EU Sovereignty Score

Updates from October 5, 2026 to October 9, 2026

To the most recent updates

Over 800 vendor records corrected

While writing the introductions we re-checked every vendor on the web. That surfaced over 800 outdated or incorrect records: headquarters, owners, licences, new product names and where data is stored.

Changed

  • 32 products have a new name, for example Yousign (Youtrust), LambdaTest (TestMu AI), Platform.sh (Upsun) and LANCOM (Rohde & Schwarz). Hellonext is now FeatureOS; the old page redirects.

Fixed

  • Headquarters corrected for 65 vendors, including Pipedrive, Tricentis, Ory and Netdata (United States), Wire and Neos (Germany) and SonarQube (Switzerland). Vendors no longer based in Europe are no longer listed as European alternatives.
  • Owner updated for 95 vendors after acquisitions, such as EQS (Thoma Bravo), Unit4 (TA Associates) and GoCardless (Mollie).
  • Licence corrected: HashiCorp Vault, Redpanda and SurrealDB, among others, are no longer open source; Cypress, Chatwoot and Meilisearch are.
  • Hosting locations updated for over 400 services to what the vendor itself documents.

New: the Cyber Resilience Act explained

A new page explains what the EU Cyber Resilience Act means when you buy software: the timeline, what vendors must do and what you can ask for from December 2027.

Added

  • Cyber Resilience Act page in four languages, with a timeline, a buyer checklist, an open-source section and FAQs. All facts come from the Regulation, the European Commission and ENISA.

Catalogue clean-up: 64 vendors removed, 16 updated

Vendors that no longer exist or were absorbed into another product have been removed; their old pages now redirect to the successor or to the category. Sixteen products with a new name or website have been updated.

Changed

  • New name or website applied for, among others, Vantor (Maxar), RIB BI+ (datapine), Actian (Zeenea), Wuunder (Paazl), Lucen Track (Timeneye), Kolo (Serverius), MindsHub (MindsDB), Spotler ActivatePro (CrossEngage), Uniphore (ActionIQ), Legly, Macrium, FLO and Fujifilm DocuWorks.

Removed

  • 13 vendors absorbed into a product already in the catalogue, such as Efecte (now Matrix42), Newsletter2Go (now Brevo), Census (now Fivetran) and Timeular (now TimeTac). Their old page redirects to the successor.
  • 51 other vendors removed from the catalogue. Their old page redirects to the category, so you see alternatives straight away.

Two discontinued identity services removed

yes.com and Verimi are no longer in the catalogue: both services have been or are being discontinued.

Removed

  • yes.com (bank-based identity): the service no longer exists and the domain no longer belongs to the provider.
  • Verimi: the shareholders decided to wind up the company; its services end at the end of 2026.

AI meeting note-takers added, with European alternatives

Fathom, Granola and Google AI Edge Foresight are now in the catalogue. As European alternatives to Fathom and Granola we list Sally, Noota, Leexi, Jamie and tl;dv.

Added

  • New vendors: Fathom, Granola and Google AI Edge Foresight (processes meetings entirely on your own Mac).
  • European AI note-takers: Sally (Germany, hosted in Germany), Leexi (Belgium), Jamie (Germany) and tl;dv (Germany).

More corrections: Xero, Typeform, Zoho and EU hosting for 40+ services

The next round of introductions surfaced more outdated data. Xero is from New Zealand, Typeform from Spain and Zoho from India; over 40 services also offer storage in the EU.

Changed

  • EU hosting option added, with sources, for over 40 services, including Workday, Asana, Airtable, Auth0, Sentry, New Relic, Intercom, SendGrid, Mailgun, Twilio SMS and Postman.

Fixed

  • Headquarters corrected: Xero (New Zealand), Typeform (Spain, EU) and Zoho Workplace (India).
  • Hosting corrected to what the vendor documents, including Camtasia (US only), Mindbody (US and UK) and Evernote (stored in the US).

Vendor data corrections: headquarters and hosting regions

While writing the introductions we re-checked the data. 91 US vendors were wrongly recorded as 'other' and now count as US; 16 services now show their EU hosting option.

