
Digital Sovereignty
A practitioner's first-person log of replacing US SaaS/cloud services with European or self-hosted alternatives across analytics (Google Analytics → self-hosted Matomo), email/passwords (Proton Mail, Proton Pass), compute and storage (DigitalOcean/AWS S3 → Scaleway, OVH for backups via rclone sync), transactional email (SendGrid → Lettermint), error tracking (Sentry → self-hosted Bugsink), and AI inference (OpenAI → Mistral, plus local models like Qwen), while explaining the deliberate exceptions kept on US infrastructure (Cloudflare, Stripe, Claude Code, GitHub/GitLab). It frames "digital sovereignty" as a practical risk-management exercise — knowing where data lives, avoiding single-vendor/jurisdiction dependence — and documents concrete migration friction (Proton's 3-domain cap, no content-based filters, OVH's buried lifecycle-rule config) rather than abstract advocacy.
Organisations named here
- GDPR
Technologies named here
- Proton Mail
- Mistral
- Cloudflare
- Claude Code
- OVH
- Scaleway
Related in GRC

Orca Security: NIST AI Risk Management Framework (AI RMF) Explained

FOSSA: CISA Releases the 2026 SBOM Minimum Elements
Teach Yourself to Phish | Huntress
