Removing US providers from the mandatory chain: what it took

When the WE BUILD consortium wrote "no US tech" into its requirements, meeting it took the better part of a year. That surprised some people, because Open Social was never built on American cloud services. Bram ten Hove, CTO and one of the founders of Open Social, explained at the Open Social Summit '26 what it actually involved.

A deliberate starting point

Open Social is open source and built on Drupal. It has been hosted ao through Upsun, a French company, for more than ten years, with data kept in the region a client chooses. The platform also avoids services that exist at only one cloud provider, using standard interfaces throughout. That choice is what made a move like this possible at all.

Still, two US companies sat in the path of every request: Cloudflare as the content delivery network, firewall and DDoS protection, and SendGrid for every notification, digest, invite and password reset. Other US services in the stack, such as video hosting or push notifications, are opt in. These two were not.

From location to jurisdiction

The sovereignty question has moved from where data is stored to whose law reaches it. Europe has had three legal bases for data transfers to the US in eleven years: Safe Harbour, annulled in 2015, Privacy Shield, annulled in 2020, and the Data Privacy Framework, which is now under challenge. For organisations with strict requirements, a mandatory provider under another jurisdiction is a risk they have to account for.

How we migrate

Replacing a provider is quick to start and slow to do well. The process has five steps: inventory every service and the data it touches, select an alternative that matches on what clients notice, build the new path alongside the old one, test it under real load and failure, and switch in stages with a way back at every step.

Email shows why each step matters. Since the start of 2021 the platform has sent more than 65 million emails, close to a million of them in September alone. A new sending service starts without a reputation, so volume has to grow gradually, bounce and complaint handling has to work exactly as before, and every client domain has to stay authenticated. Email is moving to AhaSend, a Dutch company processing in Germany and Finland, with data staying in the EEA.

The edge handles between 20 and 40 million requests a month and is moving to Bunny, a Slovenian company. Every firewall and rate limit rule was rebuilt and tested before traffic moved. The move also brought an option we had not planned for: traffic can now be kept entirely inside European data centres for organisations that need it.

The paperwork follows the architecture

Both migrations will be complete before the end of 2026. From then on there are no US companies in the mandatory chain: hosting, edge, email, backups, monitoring and build. The updated data processing agreement and subprocessor list were shared with clients before the summer.

Every other service is assessed the same way: what data it can reach, whose law applies to the company behind it, how many clients it affects, and whether they can switch it off. Gaia AI runs on Mistral by default, processing in Sweden, Norway and the Netherlands, with client data contractually excluded from training, and organisations can connect their own model instead.

3 ways to deploy

Some organisations need more control than a managed service offers. Open Social can run as managed SaaS, in a client's own cloud managed by us, or in a client's own cloud operated entirely by them. The European Commission operates ECP SaaS on its own infrastructure. GovTech Deutschland runs Open Social on Codesphere, with no data flowing back to us. The right choice depends on each organisation's requirements and risk appetite, and all three are available today.

See it for yourself

If you run a network of organisations and want to see how this works in practice, request a demo.