censhare (DE), 4ALLPORTAL (DE), Wedia (FR), QBank (SE), Fotoware (NO), Papirfly (NO), Frontify (CH), Pimcore (AT) and ResourceSpace (GB, open source) alongside OpenText, Adobe Experience Manager Assets, Cloudinary, Acquia DAM, Sitecore Content Hub, Canto, Aprimo and Brandfolder.

Changed

  • Pimcore marked as open-core instead of open source — the core is proprietary (POCL licence) since version 12 (2025).
  • Ownership recorded: Bynder has a US parent (Thomas H. Lee Partners, majority since 2023) and Wedia is no longer publicly listed since late 2024 (Cathay Capital, Paris).

Vendor database cleaned up and expanded

Nine records with incorrect headquarters information corrected, 27 new European vendors added, and the schema extended with sovereignty metadata so each vendor's positioning is explicit and honest.

Read ADR-001 on EU provenance

Added

  • 27 new EU vendors — including Didomi, Axeptio and consentmanager.net (consent management), Dynatrace and Pandora FMS (monitoring), Make.com and SeaTable (low-code), memoQ, Phrase TMS and Wordbee (translation), Trade Republic (fintech), Aircall (helpdesk) and Nedap Healthcare.
  • Three new per-vendor metadata fields: ultimate parent company (e.g. Wrike is owned by Symphony Industrial), sovereignty mode (vendor-hosted-eu / self-host / oss-distributed / vendor-hosted-non-eu) and a sharper EU classification (EU-27 / EEA / EFTA / EU-adjacent).
  • Nine invariant tests in CI that prevent regressions — no EU sentinel without a sovereignty mode, no duplicate (name, category) pairs, no non-HTTPS websites, etc.

Changed

  • Hologic, Carestream Health, Wrike and WordPress (self-host) moved from EU to US — these are US incumbents, not European alternatives.
  • RustDesk (China), Logseq (Singapore) and Synology Drive on-prem (Taiwan) corrected to the developer's actual country; sovereign only when used locally or self-hosted.
  • Bitrix24 corrected to Cyprus (legal entity) with explicit disclosure of Russian origin.
  • Wire (Switzerland), Directus (US, BSL-licensed) and SumUp (UK post-Brexit) reclassified.
  • 57 Swiss vendors tagged EFTA, 29 Norwegian/Icelandic as EEA, 4 Ukrainian as EU-adjacent.

Removed

  • Misleading and duplicate records removed: a second Epic record labelled EU (real HQ is Verona WI), a duplicate SumUp and Directus entry, a duplicate SoftMaker Office, and Adyen/Mollie from the ERP category (they are payment processors, not ERP systems).