Sovereign software: developed in Europe, for Europeans

What sovereign software means in Europe: openDesk, LaSuite, Nextcloud, CryptPad, BlueMind, Proton, Euro-Office and Romania’s opportunity — beyond “the server is in the EU”.

Europe is starting to ask a question that, for two decades, it treated more as a secondary problem: who controls the digital infrastructure on which European administrations, companies and citizens’ data run?

Computers can be bought from any part of the world, cloud services can seemingly operate without borders, and applications can be accessed from a browser regardless of where the server sits. Yet behind this simplicity lies a more complicated reality. Data is stored somewhere, software belongs to someone, updates are controlled by someone, licences can change, services can be withdrawn, and access to information is subject to a particular jurisdiction.

This is where the notion of sovereign software appears more and more often.

It is not about isolating Europe from global technology, nor about every country writing its own operating system. Digital sovereignty means, first of all, the capacity to decide: where the data is, who can access it, who can modify the software, whether it can be moved to another provider, and whether the organisation can keep operating even when the relationship with the original provider ends.

In June 2026, the European Commission again placed this issue at the centre of European technology policy, through initiatives aimed at strengthening technological sovereignty and developing open, interoperable digital ecosystems. The Commission speaks explicitly about reducing dependence on non-EU providers and increasing the role of open-source solutions in public administrations.

Sovereign does not only mean “the server is in Europe”

One of the most common confusions is equating sovereignty with data localisation.

A company may say that its data is hosted in a data centre in Frankfurt, Paris or Amsterdam. That matters, but it is not enough.

Other questions must also be asked. Who controls the company providing the service? Under which law does it operate? Can the software be installed on your own infrastructure? Can the data be exported in a standard format? Can the provider be changed without rebuilding the entire system? Can the code be audited? Are there alternatives for maintenance and support?

Truly sovereign software must reduce what the industry calls vendor lock-in — the situation in which the client becomes so dependent on one provider that changing them becomes extremely difficult or costly.

That is exactly why open source, open standards and interoperability appear permanently in the European strategy.

The European Commission has had an open-source software strategy since 2000. Over time it has led, among other things, to recommending Linux for servers and using Apache in European web infrastructure. Later, the European Union created its own open-source licence, the European Union Public Licence — EUPL, available in 22 European languages.

In its open-source strategy, the Commission uses a relevant phrase: “stay in control”. The objective is precisely the ability of European institutions to remain in control of their processes, data, information and technology.

Germany is building a sovereign digital workplace: openDesk

One of the most concrete European examples is openDesk.

Instead of the German administration depending exclusively on a single commercial ecosystem for email, documents, video conferencing, files and collaboration, Germany is developing a platform that groups open-source applications into a single interface.

openDesk comes from the “Sovereign Workplace” project initiated by the German Federal Ministry of the Interior. Since 2024, development has been coordinated by ZenDiS — Zentrum für Digitale Souveränität, a company owned by the German federal government and created specifically to strengthen the digital sovereignty of public administration.

The platform offers functions employees would expect from a modern productivity suite: documents, email, calendar, contacts, chat, video conferencing, file storage, projects, tasks, knowledge management and identity management.

The fundamental difference is not only the interface.

openDesk is built around open-source applications, open standards and open interfaces; it is modular and can be operated independently of a single provider.

This is sovereignty applied in practice. The institution does not only buy temporary access to a service. It keeps a real capacity for control over the technology ecosystem it uses.

France responds with LaSuite

Germany is not alone.

France is developing LaSuite numérique, a collection of digital tools for French public administration.

LaSuite includes applications for document editing, file exchange, messaging, video conferencing, data management and even artificial intelligence tools.

The project’s declared principles are highly relevant to what digital sovereignty means: data hosted in France, open-source technologies, security and interoperability. The platform states explicitly that it is built “with and for the public service”.

