EU Sovereignty Score

Updates from September 20, 2026 to September 27, 2026

To the most recent updates

Six new categories and more European AI-security vendors

After a systematic review of our 90 categories, six missing software types turned up: Customer Data Platform, Feature Flags & Experimentation, FinOps, Enterprise Search, Product Feedback and Digital Whiteboards. 25 new vendors were added, and targeted research for European AI-security vendors surfaced Giskard (France) and Lakera (Switzerland). Along the way, two duplicate entries were caught and removed before going live.

Added

  • Six new categories with 25 vendors, plus Giskard and Lakera added to AI Security.

Fixed

  • Miro and Mural moved to the new, more specific "Digital Whiteboards" category.

New "AI Security" category with 22 verified vendors

AI security tools (prompt-injection defence, AI red-teaming, AI governance) are a fast-growing market that wasn't in our knowledge base yet. We've added 22 vendors — every fact independently checked, never taken at face value. One vendor from the source turned out to be just a coming-soon page and was deliberately left out; another's obvious domain turned out to belong to a completely different company.

Added

  • New "AI Security" category with 22 vendors (1 European: NeuralTrust from Barcelona), each with source citations and a technical hosting signal.

euBackups added

euBackups (a German backup service for MSPs and businesses, built on Acronis, with backups stored in Germany) was submitted by the vendor itself. Before adding it, we independently checked every fact against their own legal notice, privacy policy and data processing agreement — never taking the submission at face value.

Added

  • euBackups added to the storage/backup category, with source citations and a technical hosting signal.

Explanation of our four verification labels added to "About this tool"

Vendor pages have shown badges like "Confirmed in registry" or "Vendor-stated" for a while — but nowhere explained what they actually mean. The "About this tool" page now spells out all four labels in plain language.

Added

  • An overview of the four verification labels (vendor-stated, confirmed in registry, technically measured, not yet checked) on the "About this tool" page.

Ownership chain and ultimate parent company now shown on the vendor page

A vendor's "ultimate parent company" has been in our data for a while but was never actually shown anywhere — now fixed. For Sitecore Content Hub, the full ownership chain has also been researched and added.

Added

  • New "Ultimate parent company" and "Sovereignty model" facts on the vendor page, plus an "Ownership chain" section where this has been researched.

Certifications cross-checked against an independent registry (CSA STAR)

For 103 vendors, the CSA STAR certification is no longer just "vendor-stated" but confirmed against the official CSA STAR registry — linking to its own registry entry instead of the vendor's generic page.

Added

  • Certification badges show "Confirmed in registry" once a vendor is independently found in the CSA STAR registry, linking directly to that entry.

Technical hosting signal: independent evidence, not sourced from the vendor

Established which network serves each vendor's website via a DNS lookup, for 2,216 of 2,227 vendors — the first evidence type that doesn't rely on anything the vendor itself publishes. Note: this is about the website, often behind a CDN, not necessarily where the service or data is actually hosted.

Added

  • New "Technical hosting signal" section on the vendor page and, for the first time, in the paid PDF report — badged "technically measured", the strongest provenance level.

Provenance badges on compliance evidence, now also in the PDF report

Every compliance field and certification now shows explicitly how it was established — today that's honestly always "vendor-stated", since that's what the research has done so far. The paid report shows compliance evidence for the first time.

Added

  • Provenance badge on every DPA/subprocessor/security/EU-hosting link and every certification on the vendor page.
  • The paid PDF report now also shows compliance evidence per vendor, with the same provenance badges.

Compliance evidence extended to 580 vendors (round 10)

Researched the next 200 most-recommended vendors again, including several previously-rejected vendors that came back this round with new, better evidence. One rejection rule in the merge script turned out too narrow (it only checked one field while the same bad page reappeared under a different field) and has been broadened.

Added

  • 580 vendors with compliance evidence in total (516 European, 64 non-European): 242 DPAs, 63 subprocessor lists, 463 security pages, 150 EU-hosting pages and 38 vendors with certifications.

Fixed

  • A rejection rule for one vendor's bad page previously checked only one field; it now checks every field at once.

