I wanted to pack up this analysis more than a year ago, but I did not have the time to compile and crystallize it. 2025 was crazy! Oh, and if I want to prove a point, I usually try to practice what I preach. Long story short, in early March 2025, I decided to run a test with an optimized EU and open-source-based stack, as free as possible of US commercial products. This sparked a cascade of thoughts and optimizations, ultimately leading to a product for a couple of clients with the potential to be productized, or at least to educate the EU audience of the possibilities we have locally.
The article is a long read and includes AI-assisted research for some sections to provide a clear overview of the topic. For me, as an EU agency manager and someone who makes EU software myself, these resonate pretty well. So, let's go! 🚀
Why Now, and Why It Matters
In June 2025, Microsoft's chief legal counsel in France was asked under oath before the French Senate whether he could guarantee that data belonging to French citizens stored in Microsoft's cloud would never be handed over to U.S. authorities without French approval. His answer was unambiguous: "No, I cannot guarantee that."
That single moment crystallized what European technologists, policymakers, and businesses had been warning about for years. The digital infrastructure that underpins European life - from hospitals and banks to schools and startups - is overwhelmingly controlled by American corporations, governed by American law, and subject to American political interests.
The U.S. CLOUD Act makes this explicit: American authorities can compel any U.S.-headquartered company to surrender data regardless of where it is physically stored. European data centers running on AWS, Azure, or Google Cloud offer geographic proximity, not legal protection.
This was already an uncomfortable reality. Under the Trump administration, it has become urgent.
The Geopolitical Trigger
The return of Trump to the White House has accelerated a tectonic shift in transatlantic relations. I don't want to bother you with all the complexity splashed over EU, so just let's go quickly over some points:
- A 15% baseline tariff now sits on most EU goods entering the United States. The administration has openly threatened further tariffs in retaliation for the EU's enforcement of the Digital Markets Act and the Digital Services Act - framing European regulation of Silicon Valley as economic warfare. Trump has used tariffs as leverage in disputes ranging from Greenland sovereignty to defense spending targets, signaling that no dimension of the EU–US relationship is safe from transactional pressure.
- The economic numbers are sobering. Private AI investment in the U.S. exceeded €100 billion in the first three quarters of 2025, while the entire EU attracted roughly €7 billion - a 15-to-1 funding deficit.
- The European pharmaceutical industry alone pledged over €100 billion for U.S. expansion in 2025, pulled across the Atlantic by a combination of tax incentives and tariff threats. The "Big Beautiful Bill" offers 100% bonus depreciation on new factories and immediate expensing of domestic R&D, converting tariff avoidance into an active investment magnet.
- For digital infrastructure, the dependency runs even deeper. A 2025 study found that 92% of Europe's cloud infrastructure is controlled by U.S. companies. GitHub, the world's largest code hosting platform, is owned by Microsoft and has already demonstrated its willingness to block developers in sanctioned countries.
- Europe's most sensitive government communications, healthcare records, and financial systems often run on software stacks ultimately answerable to a foreign jurisdiction.
This is not a theoretical risk. It is infrastructure that can be weaponized - and under the current U.S. administration, the willingness to do so has been demonstrated repeatedly. And I will not even start with the hidden or obscured clauses in most cloud providers' data management, processing, HIPAA compliance, and so on.
The EU Open Stack: A Practical Blueprint
Against this backdrop, a growing movement of European developers, businesses, and institutions is building something tangible: a fully sovereign, open-source technology stack that keeps data, computation, and control within European borders and European law.
Remember, this is not about isolationism - it is about ensuring that European digital infrastructure cannot be switched off, surveilled, or leveraged by foreign political interests.
And this is where I personally stand as well. I had enough with US services and vendor lock. For company management, I am glued to Google Workspace, as I have been using it since 2010, long before these tensions we have now. Moving away will be super hard, but I am looking in this direction - like Protonmail. Same with Dropbox, Adobe, and so on. But while this is the company structure, and for good or bad, I am stuck with it, I started to move my client infrastructure away from US-based services.
Let's go through what you actually need to get started.
