Data Sovereignty

“Over the past several years, the concept of digital sovereignty has become ever more central to European notions of competitiveness and economic resilience.”
Quote: https://www.atlanticcouncil.org/in-depth-research-reports/report/digital-sovereignty-europes-declaration-of-independence/

There is significant concern about the use of products from the USA. This stems from concerns raised by the EU and others due to President Trump’s hostility to the EU and others. As an IT company providing security and protective services to our clients, we operate within strict parameters to ensure our own security is of a high standard and were we can assist in ensuring continued access to systems and tools.

Where appropriate, we share our best practices with our clients.

In the following notes we share how we manage our data and where data is stored or what tools are used to handle data. As a B2B supplier, the data we handle is directly related to your business.

  • Files and documents
    • Firstly, we adopt a strict policy of ensuring documents remain portable and less likely to succumb to corruption. It is common for people saving files to introduce spaces and odd characters. The correct way is to only use – and _ along with letters and numbers. E.g. date_filename_person-version.ext
    • Dates. The date in a file and in emails or any document you want to save and retrieve quickly should use the date in Year, Month, Day format. E.g. 20260310. This way, all files from one year to the next will always be in date order. If you reverse this with DDMMYYYY all files on the 1st of a month will be together followed by all files on the 2nd day and so on.
    • Using the correct file type will ensure the correct application is used and the file is properly saved. If you just change the file extension you will not change the file type. To save a file in the correct format you must use a suitable application to save the file.
    • For file storage we use Proton (Switzerland 🇨🇭)

  • Images
    • If you send us images, send them in the raw format and let us optimise and resize images for use.
    • Use jpg or jpeg for photos. jpg = Joint Photographic Experts Group
    • Use png for graphics png = Portable Network Graphics
    • Use svg or similar for a vector image. svg = Scalable Vector Graphics
    • Our main tool is Affinity (UK 🇬🇧)
  • Passwords
    • We do not keep copies of client’s passwords. On most systems, the client can select to reset their own password. The is normally a password reset button or link
    • We strongly advise on using a password manager. These can be free of charge, however, for a small fee the full scope of the tool is available to the user. Businesses should always use a paid for tool. We use Proton (Switzerland 🇨🇭)
    • There is no excuse for not having a good password system in place
    • Business users can have systems where passwords are made available to staff without the staff having editorial or viewing rights
    • Passwords should be long rather than complicated. See information theory – entropy
    • Our main tool is Proton Pass (Switzerland 🇨🇭)
  • Browsers
    • We currently use some of the safest browsers around
      • For general use we use Vivaldi Browser, DuckDuckGo and Safari
      • For development we use Firefox Developer Edition
    • Our main browser is Vivaldi (Norway 🇳🇴)
  • Email
    • As users of MacOS we have no need for an external mail client such as Outlook.
    • For secure email we use Proton (Switzerland 🇨🇭)
    • All our hosted services come with a mail service which can be accessed via webmail. This is an included app in every hosted service
    • Where customers use Microsoft 365 we suggest they use the web version as their primary mail client. This saves on space and issues related to downloaded apps
    • Email references, particularly where important, should use the subject line in the same format as file names – Year – Month – Day etc.
  • Maps
    • For pin point accuracy, WhatThreeWords ///w3w (UK 🇬🇧)
  • Security
    • All our services use some form of security. We do not recommend you use any system without security.
    • 2FA – Two-factor Authentication. 2FA generators are freely available from Google, Microsoft. Users of integrated password managers will also have generators built in. Where possible these should be used.
    • MFA – Multi-factor Authentication (also includes 2FA) is any electronic authentication system. This can include Keys, PINs and fobs.
    • Physical characteristics- biometrics such as finger prints, eye iris or even typing speed
    • Passkey – use of WebAuthn systems
    • As a main security tool we use F-Secure (Finland 🇫🇮)
  • Backup
    • Files and systems must always be protected by a form of backup
    • Backups should exist in more than two locations. It is insufficient to hold a backup on the same system or website as the live system
    • Ideally, a backup should exist in both a remote geographical location and on a different system
  • GDPR
    • Users are responsible for security of data. We protect the data we hold about you. The data you hold is your responsibility to secure.
  • Project Manager
    • Meantime – Open Source version, originally from US (we host our own copy)
  • Website Hosting
    • All our websites are hosted in the UK. We have options to use US servers where clients have business in the US (UK 🇬🇧)

When choosing a system for your business and needing data sovereignty, you may wish to select UK or European services. Below is a list of some of those with UK,  EU or EFTA sovereignty.

UK – United Kingdom. EU – European Union. EFTA – Switzerland / Norway.

EMAIL

🇩🇪 Tuta (Tutanota) EU Hanover, Germany · Founded 2011
End-to-end encrypted email, calendar & contacts. Open-source, quantum-resistant encryption.