Compliance evidence extended to 561 vendors (round 9) — plus a fix for three earlier rejections that had silently failed

Researched the next 200 most-recommended vendors again. In the process we found a bug in the merge script that had left three fields we had reported as rejected (Codefresh, Teamhood, Checkmk) quietly live ever since their own rounds. Fixed, and existing installations will pick this up automatically.

Added

  • 561 vendors with compliance evidence in total (497 European, 64 non-European): 228 DPAs, 61 subprocessor lists, 456 security pages, 150 EU-hosting pages and 37 vendors with certifications.

Fixed

  • Fixed a bug that had left three previously-rejected vendor fields (Codefresh, Teamhood, Checkmk) live by mistake.

Compliance evidence extended to 540 vendors (round 8) — plus a fix that backfills earlier rounds

Researched the next 200 most-recommended vendors again. In the process we found that a bug in the merge script had silently skipped one 20-vendor research batch per round ever since round 2. Fixed, and every previously missed round was re-checked with the same rigor and added.

Added

  • 540 vendors with compliance evidence in total (476 European, 64 non-European): 220 DPAs, 60 subprocessor lists, 445 security pages, 148 EU-hosting pages and 37 vendors with certifications.

Fixed

  • Fixed a script bug that had been skipping one research batch per round since round 2; the missed findings were checked and added retroactively.

New: Contact page

Added a separate Contact page for press, collaboration and other general enquiries — distinct from the vendor submission page. Linked from the footer.

Added

  • Contact page (NL/EN) with an email address for general enquiries.

Compliance evidence extended to 520 vendors (round 7)

Researched the next 200 most-recommended vendors again. Manual review removed six loose links that turned out not to be real evidence (among them a bare link overview instead of actual content, a data processing agreement belonging to a separate sibling product, and a page that only incidentally contained the word "security" in a menu). For Internxt, the combined legal page was partly legitimate: the security and subprocessor content was genuinely there, but the DPA and EU-hosting claims were not.

Added

  • 520 vendors with compliance evidence in total (457 European, 63 non-European): 208 DPAs, 58 subprocessor lists, 428 security pages, 147 EU-hosting pages and 36 vendors with certifications.

Fixed

  • Codefresh: updated the vendor description — the codefresh.io marketing site was folded into parent company Octopus Deploy's site in 2026; existing customers still log in under the Codefresh name.

Fix: Aiven does not host exclusively in the EU

A reader flagged that Aiven runs on any cloud platform. That's correct: Aiven offers free region selection across six cloud platforms (AWS, Google Cloud, Azure, DigitalOcean, OVH, UpCloud) in over 100 regions worldwide. The catalogue's cloud-iaas record for Aiven wrongly said "EU hosting only"; this has been corrected to EU, US and APAC.

Fixed

  • Aiven's hosting regions corrected from EU-only to EU, US and APAC.

Fix: self-hostable vendors were incorrectly scored as "hosted by the vendor"

A reader flagged a contradiction on edgeContinuum's page: it said "closed source and hosted by the vendor", while the vendor actually runs on infrastructure the customer controls. Investigation found this affected 68 vendors in the catalogue, and not just the text — the key-management and source/runtime scores also didn't account for self-hosting. Both have been corrected.

Fixed

  • Self-hostable, closed-source vendors now score better on key management and source/runtime sovereignty, and the description correctly states that you control the hosting location and keys yourself.

Three new vendors: Affinity Photo, Ollama, Peakto

Reviewed which software visitors type in during an assessment that the catalogue was still missing. Added: Affinity Photo (photo editing, UK/owned by Australia's Canva — catalogued as a recognisable non-EU vendor so EU alternatives can be shown), Ollama (locally-run open AI language models, open source) and Peakto (French photo catalogue management, a strong EU-owned find). Two other candidates turned out to be out of scope (physical alarm security) or already present under a different name (an Israeli, now US-owned, security company).

Added

  • Affinity Photo (Design), Ollama (AI) and Peakto (Photo & Video) added to the catalogue.

