European is not a status. It is a subscription.

The question we are asked most often in advisory conversations is: "Is this vendor European?" It is a reasonable question, it is well meant — and it is the wrong one. Not because the answer does not matter, but because it has a shelf life nobody can see.

Three weeks, three European vendors

In November 2023 the California company Kiteworks acquired three vendors within a few weeks: ownCloud GmbH of Nuremberg, DRACOON GmbH of Regensburg, and Maytech of the United Kingdom. Three names that until then appeared on every European shortlist for safe file storage. After the acquisitions, the parent companies answer to US law, with everything that follows from it — from the US CLOUD Act to export controls.

Anyone who justified a 2022 procurement decision with "German vendor" was right. Anyone who had to defend the same decision in 2024 had nothing left to hold.

The pattern is older and wider

This was not an outlier. It is the rule, only rarely so concentrated.

Pipedrive, founded in Tartu in 2010 and long treated as an Estonian flagship, took a majority investment from Vista Equity Partners of Texas in November 2020. Its headquarters is now in New York. The CRM still appears on European alternative lists today.

Affinity, the British toolset with which a whole generation of designers escaped the Adobe subscription, went to Canva in Australia in March 2024 for around 380 million dollars.

MariaDB — descended from MySQL, Finnish roots, listed in Ireland — was taken over completely by K1 Investment Management of California in September 2024 and delisted. The price was roughly 37 million dollars. For a database a substantial part of European mid-sized business runs on.

Silo AI of Helsinki, at the time of the deal the largest private AI research institute in Europe, was bought by AMD in July 2024 for 665 million dollars.

Four years, five cases, one pattern.

Why this happens without anyone acting in bad faith

European software is financed mostly by venture capital, and venture capital needs an exit. The parties who command the sums paid at such an exit are mostly based in the United States. That is not a conspiracy, it is a capital structure. It will not change because we keep better lists.

Which means: headquarters is a snapshot, not a property. It describes the state of things on the day you looked it up, not a characteristic of the product.

What does not change on acquisition day

At ownCloud the source code stayed open. Anyone running the software themselves could keep running it the day after the announcement, the data stayed in-house, and migrating to another tool was a scheduling question rather than an existential one.

For a closed subscription product the same day looks different. Nothing changes on the surface and everything changes legally — and what you can do about it is written exclusively in the contract you signed three years ago.

That is the real difference. Not the flag, but the price of leaving. That price is exactly what Vendor lock-in describes, and every workable Exit strategy hangs on it.

The three questions we ask instead

First: can I get all my data out today, without asking the vendor? Not according to the contract — in practice. Export it once, open the export, check whether attachments, relations and history came along. The EU Data Act has improved the legal side of this considerably since September 2025. It does not tell you whether your export is usable.

Second: could somebody else operate this if the vendor disappeared tomorrow? For open-source software you can host yourself, the answer is yes, if necessary with a different service partner. For an open format with several vendors in the market, also yes. Otherwise, no. Open standards here are not an ideal, they are insurance.

Third: what would switching cost in hours? Not in euros — in working hours of your own people. That number has to be estimated and then tested at least once on a small part of the system. Whoever does not know it does not know their negotiating position at the next price increase.

The uncomfortable ranking

Take those three questions seriously and an order emerges that parts of our industry dislike:

1. 01Open source and self-hostable — regardless of where the vendor sits.
2. 02Open format, several vendors in the market, documented import.
3. 03European vendor with a closed format.
4. 04Non-European vendor with a closed format.

Point 1 outranks point 3. Concretely: a US-developed open-source tool running on your own server is, by this measure, better than a European subscription product you cannot leave without the vendor's help. It contradicts the gut feeling. It survives the five cases we just walked through.

The counter-check

The flag does not carry the other direction either. Delos Cloud is an SAP subsidiary, built for German public administration, operated by German staff — and technically running on licensed Microsoft Azure technology. Sovereignty there comes from the contract and the operating model, not from independent technology. That can be an entirely correct decision. You should simply know which kind of safety you bought, before the situation arrives in which the difference counts.

What we actually recommend

Keep an ownership register. A table, eight to twelve rows; no company under 250 people needs more. Six columns per critical tool: product, parent company, owner, last change of ownership, export path, last successful test export.

Go through it twice a year. It takes about ninety minutes. Company registers are public, the investment announcement sits on the buyer's own website, and the line "last successful test export" tells you more about your position than any certificate.

If it turns out that three of your most important tools have changed hands in the past five years, that is no reason to panic. It is the normal state of the market — and the only durable response is to know the cost of leaving before somebody else sets the price of staying.