Digital sovereignty is not a product you buy. It is a stack of unglamorous decisions about where your data lives. A personal look at the foundation layer beneath the apps, the storage, code, formats and backups, and why that is where your freedom actually lives.
French, EU-sovereign backup on the open ISC-licensed Kloset format: immutable, deduplicated, encrypted snapshots. Centralized fleet management and KMS are a paid Enterprise tier. A young project.
Encrypted, deduplicated backups to storage you own, with a built-in GUI and a multi-client server mode. You hold the keys, back up to S3, B2, Azure or local disk, every feature free.
Encrypted, deduplicated backups to storage you own, from one static binary. You hold the keys (zero-knowledge), back up to S3, B2, SFTP or local disk, and every feature is free.
AGPL-licensed file sync and share, a fast self-hosted Dropbox alternative for large file libraries. The vendor is China-based, and SSO, audit logs and search sit behind a paid tier.
Germany's government-built alternative to Microsoft 365. A Kubernetes-based suite integrating Nextcloud, Element, OpenProject and Collabora, stewarded by a state-owned company for the public sector.
German-built, EUPL-licensed video conferencing for the European public sector. Self-hosted, GDPR-aligned, and the first VC service to earn Germany's BSI IT security label.
MIT-licensed Git forge self-hosted on one Go binary: issues, CI/CD actions and a package registry. Now steered by a US for-profit; SAML, audit logs and IP allowlisting sit behind a paid Enterprise tier.
Open-core DevSecOps platform: Git hosting, CI/CD and project management in one self-hostable app. The core is genuinely MIT, but SSO, merge approvals and compliance tooling are gated to paid tiers.
A self-hosted Git forge that replaces GitHub and GitLab, with issues, pull requests and CI/CD built in. Every feature is free software, with no paid tier and no managed option.
A self-hosted Django HRMS covering recruitment, payroll, attendance and performance, all free under LGPL-2.1. No module is paywalled; only SSO and managed hosting sit behind a paid tier.
An AGPLv3 bare-metal platform for virtual machines and containers, built to replace VMware vSphere. Clustering, HA and live migration are free; only the tested enterprise update track needs a subscription.
GPL-3.0 self-hosted HR management system for employee records, leave and time tracking. The free Starter edition covers core HR, but external API access, payroll connectors and advanced recruitment are gated to a paid tier.
Mature open-source desktop office suite for documents, spreadsheets and presentations. Fully offline, no per-seat licence, native OpenDocument format, the standard exit route from Microsoft format lock-in.
A FreeBSD-based firewall and router that replaces Fortinet and Cisco appliances, with IDS/IPS, VPN and traffic shaping built in. The paid edition only gates a hardened, slower release track, not features.
A self-hosted alternative to Microsoft 365: files, calendars, mail, chat and office in one suite, with every byte on infrastructure you control. Enterprise hardening and support are a paid subscription.
GPLv3 modern SQL editor with a polished, friendly UI: the free Community Edition covers the common relational databases. Enterprise and NoSQL drivers, SSO, team cloud workspaces, and AI sit behind the paid Ultimate edition.
Screen-capture power tool for Windows: screenshots, screen recording, and scriptable capture-to-link workflows across 80+ upload destinations. No cloud, no account, no telemetry. Windows-only; GPL-3.0.
Moves files directly between devices on your local network. No cloud, no account, no internet hop. A cross-platform, offline alternative to AirDrop and WeTransfer (Windows, macOS, Linux, iOS, Android). Apache-2.0; single-maintainer project.
Fully local, offline speech-to-text dictation that types into any app using on-device Parakeet models and optional Ollama cleanup: zero telemetry, no cloud, and completely free.
Schema-driven .env management adding type-safety, validation, and AI-safe secret redaction over plain .env files: keeps credentials out of AI prompts, logs, and client bundles.