New vendor: edgeContinuum (Spain)

Added via the submission form: edgeContinuum, a Spanish cloud orchestration platform for self-managed virtual machines, Kubernetes and PostgreSQL, also suited to on-premises and air-gapped environments. Independently verified before adding (it was a self-submission by the vendor): category corrected to 'cloud-iaas' and the hosted-in-the-EU claim was not carried over for lack of hard evidence.

Added

  • edgeContinuum added to the cloud infrastructure category.

Compliance evidence extended to 471 vendors (round 6)

Researched the next 200 most-recommended vendors again. This round, eight loose links were removed that turned out, on manual review, not to be real evidence (among them an install page, a vendor's own homepage, and a marketing page about cybersecurity services rather than the vendor's own security policy). A reader flagged missing DPA evidence for BigBlueButton; that has been added.

Added

  • 471 vendors with compliance evidence in total (410 European, 61 non-European): 193 DPAs, 57 subprocessor lists, 388 security pages, 144 EU-hosting pages and 31 vendors with certifications.

Compliance evidence extended to 410 vendors (round 5)

Researched the next 200 most-recommended vendors again. This round's page-context review found no false certification claims, but caught eight loose links that only coincidentally contained a keyword without being real evidence (among them a review-site name misread as "trust", and two vendors where every field pointed to the same generic terms-of-service page); those were removed before the data was merged.

Added

  • 410 vendors with compliance evidence in total (351 European, 59 non-European): 163 DPAs, 50 subprocessor lists, 348 security pages, 128 EU-hosting pages and 30 vendors with certifications.

Compliance evidence extended to 344 vendors (round 4)

Researched the next 200 most-recommended vendors again, same method as the previous three rounds. Both certification claims in this round turned out, on manual review, to be a direct, first-person claim by the vendor itself (CELUM and elastic.io, both ISO/IEC 27001) and were kept.

Added

  • 344 vendors with compliance evidence in total (289 European, 55 non-European): 137 DPAs, 44 subprocessor lists, 296 security pages, 110 EU-hosting pages and 30 vendors with certifications.

Compliance evidence extended to 270 vendors (round 3)

Researched the next 200 most-recommended vendors, same method and rigor as the previous two rounds: every link was fetched and checked for content. Two certification claims were rejected after manual review: CrateDB's claim pointed to a different vendor's (Keboola) security page, and Kontainer's page only mentioned controls "based on" ISO 27001 and SOC 2, not its own certificate.

Added

  • 270 vendors with compliance evidence in total (217 European, 53 non-European): 107 DPAs, 41 subprocessor lists, 237 security pages, 94 EU-hosting pages and 28 vendors with certifications.

Correction: TYPO3's headquarters is the TYPO3 Association in Switzerland, not the German commercial arm

An attentive reader pointed out that TYPO3 GmbH (Düsseldorf, Germany) is the commercial arm, while ownership and governance of TYPO3 CMS — including the trademark — sits with the TYPO3 Association, registered in Baar (ZG), Switzerland. The country has been corrected to Switzerland and the classification to EFTA.

Fixed

  • TYPO3: headquarters DE → CH, classification eu-strict → efta, with sources (the Association's by-laws, the TYPO3 brand page, the company structure page, TYPO3 GmbH's legal notice).

Compliance evidence extended to 197 vendors (round 2: the most recommended)

Following the first round (the largest cloud, SaaS and security vendors), compliance evidence has been extended to the 96 next vendors most often shown as European alternatives. Same method: every link was fetched and checked for content, and every certification claim was read in page context before inclusion — two claims were rejected here because they referred to a hosting partner's certification (AWS) or to contract text that only "commits to comply with" rather than showing the vendor's own certificate.

Added

  • 197 vendors with compliance evidence in total (146 European, 51 non-European): 78 DPAs, 32 subprocessor lists, 173 security pages, 68 EU-hosting pages and 22 vendors with certifications.

Compliance evidence per vendor: DPA, subprocessors, security page, EU hosting and certifications

Vendor pages now show a Compliance evidence block linking to the vendor's own public documents: the data processing agreement (DPA), the subprocessor list, the security page or trust center, the page describing EU hosting and the page listing certifications such as ISO/IEC 27001, SOC 2, SecNumCloud or HDS. We only record what we actually found on the vendor's site; every link was fetched and checked for content on the check date. A missing link means not found publicly, not not compliant.

