How this test is made.
The standard
Statements about a company on this site are that company’s own wording, copied from a page anyone can open, carrying the date it was read. Statements about American law name the exact section, say whether it is still in force, and carry the date it was last checked. Nothing appears here on the strength of common knowledge.
The test states what can lawfully be compelled, and by whom. It does not state what any company has done with anyone’s data. That is not knowable from outside the process, and no page here claims otherwise.
Where each finding comes from
During research for this test, a page-summarising tool produced a quotation and attributed it to a US Congress research paper. The sentence reads perfectly and appears nowhere in the document. It was caught by extracting the real text and searching it word for word. Every quotation on this site is now checked that way automatically, against the page it was taken from.
Each finding therefore records whether the document was opened and read for this test or taken from another account of it. 25 of the 29 findings in the section on what can be done with your data rest on documents read directly. The remainder say so on their own line and are not presented as quotations.
The domain check, and what its answers rest on
The domain check names companies from a table of 209 of them, and those names rest on different evidence from the rest of this test. “This host is operated by that company” is not something a company says about itself; it is what the domain name system answers. Each entry records the delegation that was asked for and what came back, with the date, and the same query can be run by anyone.
Where an entry says something about the company rather than about the name — who owns it, who bought it — it cites a page, or it does not make the claim. One of those was wrong: a mail filter was described as bought by an American private equity firm, which it was not, and that sentence was the stated reason for a finding about a named company.
What is not established
The test records 63 points at which it could not establish an answer, each published where the question arises rather than collected out of the way. Several are questions asked constantly about this subject.
Related work
Several projects address the same question. They are listed here with what this test adds rather than repeats.
- european-alternatives.cloud catalogues European alternatives to American services and records, per service, why one might be a concern — including reasoning about US law. It is open source and actively maintained, and it covers far more services than this does.
- The European Open Source AI Index (Radboud University) scores models on how open they actually are, which is the harder half of the self-hosting question this test asks.
Others are building assessments of the same question. Upper Harbour in Canada indexes several hundred tools by parent jurisdiction; Sovereign Cloud Compass in Hamburg scores cloud providers against the European Commission’s sovereignty criteria; EU Vetted checks products against their published agreements and ownership records. The European Commission itself has published a Cloud Sovereignty Framework whose legal-exposure criterion names the CLOUD Act directly — and weights it at a tenth of the total score, on the reasoning that procurement covers the rest.
What this test adds is the supplier chain. Not who sells you the tool and where they are registered, but which companies that vendor names as running the machinery underneath, and where each of those is incorporated. That is where a European vendor stops being a European answer, and it is a per-vendor reading rather than a rule that can be applied from a list.
These projects are used here to locate documents, never as the grounds for a claim — which is also how this test asks to be used.
Scope and limits
- Most tools. If your tool is not on the first screen, that is not a clean bill of health — it means it has not been looked at.
- Special “we keep it in Europe” deals. Some suppliers sell an arrangement meant to keep everything inside Europe. Whether one actually does depends on the contract and how it is wired up. None has been examined for this test.
- Most countries. Every country has intelligence services. This test reads American law in detail, because that is the set most European companies are quietly relying on without having read a word of it, and it names Chinese law where a Chinese company is in the path. Everywhere else is out of scope.
- Your own legal position. This is not legal advice. The test has not seen your contracts and does not say what to do about any of this.
Trademarks
Each tool is shown with its own mark so a reader can find the ones they use. The marks are the trademarks of their owners, used only to identify the products named; nothing here is endorsed by or connected to any of them. Each mark is drawn into the page itself rather than loaded from that company, because requesting a Microsoft logo from Microsoft would tell Microsoft who was reading about Microsoft — the behaviour this test exists to describe. 14 tools have no published mark and are shown as text rather than as an invented one.
Checking the claims
Each claim is published as a single line carrying its source and its date. Corrections go through the contact form in the footer.