How to check if a software product is truly European

It’s actually quite simple to check if a software product is truly European:

1. Headquarters are in Europe
2. If they’re held by a parent company, the parent is also in Europe
3. Subprocessors are in Europe

With some EU products, all three can be checked because everything is European, such as LeaderGPU or DentroChat.

However, with most it’s a mixture.

Most important: headquarters and parent company

The most important check is the location of the headquarters and the parent company headquarters.

If it’s the US, the company falls under the US Cloud Act. This allows US agencies to demand data of this company, even if the data is located in Europe. Hosted in Europe is not the same as EU sovereign.

Also, it can happen at any moment that some president decides to cut Europe off from their IT infrastructure…

That means: to be sovereign, the most important step is using products with HQs in Europe. It’s not a European product if it’s owned by Microsoft (e.g. LinkedIn), Salesforce (e.g. Slack), or Google (e.g. YouTube), even when they have subsidiaries in Europe.

Second most important: the subprocessors

If almost all of the company runs on Google Cloud (as is the case with Mollie), US agencies can still access the data under the US Cloud Act. And the US can cut Europe off at any moment.

That said, a provider could still move to a cloud that is actually (mostly) European, for example Scaleway or Clever Cloud. Mollie seems to be doing exactly that right now, migrating to a self-hosted stack.

If the main services of the product run on EU sovereign subprocessors, and only auxiliary services run on US services, that’s the best it can get for most services nowadays.

Examples are Scaleway, Clever Cloud, BunnyCDN, or Lettermint. The main data and the core product are on EU-owned machines, but auxiliary tools like payment, CRM, etc. can be US-American.

How to figure all this out for new services

1. The headquarters of the firm can typically be found in the terms and conditions or privacy policy, which can mostly be found in the footer of a product. Our Privacy Policy Analyzer helps with that.
2. The subprocessor list is sometimes also linked in the footer and can be inspected.
3. For finding out about the parent company or a subprocessor if they aren’t easy to find, a good approach is to use an AI agent to figure it out. We use DentroChat every day to find information quickly regarding new services.
4. If you and your AI agent both can’t find the subprocessor list, send the company behind the product an email asking for the subprocessors. This is typically the last resort, but brings the most up-to-date and clear information. That’s how we found out that the payment provider PayNL is using Google Cloud for their backups.
5. Sometimes you have to dig deep, because their subprocessor page might be outdated. E.g. GreenPT: they’re using the US subprocessor RevenueCat for their mobile apps, but they don’t mention it in any of their legal docs. We had to download the app APK and look through the code to find it.

You see, normally it’s not that difficult to find out whether a service is truly European.

Next time the marketing material of a product screams “European” you know where to look to verify it!