Accans

Updates.

Tracked changes to the vendor database. The full technical changelog lives in our documentation.

Ownership audit: 16 jurisdiction fixes and 8 new EU vendors

A web-verified, multi-agent review (Haiku 4.5) surfaced misclassified vendors. Fifteen EU/EFTA-based providers (incl. APPUiO, Bacula Systems, Locize, Efecte, KrakenD, Sygic, Hornetsecurity, Connective, Talend, Transifex, Henchman, Homerun, Pixlr, Tails, Dinero) were wrongly flagged as 'outside the EU' — their region is corrected to EU, with the actual foreign parent recorded separately (the signal that matters for the US CLOUD Act). Payload CMS is now marked as a US provider. FortKnoxster was removed after pivoting to crypto. Eight new EU providers were added in thinly-covered categories.

Added

  • Eight new EU providers: Poolside (FR, AI coding), Noota (FR, AI cowork), Better Stack (CZ, error tracking), TRUENDO (AT, consent), DNS4EU (CZ, privacy DNS), MailerSend (LT, transactional email), Giskard (FR, open-source AI testing) and Black Forest Labs (DE, AI).

Removed

  • FortKnoxster removed — acquired by SYS Labs (Canada) and pivoted to crypto (SuperDapp); no longer an identity product.

Fixed

  • Region corrected from 'outside EU' to EU for 15 EU/EFTA-based providers; foreign owners (US/UK/AU/MY) are recorded separately via ultimate_parent_country rather than via the region.
  • Payload CMS classified as a US provider (US HQ, owned by Figma).

Passbolt corrected (LU) and added to password-manager category

Passbolt was already in the catalogue under cybersecurity, but with the wrong jurisdiction (FR instead of LU) and an overly terse description. It is a Luxembourg-based open-source credential manager (AGPL-3.0) by Passbolt SA, aimed at IT and DevOps teams. Alongside the correction, a second entry was created under password-manager so users looking for an EU alternative to 1Password, Bitwarden, LastPass or RoboForm now find Passbolt there directly.

Added

  • Passbolt as a second entry under password-manager (alongside the existing cybersecurity entry), linked as an alternative to 1Password, Bitwarden, LastPass and RoboForm.

Fixed

  • Passbolt: HQ corrected from FR to LU (Passbolt SA, Belvaux, Luxembourg), AGPL-3.0 license made explicit, description expanded.

Gap analysis round 2: 75 new EU vendors across 40 categories

Systematic scan of the remaining business categories in two blocks of twenty, using Haiku finders and Sonnet verify. The catalogue now lists 1,771 vendors. Includes Elastic (NL, apparently never recorded as a database), Kestra (FR, workflow orchestration), Lovable (SE, AI development), Haystack/deepset (DE, open-source RAG), Snom (DE, VoIP), TSplus (FR, remote desktop), Graphisoft ArchiCAD (HU, CAD), Bacula Systems (CH, backup), Rebelle (SK, natural-media design), Locize (CH, developer TMS), seven previously missing European form/survey tools (AidaForm, easyfeedback, Edkimo, empirio, Crowdtech, QUESTIONSTAR, SmartSurvey), and esign alternatives Penneo (DK) and Buypass (NO).

Added

  • Databases and data: Elastic (NL, AGPLv3-restored), Kestra (FR, Apache-2.0 orchestrator).
  • Remote desktop & VoIP: TSplus (FR), RealVNC (GB), Snom (DE), Equada (DE), Nomado (BE), Voiped Telecom (NL).
  • GIS & CAD: Oslandia (FR, open source), OPENGIS.ch (CH), Coexya (FR), Eurosense (BE), Pix4D (CH), Lutra Consulting (GB), Graphisoft ArchiCAD (HU), Graebert ARES (DE), ELITECAD (AT), Cadwork (CH), Leica Geosystems (CH).
  • Compliance, GRC & HR: DataGuard (DE), Orbiq (DE), EuroComply (PT), Talentech (NO), Eploy (GB), Vouch (NO), Breathe HR (GB), Ubisecure (FI).
  • Scheduling, time-tracking & low-code: Calenso (CH), Cronofy (GB), Reservio (CZ), Agendize (FR), solidtime (AT, open source), Time Cockpit (AT), timeBuzzer (DE), WeWeb (FR), Cerberus Testing (FR, open source).
  • AI & design: Lovable (SE), Haystack/deepset (DE, open source), Rebelle (SK), ArtFlow (PL).
  • Backup & translation: Bacula Systems (CH, AGPLv3), Xopero (PL), Locize (CH), Apertium (ES, open source), Protemos (UA).
  • Forms & surveys: AidaForm, Edkimo, empirio.ai, easyfeedback, QUESTIONSTAR (all DE), Crowdtech (NL), SmartSurvey (GB) — this category was chronically under-supplied with EU alternatives.
  • Marketing, esign & CMS: Omnisend (LT), AGNITAS (DE, open source), Membrain (SE), Quarticon (PL), sproof (AT), Commfides (NO), Penneo (DK), Buypass (NO), Jahia (CH), Microweber (BG, open source), Roadiz (FR, open source).
  • Other: Beckhoff Automation (DE, IoT), KEBA (AT, IoT), Joker.com (DE, domain registrar), Tine 2.0 (DE, email/groupware), APPUiO (CH, virtualization), Keelearning (DE, LMS), Hornbill (GB, ITSM), Linphone (FR, open source collaboration), SendRec (RO, open source collaboration), Elestio (IE, DevOps), World4You (AT, webhosting), Coolhousing (CZ, webhosting).