🇨🇭 Proton Mail EFTA Geneva, Switzerland · Founded 2013
End-to-end encrypted email from CERN scientists. Over 50,000 businesses.

🇩🇪 mailbox.org EU Berlin, Germany
Secure business email with calendar, contacts, docs, video. CO₂-neutral servers.

BROWSER

🇳🇴 Vivaldi EFTA Oslo, Norway · Founded 2014
Highly customisable browser by the original Opera founders. Built-in mail, calendar & feed reader.

CLOUD STORAGE & FILE MANAGEMENT

🇨🇭 pCloud EFTA Geneva, Switzerland
Fast, secure cloud storage with lifetime plans. Data centres in Luxembourg.

🇨🇭 Tresorit EFTA Budapest/Zürich · Swiss-Hungarian
Zero-knowledge encryption, strong business compliance tools (HIPAA, GDPR).

🇸🇮 Koofr EU Ljubljana, Slovenia
Privacy-first cloud storage. No trackers, GDPR-compliant, EU data centres. 10 GB free.

🇪🇸 Internxt EU Valencia, Spain
Open-source, post-quantum encrypted storage. First cloud service with quantum-resistant encryption.

🇳🇴 Jottacloud EFTA Oslo, Norway
Renewable-energy servers, strong privacy laws. Unlimited storage plans available.

PASSWORD MANAGER

🇨🇭Proton Pass EFTA Geneva, Switzerland
Open-source, independently audited. E2E encrypted. Includes email alias generation.

🇱🇺 Passbolt EU Luxembourg
Open-source, team-focused password manager. API integrations for DevOps workflows.

🇩🇰 Uniqkey EU Denmark
Business-focused, GDPR and NIS2 compliant. Data stored in Germany.

🇩🇪 heylogin EU Germany
No master password needed — confirm logins via smartphone or FIDO2 security key.

GRAPHIC DESIGN & PHOTO EDITING

🇬🇧 Affinity (Serif) UK
Nottingham, England · Founded 1987
Pro-grade design suite (Designer, Photo, Publisher). Adobe alternative. Now free after Canva acquisition.

🇨🇿 Zoner Photo Studio EU Brno, Czech Republic
Full photo management and editing suite for Windows. Long-established European alternative to Lightroom.

SECURITY & ANTIVIRUS

🇸🇰 ESET EU Bratislava, Slovakia · Founded 1992
Europe’s largest privately held cybersecurity company. NOD32 antivirus, endpoint & network security.

🇷🇴 Bitdefender EU Bucharest, Romania · Founded 2001
Award-winning antivirus and endpoint security. 500 million users. Advises Europol’s EC3.

🇬🇧 Sophos UK Oxford, England
Enterprise-grade firewalls, endpoint protection, encryption and managed detection services.

🇫🇮 F-Secure EUHelsinki, Finland
Endpoint, cloud protection, privacy tools and security services for businesses and individuals.

VPN

🇨🇭Proton VPN EFTA Geneva, Switzerland
No-logs VPN from the Proton ecosystem. Open-source, independently audited.

🇷🇴 Bitdefender VPN EU Romania
Included with Bitdefender security suites. Solid performance for everyday privacy use.

PRODUCTIVITY SUITE (OFFICE TOOLS)

🇩🇪 Nextcloud EU Stuttgart, Germany
Self-hosted collaboration platform. Files, calendar, video calls, docs. Used by many EU public bodies.

🇳🇱 Office.eu EU The Hague, Netherlands · Launched 2026
New privacy-first alternative to Microsoft 365. Files, email, calendar, docs — EU infrastructure only.

🇨🇭Infomaniak kSuite EFTA Geneva, Switzerland
“Ethical cloud” with email, calendar, drive, collaboration tools. 100% renewable energy.

BACKUP

🇬🇧 IceDrive UK Wales, United Kingdom
GDPR-committed cloud storage and backup. Twofish encryption, lifetime storage plans, good desktop app.

🇨🇭Proton Drive EFTA Geneva, Switzerland
End-to-end encrypted file storage and backup. Zero-access architecture. Part of the Proton ecosystem.

A few caveats on ownership/acquisition:

  • Affinity (UK, Nottingham) was acquired by Australian company Canva in 2024. It remains developed in the UK and is now free, but Canva is the parent company.
  • Bitdefender is Romanian in origin but has significant US operations and dual-headquartering. It’s still widely considered a European company.
  • Avast (Czech Republic) was also popular but merged with NortonLifeLock in 2022, making it no longer independently European.

Strong recommendations if you want a purely EU/EFTA stack:

  • Proton ecosystem (Switzerland) is arguably the most coherent all-in-one — covering email, VPN, drive, calendar, and password manager from a single Swiss provider.
  • Tuta (Germany) is the best pure-EU encrypted email alternative.
  • ESET (Slovakia) is the gold standard for security software that’s genuinely European.