Changed

  • EU hosting option added, with sources: Google Gemini, Google Drive, Mixpanel, Segment, GitHub, Canva, WordPress.com, OneTrust, Articulate 360, Docebo, CrashPlan, Brandfolder, AWS API Gateway, Apigee, Power Automate and Salesforce Flow.

Fixed

  • Headquarters region 'other' → US for 91 vendors headquartered in the US; their jurisdiction score is now higher.
  • Wix: headquartered in Israel (was US); hosting in the US and Ireland.
  • Claude Code and Claude Cowork: EU hosting removed; Anthropic documents only global or US processing.

Extended introductions on category and vendor pages

Every category page now has a 150-220-word introduction; vendor pages are getting a 120-180-word introduction step by step, each checked against sources. While writing, we found that Slack, Zoom, Dropbox, OpenAI and Notion also offer data storage in the EU; their profiles now reflect that.

Added

  • Introductions for all 96 categories and the first 20 vendors, in Dutch, English, German and French.

Changed

  • Slack, Zoom, Dropbox, OpenAI and Notion: EU added as a hosting region (option on business plans), with sources.

BirdyChat is now Balsio

The Latvian work chat app BirdyChat has been renamed Balsio. The listing has been updated and re-verified; the old page redirects automatically.

Changed

  • Balsio (formerly BirdyChat): new name, website and description, including the new team workspaces. Re-verified via its own website, independent coverage and the Latvian company register.

Category pages easier to find, and one click from every vendor to the whole category

Category pages now name the best-known non-European services they offer alternatives to (for example "Messaging: European alternatives to WhatsApp, Telegram and Messenger"). Every vendor page now links straight to all European vendors in its category, right below the alternatives.

Added

  • On vendor pages, a block below the alternatives linking to all European vendors in the same category, plus a "see all" link next to "Also in this category".
  • Category page FAQs are now also published as structured data (FAQPage) for search engines.

Changed

  • Category page titles, headings and descriptions name the best-known non-European services in that category, in all four languages.
  • Vendor page breadcrumb: Home → Categories → category → vendor.
  • The ad slot on category pages now sits below the introduction instead of above the heading.

Vendeglatas.hu added, register verification for Verde Holding Kft.

A vendor self-submission, a Hungarian hospitality/booking platform, independently verified and added. The parent company, Verde Holding Kft., already has 5 other products in the catalogue — their listing is now also confirmed via the official Hungarian company register (OCCSZ), not just the company's own website.

Added

  • Vendeglatas.hu added to the Scheduling & Booking category: a Hungarian operating system for hospitality and accommodation (bookings, POS, inventory, staff, NTAK reporting), from Verde Holding Kft.

Changed

  • The 5 existing Verde Holding Kft. listings (időpontok, Bizonylat, Felhő, Overit, Podpisat) now also cite a source from the official Hungarian company register, alongside the vendor's own website.

7 database vendors added

A candidate list of European managed-database and DBaaS providers (35 names) independently verified: 7 new vendors (MySQL, Firebird SQL, SQLite, TiDB, Dragonfly, ScyllaDB, RethinkDB), the rest already catalogued or not genuine EU alternatives.

Added

  • 7 vendors added to the database category: MySQL, Firebird SQL and SQLite (self-hostable), TiDB, Dragonfly and ScyllaDB (vendor-hosted, with a commercial cloud offering), and RethinkDB (community-governed, still active despite its reputation as discontinued).
  • 28 of 35 candidates rejected: several European DBaaS providers and open-source engines were already catalogued under a different category (e.g. OVHcloud, Scaleway, STACKIT, Qdrant, CockroachDB), and a few candidates were just sub-products of already-catalogued vendors (Amazon Aurora/RDS, Google Cloud SQL, Azure SQL Database).

4 vendors added, TigerData record corrected

A data-platform/analytics candidate list (35 names) independently verified: 4 new vendors, and an incorrect existing record (TigerData/TimescaleDB) corrected — it was wrongly recorded as Swedish/EU with no cited source, when the company is actually headquartered in New York, US.

