One sentence in our internal docs has decided more arguments than anything else we have written: EU suppliers only, no US vendors anywhere in the product or its dependencies. What that rule ruled out, what it bought, and how we live by it. Part 1 of a series on how we built email.eu.
Early on we wrote one sentence into our internal docs, and it has decided more arguments than anything else we've written since: EU suppliers only. No US vendors anywhere in the product or its dependencies.
Not "EU-hosted". Not "GDPR-compliant", which every provider claims. No US company anywhere in the chain, full stop. This post is about what that sentence actually costs to live by, and why we think it's the only version of "sovereign" that means anything. It's also the first part of a series on how we built email.eu, because almost every technical decision in the rest of the series traces back to this one rule.
The comfortable version of sovereignty is to rent a Frankfurt region from a US hyperscaler and put a European flag on the pricing page. The bytes sit in Germany. The company that controls them answers to Washington, CLOUD Act included. Where your data physically lives and who can be legally compelled to hand it over are two different questions, and only the second one matters when it counts.
So our rule isn't about geography. It's about jurisdiction, all the way down the supplier chain. If a US company can reach the data, the flag on the datacenter is decoration.
A rule you never feel isn't a rule. Here are the places where the convenient, industry-default choice was American, and what we did instead.
| The default | Our answer |
|---|---|
| Cloudflare in front of everything | Nothing in front. OVHcloud's own network and anti-DDoS, and services built to be exposed directly. |
| reCAPTCHA or hCaptcha on signup | Altcha, a proof-of-work check your browser solves locally. Nothing phones home to a verification service. |
| Stripe for payments | Mollie, from the Netherlands. |
| SendGrid or SES for transactional email | Remails, an open-source, privacy-first European transactional email provider. |
| Google Analytics | Umami, self-hosted and cookieless, on our own cluster. |
| Datadog or Grafana Cloud for monitoring | Self-hosted probes and a public status page fed by them. |
| Google Fonts | Fonts downloaded once at build time and served from our own servers. |
Each row was a real decision with a real cost. The American option is usually the polished one, with the better docs and the bigger community. Saying no to all of them, every time, without exceptions creeping in "just for this one thing", is the actual work. A single "temporary" Cloudflare setup or one analytics snippet and the claim on the homepage is quietly false.
The payoff shows up in a number: three. That's the full list of companies that process customer data at email.eu. OVHcloud for infrastructure, Mollie for payments, Moneybird for invoicing. French, Dutch, Dutch. We published the whole list, edge cases included, and it's the same list as in our DPA.
Most workspace products have a subprocessor list that runs to dozens of companies, because every convenient SaaS bolted on over the years shows up in it. Ours is short for a structural reason: everything that touches your mail, files or identity is software we operate ourselves rather than a service we send your data to. The rule forced that. When you can't buy the American service, you end up running the open-source equivalent on your own machines, and your data stops travelling.
We should be straight about the edges, because a transparency claim with hidden edges is worse than none. Our source code and build pipeline live on GitHub, which is American. Code, not customer data, but we disclose it rather than hoping nobody asks. The full honest list is in the subprocessor post.
The rule means the hard parts are ours to run. No outsourced email API, no outsourced identity service, no third-party support desk with our data in it. We run the mail servers, the identity provider, the file storage, the video stack, the billing engine, all of it, on infrastructure we control at OVH.
That's the point of the rule, not its price. A provider that operates its own stack understands it, can fix it at 3am, and can look a customer in the eye about exactly where every byte goes. The rest of this series is a tour of how that works in practice:
If the destination sounds right and you're wondering about the journey, the practical answer is shorter than you'd think: most teams move in a weekend, and nothing changes for the outside world until one DNS record at the very end.