Gap analysis: 21 new EU vendors added in the thinnest categories

Targeted gap scan on the twelve categories with the fewest EU alternatives. Twenty new vendors added, plus Otobo as a second open-source OTRS fork. Includes sovereign AI workspaces (Delos in Paris, nexos.ai in Vilnius, Nextcloud Assistant), captcha alternatives to reCAPTCHA (Private Captcha from Estonia, Captcha.eu from Austria, Myra EU CAPTCHA from Munich), writing tools (DeepL Write, Writefull, ProWritingAid, CKEditor), API management (Frends from Finland, Locoia from Germany, STOA from France), and transactional email (AhaSend from the Netherlands, MessageFlow from Poland).

Added

  • AI Cowork: Delos (FR, sovereign French AI workspace platform), nexos.ai (LT, founded by Nord Security founders), Nextcloud Assistant (DE, open source, self-host).
  • Writing tools: DeepL Write (DE), Writefull (NL, academic), ProWritingAid (GB), Surfer SEO (PL), CKEditor (PL, open source).
  • API Management: Frends (FI), Locoia (DE), STOA (FR, open source).
  • CAPTCHA: Private Captcha (EE), Myra EU CAPTCHA (DE), Captcha.eu (AT) — all GDPR-compliant and cookieless.
  • SMS API: tyntec (DE, Tier-1 CPaaS). Digital Signage: ScreenCom (NL). Consent Management: Cookie Information (DK). AI Coding: Lurus Code (DE). Transactional Email: AhaSend (NL), MessageFlow (PL). ITSM: Otobo (DE, second active OTRS fork alongside Znuny).

Second audit pass: 67 corrections on vendors skipped in the previous round

Reviewed 1,223 vendors that were skipped in the previous audit using a cheaper overnight loop (Sonnet 4.6, split across six ticks): 78 confirmed findings, of which 67 changes applied. Includes new ownership structures (Harvest to Bending Spoons IT, MailerLite to Vercom PL, Fondy to TBC Bank GB, MariaDB commercial arm to K1 US, PAYONE under Worldline FR), licence rug-pulls from open source to source-available (CapRover, Chatwoot, Invoice Ninja, OpenKM, Planka, Rasa, TheHive), and removals (legacy SchildiChat Desktop, standalone Sofort, Juke, iRedMail Easy).

Changed

  • 42 new ownership corrections for vendors whose parent had moved to a different jurisdiction — including Nets → Nexi (IT), Nmbrs → Visma (NO), SnelStart → EG (DE), Magnolia → GENUI (DE), Roundcube → mailbox.org (DE), Signaturit → Namirial (IT), SMSAPI → LINK Mobility (NO), Sympa → US, Tidal → US, Topicus Healthcare → CA.
  • 10 headquarters corrections (SigNoz was mis-classified as DE, actually US; Vendure is Vienna, not Prague; Corteza is IE, not SI; Quire is TW; NoMachine is LU; WEDOS relocated CZ → LU).
  • 10 licence changes: CapRover, Chatwoot, Invoice Ninja, OpenKM, OTRS, OXID eSales, Planka, Rasa and TheHive lost open-source status (Fair Use, custom EULA or open-core with commercial core). Descriptions updated with the date and nature of the licence change.
  • Rebrand corrections: Gardener (SAP) → Gardener (NeoNephos Foundation), Lectora (eLearning Brothers) → Lectora (ELB Learning), Restorepoint → Skylar Compliance, MobilePay + Vipps → single 'Vipps MobilePay' entry, myLoc → myLoc a WIIT Company, Trilium Notes → Trilium Notes (TriliumNext), windream → dataglobal.

Removed

  • 5 vendors removed due to discontinuation, absorption or duplication: SchildiChat Desktop (now 'legacy'), Sofort as standalone (folded into Klarna), JUKE (Talpa discontinued the service), iRedMail Easy (hosted version), MobilePay (merged into Vipps).

