Open, capable, sovereign: in AI you get to pick two. The frontier models are proprietary and revocable, the open ones you cannot run or cannot match, and even Europe's champion runs on chips it will never make. Sovereignty is not the model you pick. It's the weakest layer beneath it.
Documentation sites on Astro, with self-hosted full-text search built in rather than bolted on. Mix React, Vue, or Svelte components in one site. Still pre-1.0 after three years.
Vue and Vite powered documentation sites. Markdown in, static HTML out, with a build fast enough that large sites stay pleasant. The stable line has been quiet for about a year.
The documentation generator behind Python itself. One plain-text source builds a website, a PDF, and an API reference pulled from your code. reStructuredText is the learning tax.
Documentation as code. Your content stays as Markdown in your own Git repo and ships as static HTML you host anywhere. Search is the one piece you still solve yourself.
An authoritative-only DNS server from the Dutch non-profit NLnet Labs, run by DNS root servers and many TLDs. Minimal attack surface by design, BSD-3. It serves zones only, not recursion.
A validating recursive DNS resolver from the Dutch non-profit NLnet Labs. Resolve from the root servers yourself, so no public resolver sees your lookups. A focused resolver, not a full server.
The reference DNS implementation much of the internet runs on, governed by the non-profit ISC, not a company. Authoritative and recursive, MPL-2.0. Configuration is manual and zonefile-driven.
Carrier-grade open source DNS used by ISPs and telcos: authoritative server, recursor and load balancer in one GPLv2 codebase. EU-owned via Open-Xchange. The management UI and support are a paid tier.
A self-hosted DNS ad-blocker with encrypted DNS and DHCP built in, blocking ads across every device. Auditable GPL code that phones nothing home. A modern sinkhole, not a full authoritative server.
A network DNS sinkhole that blocks ads and trackers for every device, with no client software. Runs fully offline, so its US parent never sees a query. A focused ad-blocker, not a full DNS server.
A self-hosted DNS server that works as both a privacy resolver and a full authoritative server. Encrypted DNS, DNSSEC, clustering and SSO are all free, with no paid tier. Development rests on one maintainer.
A Luxembourg-based, OpenPGP password manager for teams sharing credentials. EU jurisdiction keeps it clear of the US CLOUD Act. SSO, directory sync and audit logs are paywalled.
An offline password vault with no server and no vendor cloud. Credentials live in a local encrypted file you control. No central administration, so offboarding and backups are yours.
Apache-2.0 zero-trust overlay you embed into the application itself. The whole stack, controller included, is self-hostable with no capability paywall. NetFoundry sells only managed hosting and support.
BSD-licensed control server that runs official Tailscale clients on coordination infrastructure you host, no proprietary cloud. Volunteer-maintained; no GUI, RBAC, or commercial support.
WireGuard mesh VPN with a control plane you self-host, the EU-sovereign answer to Tailscale. OIDC SSO included; active-active HA, SCIM, and SIEM streaming are commercial.
"Buy European" has become Europe's answer to digital dependence. But a European vendor is one acquisition away from being American, and hosting on home soil won't stop US law. Real sovereignty isn't where your software comes from. It's whether you can leave it.
MIT-licensed collaborative intrusion prevention that blocks malicious IPs from your logs and shares the signals network-wide, so every user gains herd immunity. Premium blocklists are paid.
Source-available (ELv2) network security monitoring on Suricata, Zeek, and the Elastic Stack. Self-hostable and airgappable; SSO and disk encryption require the paid Pro tier.
Open-core, dbt-native BI that turns metrics and dashboards into version-controlled code. The MIT core is self-hostable; SSO and fine-grained RBAC sit behind the paid tier.
A SQL-first query, dashboard, and alerting tool with 50+ data connectors and no paid tier. Databricks abandoned the hosted service in 2021; the community rebuilt it.
Every digital sovereignty talk ends the same way: set up an OSPO, and the idea gets filed under someday. But the office is not the point. It is a container for the jobs your vendor used to do, priced into the license fee and now yours to own. Name who owns them and you are ahead of most.
Google published the Open Knowledge Format, an open, vendor-neutral way to hold the knowledge your AI reads: nothing but text files. Then it bundled its own tooling beside it, every piece pointing back to Google Cloud. The format is worth taking. The strings are worth cutting.