Added

  • 4 vendors added: Databend and Apache Iceberg (data-platform), Milvus (database), Incus (virtualization — community-governed fork of LXD).
  • 30 of 35 candidates rejected: 24 were already known (often the same existing cloud-iaas/storage vendor with an "Analytics" suffix), "Ververica Streaming Platform" turned out to still be Alibaba-owned despite its EU framing, Greenplum has been closed-source since 2024, and "Chimp Analytic Engine"/"Velocity Stream" were fabricated products with no findable source.

Fixed

  • TigerData (TimescaleDB) carried no source citation at all and was recorded as Swedish/EU; independent research confirms a New York, US headquarters and a partially non-open license (the core engine is Apache-2.0, but the widely-used Community edition is under the non-OSI Timescale License). Headquarters country, open-source status and sovereignty mode corrected.

13 vendors added to customer-data-platform

A second submitted CDP candidate list (35 names) independently verified: 13 new vendors, including two country corrections that moved a vendor from "non-EU" to "EU".

Added

  • 13 vendors added to customer-data-platform: ContactPigeon (Greece), NGDATA Lily (Belgium — the candidate list wrongly claimed a US headquarters), Tracardi (Poland), Tealium Customer Data Hub, Treasure Data CDP, Optimove (Israel, not the US as claimed), Blueshift SmartHub CDP, Redpoint Global (rgOne), Klaviyo CDP, Simon Data, Zeta Global Marketing Platform, Lemnisk (India, not the US) and Evam Streaming CDP (Turkey, not the UK).
  • 22 of 35 candidates rejected: 6 EU candidates (BlueConic, Bloomreach/Exponea, Clerk.io, Mapp/Webtrekk, Splio, Actito) were already catalogued, just under the marketing or e-commerce category instead of customer-data-platform; 3 candidates turned out not to have an EU headquarters despite the claim (Teavaro = UK, Meiro = Singapore, Insider = Turkey); "Twosense / Acxiom Real-Time CDP" was a fabricated pairing of two unrelated companies; Lytics is no longer available as a standalone product following its acquisition.

6 DNS privacy resolvers added

A sixth submitted candidate list (DNS privacy resolvers) independently verified: 6 new vendors, 19 rejected — often because a small individually-run service had since shut down or never existed.

Added

  • 6 vendors added to dns-privacy: UncensoredDNS/Censurfridns (Denmark, active since 2009), Freifunk München DNS, Dismail.de Secure DNS, dnsmasq, Stubby and SmartDNS.
  • 19 of 25 candidates rejected: 5 were already catalogued (Knot Resolver, PowerDNS, CoreDNS, BIND9, NSD, some filed under cdn-dns), several small individually-run European DNS services turned out to have shut down (Swiss Privacy Foundation DNS since 2015, Snopyta) or never existed ("Grote Netwerken / Captn DNS", "Tungsol DNS", "Amaze DNS" — each sourced with only a bare github.com link), and "Nebula DNS Connectors" turned out to be Slack's mesh-VPN tool Nebula, unrelated to DNS.

13 vendors added across data integration and ETL

A fifth submitted candidate list (data integration/ETL) independently verified: 13 new vendors, 32 rejected — most because they were already catalogued, sometimes under a different category.

Added

  • 13 vendors added spread across data-integration (TimeXtender, Logstash, Apache Camel, Redpanda, Dagster, Vector, AWS Glue, Azure Data Factory, Google Cloud Dataflow), data-platform (Apache Spark, Apache Beam), data-governance (BiG EVAL) and customer-data-platform (Multiwoven).
  • 32 of 45 candidates rejected: over 20 were already catalogued (often under a different category than claimed — Boomi and MuleSoft, for instance, sit under api-management, not data-integration), a few were fabricated or mislabelled products ("Halaxy / DataVirtuality", Squidex described as an ETL tool when it's actually a CMS), and two EU vendors (Stambia/Semarchy, Denodo) turned out to have since moved their headquarters to the US — the same ADR-001 rule already applied to Optimizely and Dashlane.