DINUM, the government structure responsible for the French state’s digital strategy, explicitly aims to strengthen digital sovereignty and develop open, interoperable and secure solutions. France also collaborates with Germany to build a European digital ecosystem that reduces dependence on major technology platforms outside Europe.

This is an important signal.

Digital sovereignty is no longer treated only as a national security issue. It is becoming a matter of day-to-day productivity.

Email, Word documents, presentations, video calls and files may look like ordinary tools. But if an entire administration’s activity depends on them, then the office infrastructure becomes strategic infrastructure.

Nextcloud: the European alternative for files and collaboration

Another well-known example is Nextcloud, a company founded in Germany.

Nextcloud develops an open-source platform that can be installed on an organisation’s own infrastructure and can offer file storage, collaboration, communications, calendar, contacts, video conferencing and integration with office suites.

The company states that its entire product is open source and emphasises open standards, data export and avoiding proprietary formats that lock the user into a single platform.

Nextcloud is not only an experimental project for a few small servers. The platform is used by administrations, universities and companies. In 2026, among other examples, the company announced a deployment for about 1,200 employees of an Austrian federal ministry and a project through which around 100,000 researchers, teachers and students at Dutch universities were to use Nextcloud services via the SURF organisation.

More interesting still is that Nextcloud is also working toward sovereign AI. A project with the German state of Schleswig-Holstein aims to develop AI technologies for administration that can run locally and process sensitive information without sending it to external services.

This may become one of the most important components of digital sovereignty in the coming years.

It will no longer be enough to know where documents are stored. We will also need to know who reads the documents when we analyse them with artificial intelligence.

CryptPad and XWiki: European collaboration with privacy by design

France also offers other interesting examples.

XWiki is an independent European company, founded in 2004, with teams in France and Romania. It develops open-source software for information management and collaboration and states that its shareholders are employees, former employees and open-source contributors.

From the XWiki ecosystem comes CryptPad, a collaborative suite that offers documents, spreadsheets, presentations, forms, Kanban and other tools.

Its particularity is a “zero knowledge” architecture: data is encrypted so that the server hosting the application cannot normally read the content of users’ documents. The software is open source and can be installed independently.

CryptPad is also a very good example of the idea of “public money, public code”: the project has received French and European funding and supports the principle that public money used to develop software should produce publicly reusable software.

BlueMind: even email can be sovereign

Email is probably one of the hardest services to replace in an organisation.

For years, companies and institutions built their flows around Microsoft Exchange and Outlook. Changing the platform can affect thousands of users.

The French company BlueMind tries to solve exactly this problem.

BlueMind develops an open-source platform for email, calendar, contacts and collaboration, designed as a European alternative and including Outlook compatibility. The company presents its product as a French, open-source solution without external technological dependence.

The importance of such a project is not only that another email application exists. It shows that digital sovereignty must also take into account user experience.

You cannot convince millions of European users to adopt sovereign software if it is much harder to use than established alternatives.

Sovereignty without ergonomics risks remaining a technical project.

Proton: a European example from outside the European Union

Europe is larger than the European Union.

An interesting example is Proton, a Swiss company known for Proton Mail, Proton Drive, Proton VPN, Proton Calendar and other privacy-focused services.

Proton states that its infrastructure and data are located legally and physically in Switzerland and that the company is subject to Swiss law.

The example matters because it shows that “European” and “European Union” are not synonyms.

For a client pursuing digital sovereignty, the exact applicable jurisdiction must be analysed — not only the continent where the company sits.

Euro-Office: Europe is also trying to build the office alternative

In March 2026 the Euro-Office initiative was also announced, the result of collaboration among several European organisations, including IONOS, Nextcloud, XWiki, OpenProject and other actors in the open-source ecosystem.

The declared objective is to develop a European suite for editing documents, spreadsheets and presentations, with high compatibility and without structural dependence on a single global corporation.

This is another sign that the market is changing.

For many years the question was: “Is there a European alternative?”