Infrastructure: Hetzner or Hostinger Hardened VPS
The foundation is a European-owned server infrastructure. Hetzner, a German company operating data centers in Nuremberg, Falkenstein, Helsinki, and other European locations, offers high-performance virtual private servers at a fraction of the cost of hyperscaler prices. Hostinger, headquartered in Lithuania, provides similar EU-based hosting. Both are subject exclusively to European law - no CLOUD Act, no FISA, no executive orders from Washington.
A hardened VPS means a server configured with strict security baselines: minimal attack surface, automated patching, encrypted storage, and firewall rules that limit exposure. This is the bedrock on which everything else runs.
Deployment: Dokploy
Dokploy is an open-source, self-hosted Platform-as-a-Service - a direct alternative to Vercel, Netlify, and Heroku. It provides a web-based dashboard for deploying applications in any language (Node.js, Python, Go, PHP), managing databases (PostgreSQL, MongoDB, Redis), handling SSL certificates, and monitoring resource usage. It integrates natively with Docker and Docker Compose, supports multi-server deployments via Docker Swarm, and includes one-click templates for popular open-source applications.
The critical difference: Dokploy runs entirely on your own infrastructure. There is no vendor lock-in, no usage-based pricing that scales unpredictably, and no dependency on a San Francisco startup's business decisions. With over 26,000 GitHub stars and 4 million Docker downloads, it is a mature and battle-tested platform.
Traffic and CDN: BunnyCDN
BunnyCDN (bunny.net) is a Slovenian company that has built one of Europe's most compelling content delivery networks. With 24 points of presence across EU member states and EU-only routing filters that ensure data never leaves European jurisdiction, BunnyCDN offers GDPR compliance through its architecture rather than a policy document.
The company has positioned itself explicitly against the surveillance capitalism model. It does not run tracking pixels, does not use Google Analytics, and self-hosts its internal tools. It even built Bunny Fonts - a privacy-respecting drop-in replacement for Google Fonts that is now the default in the Laravel framework. BunnyCDN holds ISO/IEC 27001:2022 certification and is fully compliant with GDPR, NIS2, and the EU Data Act.
Automation: n8n and Windmill
Workflow automation is typically dominated by U.S. platforms like Zapier or Make. The EU Open Stack replaces these with n8n and Windmill - both open source and self-hostable.
n8n is a workflow automation tool that connects APIs, databases, and services through a visual node-based interface. It can be deployed on any VPS and supports hundreds of integrations. Windmill takes a developer-first approach, offering a script-based automation platform for building internal tools, data pipelines, and scheduled jobs. Both keep automation logic and the data it processes entirely on your own servers.
AI: Mistral
For AI capabilities, the stack turns to Mistral AI - Europe's most prominent AI company, founded in Paris by former DeepMind and Meta researchers. Mistral's open-weight models (Mistral 7B, Mixtral 8x7B, Codestral) can be downloaded and self-hosted on European infrastructure without any dependency on U.S. cloud providers.
In September 2025, ASML - the Dutch semiconductor giant - led a €1.7 billion funding round that valued Mistral at €11.7 billion, making it Europe's most valuable AI company. Mistral has since launched Mistral Compute, a sovereign AI cloud platform running 18,000 NVIDIA Grace Blackwell chips in a French data center, with expansion planned across Europe, including a $1.43 billion investment in a Swedish AI data center announced in February 2026.
Mistral's Le Chat Enterprise platform offers full hybrid deployment - on-premises, private cloud, or serverless - making it viable for organizations operating under GDPR and the EU AI Act. While questions remain about whether Mistral's current infrastructure is fully independent of U.S. cloud providers at every layer, the company's trajectory is clearly toward complete European sovereignty, and its open-weight models can already be run on purely European infrastructure today.
Why Open Source Is the Only Path
The EuroStack cannot be built on proprietary European software. That would simply replace one form of vendor lock-in with another. Open source is the essential ingredient because it provides transparency (anyone can audit the code), portability (you can move between providers), and resilience (no single company's failure or acquisition can eliminate your infrastructure).
