Every EU founder runs into the friction eventually, usually around the time they’re choosing between GitHub and “something else”. Your US counterpart spun up Vercel, GitHub, PagerDuty, Vanta, and Notion in an afternoon. You’re reading Article 28 of the GDPR and wondering whether your CI provider’s DPADPAData-processing agreement - the contract that spells out how an outside vendor is allowed to handle personal data on your behalf. GDPR requires one with every such vendor. actually covers what you think it covers. And the gap widens with every compliance framework your sector falls under.
Europe has the tools, not the integration
What’s missing is not raw capability. Europe has credible alternatives in almost every infrastructure category. Gitea and Forgejo compete with GitHub. Authentik and Keycloak handle identity. Grafana and Prometheus are the de facto standard open-source monitoring stack – and while Grafana Labs is a US company, the software is open source and fully self-hosted, with no network dependency on any US-controlled service. CISO Assistant, built by a French company, handles GRCGRCGovernance, risk & compliance - software for tracking the security rules you have to follow and keeping the evidence that proves you follow them. across ISO 27001, NIS2, DORA, and GDPR simultaneously.
The gap shows up when you try to assemble them into a stack. Microsoft and Amazon are not really selling you tools. They are selling you the integration – and it is very good.
It’s worth being honest about what that buys, because the sales pitch happens to be true. On Azure, a .NET service goes to App Service straight from a CI/CDCI/CDContinuous integration / delivery - automation that tests your code and ships it to your servers every time you make a change, instead of doing it by hand. pipeline; you point Easy Auth at Entra ID and the app has SSOSSOSingle sign-on - one login that gets a person into every tool, instead of a separate password for each app. in about three clicks, with no library to add and no redirect URIs to get wrong; managed identity lets it read from Key Vault without a secret ever landing in a config file. AWS asks for more – a VPC with its subnets and route tables, IAM roles and policies, a load balancer with target groups and listeners – but it is exceptionally well-trodden ground, and there is a written-up answer for every step of it.
Self-hosting is where the wiring bill arrives. Gitea doesn’t know about Woodpecker. Woodpecker doesn’t know about your OIDC providerOIDC providerThe one login service that all your other apps trust to answer ‘who is this user?’ - the hub that makes single sign-on work. (OIDC is the standard the apps use to ask.) . Nothing knows which routes are supposed to sit behind a login and which have to stay open, or whether last night’s backup ran. Every line between those components is yours to draw, and then yours to keep working. Each tool is good on its own; the integration burden falls entirely on you.
And there’s a part that never appears on a pricing page. Both hyperscalers hand you their ISO 27001, SOC 2, and C5 attestations for everything underneath your application. That is a real lift, it is the strongest card they hold, and you should take it seriously before walking away from it.
But an attestation is a statement about controls, and jurisdiction isn’t a control – it’s a fact about who operates the service and which courts can compel them. So the inheritance runs both ways, and only one direction is on the sales page. Their certifications transfer to you. So does their jurisdiction.
Early-stage startups should be spending their engineering time on product, not on wiring identity providers to reverse proxiesreverse proxiesA reverse proxy is a gatekeeper server that sits in front of your apps: every web request hits it first, and it forwards each one to the right app - handling HTTPS and login checks in one place. and then debugging forward-auth headers at midnight. That is exactly the bind: the vendors who will gladly do that wiring for you are the ones whose jurisdiction you were trying to leave.
Then compliance stacks on top
The integration gap is annoying on its own. Add EU compliance and it starts costing real money.
GDPR has been around long enough that most founders understand the basics: lawful basis, DPA with processors, 72-hour breach notification to your supervisory authority. But NIS2, which member states had to transpose into national law by October 2024, added a whole second rulebook. If your startup provides services in sectors like digital infrastructure, ICT service management, or cloud computing, you now face mandatory risk management measures under Article 21 that cover supply chain security, cryptographic controls, access management, incident handling, and business continuity. And Article 20 makes management personally liable for ensuring these measures are in place.
DORA adds another layer for anyone touching financial services. It demands ICT risk management frameworks, detailed incident classification and reporting timelines (initial notification within 4 hours of classifying an incident as major), and explicit contractual requirements with your ICT service providers.