16 vendors added across cloud infrastructure

A fourth submitted candidate list (cloud IaaS) independently verified: 16 new vendors spread across cloud-iaas, virtualization and network-infrastructure, 24 rejected as already catalogued or nonexistent.

Added

  • 6 European IaaS/VPS vendors added to cloud-iaas: Bleu (Orange/Capgemini sovereign cloud), Delska, Infomaniak Public Cloud, Nine Internet Solutions, VNET Cloud, Prometeus.
  • 5 open-source virtualization tools added to virtualization: oVirt, KubeVirt, Virt-Manager, MicroCloud (Canonical), plus Open vSwitch added to network-infrastructure.
  • 5 US benchmarks added: AWS European Sovereign Cloud and Oracle EU Sovereign Cloud (separate, EU-incorporated legal entities with a US ultimate parent), Vultr, Akamai Connected Cloud (formerly Linode), CoreWeave.
  • 24 of the 40 candidates rejected: already catalogued under a different name or category (incl. Apache CloudStack, Proxmox VE, Ceph, LINSTOR, Gcore, Scalingo, Greenhost), nonexistent or linked to the wrong URL (e.g. "Netcetera Cloud", "Hydro66" pointing to an unrelated company), or a vendor with a falsely claimed EU headquarters while its real parent company sits in Russia (Serverspace/ITGLOBAL.COM).

Fixed a scoring bug for self-hosted software; removed 2 WordPress-only plugins

Self-hostable and community-distributed open-source vendors were incorrectly scored as the worst possible case on data residency. Koko Analytics and Statify (WordPress plugins) have been removed from analytics: they aren't a standalone service.

Removed

  • Removed Koko Analytics and Statify from analytics: they are WordPress-only plugins that only work inside a WordPress site, not a standalone analytics service — and that category is meant to be platform-agnostic.

Fixed

  • The data-residency score (DRS) ignored self-hostable or community-distributed open-source software: without an explicit EU country code among the hosting regions (e.g. a vendor whose only region was "self-host" or "GitHub"), such a vendor scored the worst possible 100 ("no EU hosting") — when self-hosting is precisely what lets you choose where the data lives. Around 59 catalogue vendors were incorrectly shown red because of this. The scoring engine now always treats `sovereignty_mode: self-host`/`oss-distributed` as a data-residency score of 0.

51 vendors added to analytics and AI security

5 web-verified community submissions (Verde Holding Kft., Hungary) and 46 new vendors in the analytics and ai-security categories, after independently verifying two submitted candidate lists.

Added

  • 5 vendors from Verde Holding Kft. (Hungary/Slovakia) added after verification via their own privacy-policy pages: Felhő, Overit, Bizonylat, időpontok and Podpisat.
  • 22 vendors added to ai-security (including Mindgard, LLM Guard, Presidio, Arize AI, Cisco AI Defense) after independently web-verifying a submitted candidate list — over half the original list was dropped as already catalogued, nonexistent, or miscategorised.
  • 24 vendors added to analytics (including GoatCounter, Koko Analytics, Contentsquare, Smartlook, Snowplow) via the same independent verification, including corrections to incorrectly claimed headquarters countries.

27 vendors added — knowledge base reaches 3,500

New EU vendors Storyteq, AtroDAM, Razuna, Phrasea, Comosoft LAGO, Sharedien, Picturepark, Sliplane, Platform.sh, anynines, lowcloud, DanubeData, Encore and Raynet One, plus international benchmarks. With this, the knowledge base reaches its 3,500-vendor target.

Added

  • 27 vendors added across digital-asset-management, cloud-paas and endpoint-management — the knowledge base now stands at 3,500 vendors.

13 vendors added across 2 categories

New EU vendors LingoHub, Gridly, Prompsit, Tilde, SimpleLocalize, Gingout, Pangea Global, eTranslation and PassSecurium, plus international benchmarks.

Added

  • 13 vendors added across translation and password-manager — the knowledge base now stands at 3,473 vendors.

18 vendors added across 2 categories

New EU vendors CERRIX, Swiss GRC, Enactia, Matproof, Copla, Actecil, Recruitis, Adeptiq, CVWarehouse, HROffice, Altamira Recruiting and HireHive, plus international benchmarks.