Added

  • First round: 101 vendors (55 European, 46 non-European), including the major cloud, SaaS and security vendors and their European counterparts. Found: 57 DPAs, 27 subprocessor lists, 86 security pages, 46 EU-hosting pages and 22 vendors with certifications.
  • The statistics page shows the coverage of compliance evidence (with DPA link, with subprocessor list, with certifications), also in the citable Dataset metadata.

Changed

  • Certifications are listed only when the vendor claims them on the linked page itself; a third party's certified data centre or "ISO 27001 compliant" wording does not count as a certification.

40 vendors from an enterprise application landscape added, each with sources and a check date

An application landscape of a large organisation was compared with the knowledge base: of 81 tools named, 17 were already listed, 40 are now added and 24 were deliberately left out (internal or unverifiable names, network functions, or telecom BSS without a fitting category). Every new record carries its check date and the public sources that substantiate jurisdiction, ownership, data location and the GDPR data-processing agreement, so the page can feed a DORA or NIS2 third-party file.

Added

  • European: Nokia Altiplano (FI), Atoll by Forsk (FR), DataMiner by Skyline (BE), Kibana by Elastic (NL), Nexthink (CH), InSocial (NL), Youforce by Visma Raet (NL, owned by Visma NO), FIQAS Abillity (NL), iProtect by TKH Security (NL) and Axxerion/Spacewell Workplace (BE, owned by Nemetschek DE).
  • Non-European, with European alternatives: Microsoft Active Directory, Azure Virtual Desktop, Cisco Webex, Amazon CloudFront, Google Firebase, Salesforce Commerce Cloud, Kubernetes, OpenStack, Apache Tomcat, HAProxy, NETSCOUT, Cacti, RANCID, Wireshark, SecureCRT, RUCKUS One, Exabeam, Layer7 API Gateway (Broadcom), IBM Security Verify Access, K2view, Coalesce, BlueConic, Khoros, Akana (Perforce), Amdocs CRM, ActixOne (Amdocs), Rhino (Metaswitch/Alianza), Conviva, Avaya Communication Manager and SAM Seamless Network.

Changed

  • Miro, Mural, Figma, Lucid, Whimsical, ClickUp, monday.com and Trello (added on 19 September) now show their sources too.
  • Airtable: the Bending Spoons acquisition closed on 4 September 2026; the 'closing not yet confirmed' note is replaced by the final ownership statement, sourced to the press release and SEC filing.
  • Nexthink was added as a European alternative to Ivanti, Jamf Pro, Microsoft Configuration Manager, Microsoft Intune and Omnissa Workspace ONE.

Faster pages, less repetition on vendor pages and product data in the shop

Every page is now built ahead of time and served directly instead of rendered per visit. Vendor pages repeat less boilerplate and link to their category page. The English homepage carries the tool's English name. The shop, the statistics page and the changelog have cleaner structured data; llms.txt is linked from the footer.

Category pages: why the category matters, related categories and check date

Every category page now explains in two sentences what data flows through it and what to check in a vendor, shows the date of the last check and points to related categories. Non-European vendors state their number of EU alternatives. Shorter page titles and a page-specific preview when shared on social media.

Category overview: how we count, and better discoverability

The overview of all categories now explains how we count and what "European" means, with the date of the last check and links to the methodology and the statistics. Each category now names its total. Sharing a page on LinkedIn or Mastodon shows the right title and link; the sitemap reports the real verification date per page.

Software by category and by country, and knowledge base statistics

New overview pages: per category every European vendor with country, owner and open-source status, plus the non-European vendors with their alternatives; per country every vendor by category with a note on the legal position. The statistics page shows the current knowledge base figures, including verification coverage, with a citation line.

Check date and sources per vendor; independence statement

Every vendor page now shows when the record was last checked and, for records since September 2026, the public sources used. The About page and the footer state explicitly what keeps us independent: no money from vendors, no sponsored listings, no paid labels and no affiliate links.