From 2025–2026, the question is increasingly becoming: “Which European alternative do we choose, and how do we integrate it?”

Romania should not remain only a consumer

This is where an important opportunity appears for Romania as well.

Sovereign software does not mean that every state must recreate Nextcloud, Linux, a database and an office suite from scratch.

A Romanian product can use European and international open-source components, while keeping control over architecture, data, installation and its own development.

For example, a Romanian DMS for companies and administrations can be installed on the beneficiary’s server or in a European cloud, store documents in standard formats, offer open APIs, export data completely and use local AI for document classification, OCR, semantic search or automatic information extraction.

In such a system, an official filing can have a registration number, a main document and several annexes. Supporting documents that do not need registration can stay associated with the file without artificially receiving a registry number. AI can automatically identify document type, sender, date, tax ID or an invoice amount, but the final decision and the data remain under the organisation’s control.

This would be much closer to the idea of sovereign software than simply moving an American service onto a server physically located in Bucharest.

A product such as InitWin Docs, developed in Romania, can follow this direction: local control over documents, dedicated installation for each organisation, interoperability, avoiding closed formats and integrating an AI component that can also run locally. In that case, the European component would not be only a marketing label, but an architectural choice. For Nextcloud-based storage and collaboration, see also INITWIN Cloud.

Open source does not automatically mean sovereignty

An important clarification is needed, however.

Open-source software is not automatically sovereign.

An organisation can install an open-source application and still depend on a foreign cloud service, a proprietary authentication system, an external AI API or a single provider that holds all the expertise needed to operate the system.

Likewise, software made by a European company is not automatically sovereign if it uses formats that cannot be exported, infrastructure controlled from outside Europe or licensing mechanisms that make migration impossible.

Sovereignty is the result of the entire chain.

• Code matters.
• Infrastructure matters.
• Jurisdiction matters.
• Data formats matter.
• Digital identity matters.
• AI matters.
• The commercial contract matters.
• The ability to move the system matters.

This is why the Interoperable Europe Act, which entered into force on 11 April 2024, places such importance on interoperability, reuse of solutions and cooperation among European administrations.

European software must also be good

There is also a less comfortable truth.

No European strategy will succeed if users are asked to accept products that are slower, more complicated or visibly inferior only because they are European.

Sovereign software must compete.

It needs modern interfaces, good mobile apps, fast document preview, intelligent search, real-time collaboration, integration with existing systems and AI.

An administration should not have to choose between sovereignty and productivity.

A company should not have to choose between data protection and a good experience for employees.

This is the real challenge for the European software industry: to turn sovereignty principles into a competitive advantage, not a restriction.

From “cloud first” to “control first”

The last decade was dominated by the phrase “cloud first”.

The next one could be better characterised by “control first”.

Organisations will continue to use cloud services, international software and technologies developed across multiple continents. Digital sovereignty does not mean building technological walls around Europe.

It does, however, mean that an alternative exists.

• If an administration, hospital, strategic company or university decides that certain information must not leave its infrastructure, it must have the necessary technology.
• If it wants to change cloud operator, it must be able to do so.
• If a provider raises prices or changes contractual terms, the client must have an exit path.
• If artificial intelligence analyses millions of confidential documents, the organisation must know exactly where the information goes and who controls the model.
• And if a solution is funded with public money, Europe increasingly asks why that code could not be reused by other institutions.

These are the questions behind the concept of sovereign software.

Europe already has many of the necessary components: openDesk in Germany, LaSuite in France, Nextcloud, XWiki and CryptPad, BlueMind, Proton in Switzerland and new initiatives such as Euro-Office. In parallel, the European Union is building the legal and political framework for interoperability and open digital ecosystems.

So European sovereign software is no longer only an idea about the future.

It is beginning to exist.

The next stage is for European administrations and companies to buy it, implement it and — perhaps most importantly — for European firms to keep developing it.