Do not take our word for any of it.

The standard

Everything this test says about a company is that company’s own wording, copied from a page you can open yourself, with the date we read it. Everything it says about American law names the exact section, says whether it is still in force, and gives the date we last checked. Nothing is here because people say it.

We say what can be lawfully compelled and by whom. We never say what any company has done with anyone’s data, because we do not know that and neither does anybody else outside the process.

Why we say, every time, whether we opened it ourselves

Because we watched it go wrong. While researching this, a tool that summarises pages invented a quotation and put it in a US Congress research paper. It read perfectly. It appears nowhere in the document. We only caught it by pulling out the real text and searching it word for word — which is now how every quotation here is checked, automatically, against the live page.

So every single finding says, on its face, whether we read the document ourselves or took somebody else’s word for it. 25 of the 29 findings in the section on what can be done with your data rest on documents we opened and read ourselves; the rest say so plainly, and are not given as quotations.

What we do not know

There are 45 places in this test where we say we could not establish something, including several questions people ask about this subject constantly. Leaving them visible is not modesty. A tool that appeared to have an answer for everything would deserve to be dismissed, and would take the sourced findings down with it.

Other people got here before us

They did real work, and pretending otherwise would be a poor start for a page about honesty. Here is who they are, and what this adds instead of repeating.

• european-alternatives.cloud catalogues European alternatives to American services and records, per service, why one might be a concern — including reasoning about US law. It is open source and actively maintained, and it covers far more services than this does.
• The European Open Source AI Index (Radboud University) scores models on how open they actually are, which is the harder half of the self-hosting question we ask.

Others are building assessments of the same question. Upper Harbour in Canada indexes several hundred tools by parent jurisdiction; Sovereign Cloud Compass in Hamburg scores cloud providers against the European Commission’s sovereignty criteria; EU Vetted checks products against their published agreements and ownership records. The European Commission itself has published a Cloud Sovereignty Framework whose legal-exposure criterion names the CLOUD Act directly — and weights it at a tenth of the total score, on the reasoning that procurement covers the rest.

What this test does that those do not: it follows the supplier chain. Not who sells you the tool and where they are registered, but which companies that vendor names as running the machinery underneath, and where each of those is incorporated. That is where a European vendor stops being a European answer, and it is a per-vendor reading rather than a rule that can be applied from a list.

We use their work the way we would want ours used: to find the document, never as the reason to believe something. Nothing here is copied out of somebody else’s list. Every sentence comes back to a page we opened ourselves.

What this test will not tell you

• Most tools. We would rather do a short list properly than a long list badly. If your tool is not on the first screen, that is not a clean bill of health — it means we have not looked at it.
• Special “we keep it in Europe” deals. Some suppliers sell an arrangement meant to keep everything inside Europe. Whether one actually does depends on what your contract says and how it is wired up, and we have not examined a single one.
• Any country other than the United States. Every country has intelligence services. This is about one country’s powers, because that is the set most European companies are quietly relying on without having read a word of it.
• Your own legal position. And it is not legal advice. It has never seen your contracts and it cannot tell you what to do about any of this.

About the logos

Each tool is shown with its own mark so you can find the ones you actually use. They are the trademarks of their owners, used only to identify the products named, and nothing here is endorsed by or connected to any of them. Every mark is drawn into the page itself rather than loaded from that company — asking Microsoft for a Microsoft logo would tell Microsoft who was reading about Microsoft, which is the exact behaviour this test exists to point at. Three tools have no published mark and are shown as text instead of an invented one. We quote just enough of a sales claim to show what it says, with the source and the date beside it.

If we have got something wrong

Tell us and we will fix it. Every claim here is one line with its source and its date attached, so correcting one is a small change anybody can check rather than an argument. That goes for the companies named here as much as anyone else.

Every source, and proof of what it said when we read it, so you can check you are reading the same document we read.

We also run these questions on ourselves, and publish the parts that do not flatter us.