Added

  • 18 vendors added across compliance-grc and recruitment-ats — the knowledge base now stands at 3,460 vendors.

72 vendors added across 6 categories

New EU vendors Pixelmator Pro, Cinema 4D, TVPaint, eYou, W Social, BeReal, CounterMail, CTemplar, Caliopen, Ligo, fynk, Contractify, Bigle Legal, Bind Legal, Bird, Spryng, LOX24 and PAFnow, plus dozens of international benchmarks.

Added

  • 72 vendors added across design, social-media, email-personal, time-tracking, legal-tech and sms-api, plus a process-mining-rpa supplement — the knowledge base now stands at 3,442 vendors.

53 vendors added across 6 categories

New EU vendors A-Trust, TrustPro, Agrello, Oneflow, Subnoto, Paperless.io, SIGN8, inSign, Infomaniak kChat, Realtime Register, Webland, easyname, Northmill Bank, Rocker, Solaris, Saldo Bank, Wallester, Tinaba, Zen.com, VeloBank, ActivoBank and Tinybird, plus dozens of international benchmarks.

Added

  • 53 vendors added across testing-qa, esign, messaging, domain-registrar, fintech-banking and data-platform — the knowledge base now stands at 3,370 vendors.

65 vendors added across 6 categories

New EU vendors GBTEC, Tailent, Tebis, GRAITEC, HiCAD, Shapr3D, VariCAD, HIGHRESAUDIO, STAGE+, Klassik Radio Plus, HERE Technologies, Sinergise, Airbus Defence & Space, Mercateo, VORTAL, AddVue, Keelvar, Sana Learn, Scheer IMC, time4you, SoftDeCC, Sanoma Learning and Gility, plus dozens of international benchmarks.

Added

  • 65 vendors added across process-mining-rpa, cad-engineering, music-streaming, gis-geospatial, procurement and education-lms — the knowledge base now stands at 3,317 vendors.

46 vendors added across 6 categories

New EU vendors Telebugs, UXCam, dunDNS, Alpega Group, AEB SE, PSI Logistics, PULPO WMS, Ehrhardt Partner Group, Logistics Reply, Davanti, Talkspirit, Jamespot, eXo Platform, Framasoft, Easiware, eDesk and IncludeOS, plus dozens of international benchmarks.

Added

  • 46 vendors added across error-tracking, dns-privacy, supply-chain-operations, office-productivity, helpdesk-support and virtualization — the knowledge base now stands at 3,252 vendors.

52 vendors added across 6 categories

New EU vendors Cerascreen, F-Secure VPN, Avira Phantom VPN, PrivateVPN, Goose VPN, Everteam, Pydio Cells, DocLogix, Fabasoft, Woosmap and ViaMichelin, plus dozens of international benchmarks.

Added

  • 52 vendors added across health-personal, data-integration, vpn, ai-cowork, document-management and maps — the knowledge base now stands at 3,206 vendors.

44 vendors added across 5 categories

New EU vendors Livesignage, Cloudchipr, Meshcloud, Kontakt.io, Actility ThingPark and Royal TS, plus dozens of international benchmarks.

Added

  • 44 vendors added across digital-signage, finops, iot-embedded, remote-desktop and writing-tools — the knowledge base now stands at 3,154 vendors.

43 vendors added, knowledge base passes 3,100

New EU vendors Sender, Cludo, Seznam, Calendesk and Feature Upvote, plus dozens of international benchmarks.

Added

  • 43 vendors added across transactional-email, enterprise-search, search-engine, scheduling-booking, telephony-voip and product-feedback — the knowledge base now stands at 3,110 vendors.

45 vendors added across 6 categories

New EU vendors Piano, DNS.SB, LibreDNS, Ziteboard, Dastra and XTM Cloud, plus dozens of international benchmarks.

Added

  • 45 vendors added across tag-management, dns-privacy, whiteboarding, compliance-grc, endpoint-management and translation — the knowledge base now stands at 3,067 vendors.