Any one of these frameworks is manageable. It’s stacking them that hurts. A SaaS company incorporated in the EU is under GDPR from its first user, under NIS2 the moment it lands in scope, and under DORA’s flow-down requirements as soon as it sells to a bank: overlapping but non-identical sets of controls, each with its own audit trail and its own paperwork. And none of it replaces the SOC 2 report an enterprise buyer will ask for anyway.
A US startup building the same product starts with SOC 2, and picks up HIPAA only if it touches health data: one dominant framework with mature tooling (Vanta, Drata) and an ecosystem of auditors who know exactly what to check.
A fintech has it worse still: add its national supervisor’s requirements – DNB, for a Dutch fintech – to that pile, and every one of those regimes wants its own evidence.
What “sovereign” actually means in practice
The CLOUD Act discussion is real, but it tends to stay abstract. The concrete version:
When your company stores operational data – source code, CI/CD pipelines, infrastructure credentials, incident logs, employee information – in a US-incorporated service, that data is subject to US government access requests regardless of where the servers physically sit. The provider can be compelled to produce it without notifying you. For regulated entities under NIS2 or DORA, auditors are starting to flag this as a compliance gap.
Sovereignty means more than “hosted in Europe”: the entire chain – the legal entity operating the service, the code, the infrastructure – has to sit outside the jurisdiction of foreign data access laws. Hetzner in Germany or Finland, OVHcloud in France, and self-hosted open-source software with no network dependency on a US-controlled service – that’s the combination that actually satisfies the requirement. For most tools that also means no US parent entity; where one exists – as with Grafana Labs, Authentik, or Keycloak – the test is that you run the software yourself, so there is no operator a foreign court order can compel.
The missing middle
The market has two extremes and an empty middle. On one end, you can buy managed EU cloud services. Scaleway, Hetzner Cloud, OVHcloud all offer VMs and object storage, and Scaleway and OVHcloud add managed databases. Those are building blocks, though. Nobody is offering “here’s your complete internal operations platform, with the compliance scaffolding included” – managed or otherwise.
On the other end, large enterprises hire infrastructure teams to build custom stacks. They can afford to spend six months integrating identity providers, setting up monitoring, configuring backup pipelines, and documenting everything for their ISO 27001 audit. A ten-person startup cannot.
The middle would be a pre-integrated, sovereign-by-default stack that a technical founder can deploy in an afternoon, with the compliance scaffolding already in place.
An EU company could sell exactly that as a managed service, and it would answer the jurisdiction question perfectly well. Nothing here says otherwise; that is a real and legitimate product. But it adds a company to your supply chain, and not an equivalent one. A hosting provider holds a disk, and you can encrypt that disk with a key they don’t have – do that, and their access buys them nothing. Whoever operates your application holds the keys and the database in the clear, because an application cannot run on data it cannot read. That is the processor you have no technical defence against, and the only way to have none of them is to run the thing yourself.
Which means somebody has to do the integration work once, properly, and hand it over – instead of leaving every team to reinvent it.
Why it matters now
Two regulatory timelines make this urgent.
NIS2 transposition deadlines have passed in most member states, and enforcement is ramping up. If your startup falls within the directive’s scope (and the scope is broader than most founders realize – “digital infrastructure” and “ICT service management” catch a lot of SaaS companies), you need documented, auditable security measures in place now.
DORA became applicable in January 2025. Financial institutions are already flowing down its requirements to their technology providers. If your startup sells to banks, insurers, or payment processors, your customers will start asking for evidence of ICT risk management frameworks and incident response capabilities in their procurement process.
Founders who sort this out before their first enterprise sales call will have a much easier time than the ones retrofitting it under procurement pressure. The retrofit gets more expensive with every customer and every new regulation.
Europe needs better defaults.
Edited 2026-07-24. Corrected the provider comparison in the missing-middle section: Hetzner Cloud offers VMs and object storage but no managed database product; that offering belongs to Scaleway and OVHcloud.
Edited 2026-07-27. Corrected the sovereignty section: Grafana Labs is not the lone US-parented exception – Authentik and Keycloak carry US parentage too, and the run-it-yourself test applies to all of them. Also clarified that DNB is the supervisor for a Dutch fintech specifically.