Full audit of acquisitions, ownership and licences

All 1,700 records reviewed via a layered agent swarm: 320 changes applied, including 153 ownership corrections, 73 headquarters corrections, 39 removals of discontinued or absorbed products, and 17 licence changes where formerly open-source projects moved to source-available or proprietary.

Changed

  • 153 ultimate parents and EU classifications updated — e.g. DocuWare (owned by Ricoh, JP), DomainFactory (owned by GoDaddy, US), Doxis/SER Group (TA Associates majority, US), Dokobit (folded into Signicat, NO/EEA).
  • 73 headquarters corrections including Dynatrace and Bruker (operational HQ moved to the US) and Duplicati (incorporating entity Duplicati Inc is US-based).
  • 26 product rebrands applied: Doxis4 → Doxis, HubSpot CMS → HubSpot Content Hub, All 4 → Channel 4, Bugsnag → SmartBear Insight Hub, Byte → Hypernode, and more.

Removed

  • 39 vendors removed that have shut down or been absorbed: Boxcryptor (assets to Dropbox, closed January 2023), BullGuard (NortonLifeLock, phased out), Buttercup (project ended June 2025), Hotjar (merged into Contentsquare, July 2025), BrutX (streaming closed 2022), ZenMate (absorbed into CyberGhost), Reaction Commerce (ended), Pootle (closed May 2023) and 31 others. Platform.sh also removed in favour of its successor Upsun.

Fixed

  • 17 projects previously marked as open source corrected to open-core or proprietary: Airbyte (ELv2), Anytype, Cal.com (AGPL → commercial licences for enterprise), Camunda, CockroachDB (BSL), Directus (BSL), FusionAuth, Kopano, Meilisearch (commercial clauses), MinIO (AGPLv3 but recalibrated), Mirth Connect, NocoDB, ONLYOFFICE, Proton Pass, Sentry (FSL), Talend, Chartbrew.

New category: Digital Asset Management

Twenty DAM vendors added — from OpenText, Adobe and Cloudinary to European alternatives such as WoodWing, Bynder, CELUM and Fotoware — with verified ownership structures and hosting regions.

Added

  • Digital Asset Management (DAM) category with 20 vendors: European options WoodWing (NL), Bynder (NL), CELUM (AT), censhare (DE), 4ALLPORTAL (DE), Wedia (FR), QBank (SE), Fotoware (NO), Papirfly (NO), Frontify (CH), Pimcore (AT) and ResourceSpace (GB, open source) alongside OpenText, Adobe Experience Manager Assets, Cloudinary, Acquia DAM, Sitecore Content Hub, Canto, Aprimo and Brandfolder.

Changed

  • Pimcore marked as open-core instead of open source — the core is proprietary (POCL licence) since version 12 (2025).
  • Ownership recorded: Bynder has a US parent (Thomas H. Lee Partners, majority since 2023) and Wedia is no longer publicly listed since late 2024 (Cathay Capital, Paris).

Vendor database cleaned up and expanded

Nine records with incorrect headquarters information corrected, 27 new European vendors added, and the schema extended with sovereignty metadata so each vendor's positioning is explicit and honest.

Read ADR-001 on EU provenance →

Added

  • 27 new EU vendors — including Didomi, Axeptio and consentmanager.net (consent management), Dynatrace and Pandora FMS (monitoring), Make.com and SeaTable (low-code), memoQ, Phrase TMS and Wordbee (translation), Trade Republic (fintech), Aircall (helpdesk) and Nedap Healthcare.
  • Three new per-vendor metadata fields: ultimate parent company (e.g. Wrike is owned by Symphony Industrial), sovereignty mode (vendor-hosted-eu / self-host / oss-distributed / vendor-hosted-non-eu) and a sharper EU classification (EU-27 / EEA / EFTA / EU-adjacent).
  • Nine invariant tests in CI that prevent regressions — no EU sentinel without a sovereignty mode, no duplicate (name, category) pairs, no non-HTTPS websites, etc.

Changed

  • Hologic, Carestream Health, Wrike and WordPress (self-host) moved from EU to US — these are US incumbents, not European alternatives.
  • RustDesk (China), Logseq (Singapore) and Synology Drive on-prem (Taiwan) corrected to the developer's actual country; sovereign only when used locally or self-hosted.
  • Bitrix24 corrected to Cyprus (legal entity) with explicit disclosure of Russian origin.
  • Wire (Switzerland), Directus (US, BSL-licensed) and SumUp (UK post-Brexit) reclassified.
  • 57 Swiss vendors tagged EFTA, 29 Norwegian/Icelandic as EEA, 4 Ukrainian as EU-adjacent.

Removed

  • Misleading and duplicate records removed: a second Epic record labelled EU (real HQ is Verona WI), a duplicate SumUp and Directus entry, a duplicate SoftMaker Office, and Adyen/Mollie from the ERP category (they are payment processors, not ERP systems).
Changelog — Digital Sovereignty Heatmap