11 new vendors in API Management (incl. Ory Oathkeeper, Zuplo, Hoppscotch), 14 in BPM & Workflow (incl. Temporal, Apache Airflow, Prefect) and 3 new browsers (Ecosia, DuckDuckGo Browser). The knowledge base now stands at 2,531 vendors.
12 new vendors in AI Coding (including Aider, Cline, Tabby and Goose) and 2 in AI (llama.cpp, LiteLLM). Qodo was incorrectly listed as 'EU' in the supplied list — independently checked: Tel Aviv, Israel.
Moved Map and About to the footer (already listed there), renamed Reports to Pricing, and added a dedicated Donate button. On the support page, the donation amounts now sit right under the intro instead of below three paragraphs of explanation.
A customer pointed out that Screenbird's hosting location was wrongly scored as 'mixed'. While checking this, we found the scoring engine itself didn't recognise a specific EU country's own code (like 'DE') as EU hosting — fixed for every vendor, with no data changes needed. Also corrected Mindbreeze and Explain Everything based on their own privacy policies.
Added 20 more verified vendors, including Kaleyra (Italian HQ, but owned by India's Tata Communications — a good example of why we track HQ and parent company separately) and FDN DNS (a French nonprofit DNS resolver).
Filled out the 10 categories with the fewest vendors (from enterprise search to testing/QA) with 87 verified, real vendors — including Elasticsearch, Datafari, ConfigCat, AB Tasty, Kameleoon, DataDome and TestRail as EU alternatives.
After checking a list of 30 AI-agent/cowork tools: 16 genuine gaps filled (including Connic and 2501.ai as EU alternatives), and three doubtful names (Stenwrite, OpenAI Operator, MultiOn) deliberately left out after independent verification.
Round 14: 24 corrections, including InterSystems and Infobip (headquarters turned out to be elsewhere than recorded) and Informatica (now owned by Salesforce after an $8B acquisition).
A dedicated page explaining why the tool stays free, why we depend on donations, and what your contribution actually funds.
Major addition after comparing the catalogue against three external lists of well-known enterprise software, customer data platforms and AI-security tools: 82 missing vendors added, including Oracle CX Cloud, SugarCRM, HashiCorp Vault and a range of customer data platforms and AI red-teaming tools.
Round 13: 31 corrections, including Hexagon Geospatial (now part of the newly independent Octave after a spin-off) and the familiar US-country/wrong-region-code inconsistency found five more times.
Round 12: 18 corrections, including Ghost (headquarters turned out to be Singapore, not the UK) and four community open-source projects wrongly marked "vendor-hosted".
Round 11: 18 corrections, including eleven community open-source projects wrongly marked "vendor-hosted", and Garden.io (headquarters turned out to be Germany, with an Israeli parent company since its 2024 acquisition).
Round 10: 15 corrections, including Erxes (headquarters turned out to be California, not Mongolia), Evernote and Etherpad (both had their controlling entity's country confused with their own headquarters), and three community open-source projects.
Round 9: 11 corrections, including the same internal inconsistency found five more times (a US country paired with the wrong region code) and four community open-source projects wrongly marked "vendor-hosted".
Round 8: 16 corrections. Biggest catch: Debian's legal entity is US-based, not German, and the "Dutch" Deel listing turned out to be a local office — the real headquarters is San Francisco. Also seven community open-source projects wrongly marked "vendor-hosted".
Two Dutch vendors added after a community submission: Screenbird (digital signage) and Voronai (customer data platform). Both independently verified, not taken on the vendor's word alone.
Round 7: 18 corrections. Biggest catch: CyberArk is headquartered in Israel, not the US (acquired by Palo Alto Networks in February). Also CrateDB (US, not Austria) and five community open-source projects wrongly marked "vendor-hosted".
The categories page listed categories sorted by EU-vendor count. Now sorted alphabetically instead, by the name as shown on screen.
Round 6: 9 corrections, including an incorrect UK parent on three Combell listings and on Complianz (team.blue, actually Belgian) and Concourse CI (correctly a distributed open-source project, not a company with a headquarters).
The badge now appears everywhere you browse vendors: the alternatives dashboard (rows, expanded alternatives, search results) and the map's vendor pop-up too.
The badge already appeared on vendor pages and in the report; now it shows next to every vendor on category and country pages too, so you can scan a whole list at a glance.
Right under every vendor's name there is now one clear mark: EU sovereign, self-host/open source, EU-hosted with a non-EU parent, or non-EU. The same badge now also appears in the paid report's vendor table.
Round 5: 11 corrections, including CiviCRM and Checkly (both actually US, not Belgium/Germany), Checkmk (no US parent at all — it's stayed German-owned throughout its history), and two open-source projects (Ceph, CapRover) wrongly marked "vendor-hosted".
Round 4: 13 corrections, including Blomp (US, not UK), two "self-host" listings (BookStack, Cachet) that used a generic EU placeholder despite a real registered company behind them, and three open-source projects (Blocky, BRouter, BookWyrm) wrongly marked "vendor-hosted" instead of distributed open source.
Round 3: the next 60 vendors checked. 5 corrections, including two missing parent companies (Auth0/Okta, Aware Health/Aeon) and two internal inconsistencies (a US headquarters paired with the wrong region code). A not-yet-completed acquisition (Bahnhof/Telenor) was deliberately left unrecorded.
Round 2 of the ongoing re-verification pass: the next 59 vendors (alphabetically) checked against independent sources. 7 corrections, including Anytype (Berlin, not Switzerland), AppFlowy (Singapore, not the US), and Alpine Linux (reclassified as an open-source project with no fixed headquarters). A premature merger (Aleph Alpha/Cohere) was removed from the data since it hasn't closed yet.
We've started an ongoing re-verification pass across the whole catalogue: 93% of vendors had a check date but no actual source behind it. Round 1 checked the first 60 (alphabetically) against independent sources and found 8 corrections (e.g. 4me turns out to be US-based, not Dutch) plus one duplicate (About You Cloud/Commerce = SCAYLE), now merged.
Every vendor page and report now shows whether the European Commission has found the headquarters country's data protection adequate — a real, citable EU legal fact. The US deliberately does not get a simple yes/no: the EU-US Data Privacy Framework only covers individually certified companies, so that status is marked separately as "conditional".
The previous update noted that Customer Data Platform, FinOps and Product Feedback had zero European vendors. Targeted European research found nine after all: Upvoty, Featurebase, Sleekplan and ProductLift (product feedback), Holori and Cycloid (FinOps), and Mediarithmics, Zeotap and Commanders Act (Customer Data Platform).