The European Commission recognized this explicitly at the 2025 EU Open Source Policy Summit, where Cristina Caffarra of the Centre for Economic Policy Research stated plainly that Europe is "colonized by Big Tech, with 90% of our infrastructure owned by them." Adriana Groh of the Sovereign Tech Agency called sovereign technology "not a nice-to-have, but a must-have."
In November 2025, the French-German Summit on European Digital Sovereignty in Berlin produced a formal Declaration of Digital Independence, signed by dozens of European open-source industry associations. The declaration stated that "digital independence is possible" and called on European leaders to make use of the open-source ecosystem that already exists.
The European Commission has since launched a formal consultation on building open digital ecosystems, with a Communication to Parliament expected in Q1 2026. The initiative explicitly frames open-source technologies as strategic assets for competitiveness, cybersecurity, and resilience.
The Risks of Inaction
The consequences of continuing to depend on U.S.-controlled digital infrastructure are not hypothetical. They are already visible:
Legal exposure. The CLOUD Act creates an irreconcilable conflict with GDPR. European organizations using U.S. cloud providers cannot guarantee compliance with their own data protection laws. Microsoft's sworn testimony before the French Senate confirmed this definitively.
Political leverage. The Trump administration has demonstrated a willingness to use technology access as a geopolitical tool - from threatening tariffs over digital regulation to instructing Microsoft to revoke email access for the chief prosecutor of the International Criminal Court. Infrastructure that can be weaponized will be weaponized.
Economic drain. Every euro spent on AWS, Azure, or Google Cloud flows to U.S. shareholders and funds U.S. R&D. Europe's most talented developers contribute to open-source projects whose economic value is captured outside the continent. The EU hosts one of the world's largest communities of open-source developers, yet much of the value they create enriches American corporations.
Innovation dependency. With AI funding running at a 15-to-1 ratio in favor of the U.S., Europe risks becoming a consumer of American AI rather than a producer of its own. Self-hosted European AI infrastructure - powered by companies like Mistral running on European servers - is the only way to ensure that AI development reflects European values, languages, and regulatory frameworks.
A Call to Action
The EU Open Stack is not a utopian vision. Every component described in this article exists today, is production-ready, and can be deployed by a single developer on a €20/month VPS. The total cost of running a fully sovereign European infrastructure stack - VPS, deployment platform, CDN, automation, and AI - is a fraction of what equivalent U.S. cloud services charge, with the added benefit of complete data sovereignty and zero vendor lock-in.
What is needed now is not more regulation or more policy papers. As Caffarra urged at the Open Source Policy Summit: "Do the demo instead of the memo."
Every European startup that deploys on Dokploy instead of Vercel, every business that routes through BunnyCDN instead of Cloudflare, every developer who runs Mistral on Hetzner instead of calling the OpenAI API - these individual choices compound into collective sovereignty.
The question facing Europe's technology community is no longer whether digital independence is desirable. Under the current geopolitical reality — with tariffs as weapons, data as leverage, and infrastructure as a tool of foreign policy — it is whether Europe can afford not to pursue it.
The tools are here. The moment is now. Build the stack.
Final word
I assume if you have read through the article or just skipped to this part, you ask yourself: "Alright, sounds easy, but it's actually not!" Some of the terms, setups, and management of the whole stack will sound like black magic to you, and just clicking and placing a few hundred euros on an already-managed US structure looks tempting.
There are specialists, organizations, and companies, including ITWS.eu, that actively provide this service with examples, with full transparency of what is done, with a secure and traceable chart of the data that will ultimately be yours, with daily (or hourly) backups of every data to a secure connection, providing reliability, maintainability, and incredible customization, EU based. Ping me up if you want to chat in detail.
*This article advocates for the *EU Open Stack - a self-hosted, open-source technology ecosystem designed to keep European data, computation, and digital autonomy within European jurisdiction*. The stack includes: Hetzner/Hostinger (infrastructure), Dokploy (deployment), BunnyCDN (traffic), n8n/Windmill (automation), and Mistral AI (artificial intelligence), but is not limited to and provides much wider coverage of services and areas.*