How digitally sovereign are Belgian municipalities?

9 August 2026

Welcome to the first post in this blog. I wanted somewhere to write more in depth articles than my daily email, and this is where it will happen. First up: digging into the sovereignty of our local administrations.

I've seen multiple mentions of Belgium being a bad pupil as far as digital sovereignty goes. Not that I think any European country deserves a gold star for this one, but, living here, I was curious enough to want to dig deeper.

The only data I could find concerned email. So, having already built a scanner for this exact purpose, I decided to point it at every Belgian municipality to get a better picture.

What follows is what I found out. Take it as a signal, not a verdict.

Note: for simplicity, I use municipality to refer to the administrative entities known in Dutch as gemeenten and in French as communes.

Contents

1. What I analysed
   1. The process
   2. The criteria
2. The results
   1. Sovereignty score
   2. Email
   3. Hosting
   4. Registrars
   5. DNS
   6. SSL certificates
   7. Third-party resources
   8. Conclusion
   9. Full results table

What I analysed

The process

Each municipality got a digital sovereignty score assembled from a series of criteria, each weighted by its relative importance.

I did this by running all 565 current Belgian municipalities through my sovereignty scanner (you can scan your own site here). One, Herstappe, has no standalone website as far as I can tell, so was skipped; 564 returned a usable result.

In the results, I consider a service "European" if the company operating it has its legal headquarters in Europe. That means EU member states, but also the UK, Switzerland, Norway and Iceland, who share similar data protection frameworks and legal traditions.

What really matters is jurisdiction, not wherever the servers are physically located. A US-headquartered vendor counts as non-European even if its data centre is in Frankfurt. This is because of laws like the CLOUD Act.

A few caveats: this is not gospel, and certainly not scientific research. A municipality may rely on plenty of potentially non-European tools that simply don't show up in a scan like this, such as cloud storage or video conferencing. Some elements might be misidentified, others missed completely. Please read it in that spirit.

It's also a snapshot (currently from August 6th 2026), things change.

The criteria

Email provider, including email marketing tools 25%

Email is one of the most sensitive layers and one of the hardest to migrate once it's entrenched.

The municipality's email provider is detected via various means (MX, SPF, autodiscover…) and rated based on its legal jurisdiction.

Email marketing/newsletter tools are also detected since these often expose the same (citizen) data.

Side note: email marketing detection sometimes surfaces multiple services, since old configurations tend to linger on long after a service has been dropped.

Website host 25%

This detects where the municipality's website and, by extension data, lives, legally speaking.

This is done via looking up the hosting provider's ASN (autonomous system number) and figuring out what organisation is behind it. This tells me which legal entity is operating the infrastructure, not just the physical location of the server.

A server located in Europe but operated by a US cloud provider, for example, is considered non-European.

If a service like Cloudflare is sitting in front of the website, it counts as a point of foreign control, even if the origin host is in Europe.

Side note: this detects the actual infrastructure owner. Many smaller web hosting companies lease space from these larger entities and will not show up themselves. For example: sites hosted by LCP show up as Datacenter United, where the actual servers are.

Domain registrar 15%

The registrar controls the domain itself. It's where you renew it, transfer it, or… have it seized or suspended under a foreign legal order.

This doesn't weigh as much as email and hosting because losing your registrar is disruptive, but will rarely expose citizen data etc.

This one is a control risk rather than a privacy one.

DNS (domain name system) host 10%

This checks who operates the authoritative name servers for the domain. What these do is answer "where is this municipality's website/email server located?" when a device looks them up.

This gets scored by jurisdiction like the rest. It's weighted lower because switching DNS providers is relatively simple compared to, say, email. A municipality could probably do it in an afternoon without touching anything else.

SSL certificate 5%

The SSL certificate is responsible for the encryption of a citizen's connection to a website. That's what the padlock in the browser address bar indicates.

The authority responsible for issuing these certificates is the least important of all the categories tracked here. They're easy to swap and I include them mainly for completeness.

A fully sovereign setup would ideally have a European certificate too but, in the grand scheme of things, this is a detail.

Third-party resources 20%

Modern websites rarely stand on their own and this includes municipality sites.

They load all manner of things from external (third-party) servers: fonts, analytics scripts, chat widgets, social media trackers, and so much more.

Each one of those is a potential exit path for citizen's data to leave Europe, regardless of where the site itself is hosted.

These resources are scanned and, for the most part, identified using a local database complemented by Ghostery's TrackerDB.

The score is then established based on the proportion of those resources that are European or not.

This is weighted second-highest below email and hosting, because it's the category most often overlooked. A site could be sovereign on its own but leak visitor data to dozens of other places.

The results

A full table of all results is included at the bottom of this post.

Sovereignty score

Scores range from 11.8 (Antoing, Verlaine, Malmedy and Vresse-sur-Semois, all tied at the bottom) to 94.1 (Lubbeek), with an average of 49.2 out of 100. No one gets top marks but I don't think there are any lost causes either.

Ties are common at both ends, so here are the 5 highest and 5 lowest scores:

The regional split is interesting: Wallonia averages 38.6, against 58.4 for Flanders and 59.2 for Brussels. It shows up province by province too: Walloon Brabant, Hainaut, Liège, Luxembourg and Namur all sit in the 30s, while every Flemish province sits above 55.

I'm guessing shared regional IT service providers (some seem to specialise in local municipalities) explain a good portion of this.

Email

Microsoft 365 alone accounts for 483 of 564 municipalities.

That means 86% of all municipalities are running their citizens' and internal correspondence through a US-headquartered provider.

That leaves only 12.1% of municipal email setups scoring as European overall. The rest is a long tail of small, mostly Belgian, self-hosted or regional providers. A rounding error, basically.

Email-marketing-wise, the top tool is French: Brevo (ex-SendInBlue). Globally, Mailchimp still dominates but, in some European markets – and that seems to include Belgium – Brevo has overtaken the big chimp.

Hosting

Hosting has a more even split. 59% score European, mostly thanks to Belgian hosts like Datacenter United, Combell and Level27 being quite popular.

The complication is Cloudflare. It sits in front of 192 municipal sites as a US-controlled reverse proxy. Even when the actual server behind it is Belgian, Cloudflare's position in front counts as a point of foreign control where traffic is handed off unencrypted.

For the 172 sites sitting behind a service like cloudflare, I tried to guess the origin host by using historical data. This is a low-confidence guess and should be taken as directional at best.

Still, you can see OVH, a French webhost, is quite popular once you rip away the proxy layer, mostly in Wallonia.

Registrars

This one is the closest to being solved: 99.8% of registrars are European, with Belgian players like Combell, Proximus, and LCP covering most of the market. It makes sense, most people will buy a .be from a local reseller. Nice to have one category that's not on fire.

DNS

Same story as for the registrars, and for pretty much the same reason: 95.9% European, dominated by the same handful of Belgian companies that also handle hosting and registration. The exception is when Cloudflare is invoved: using their proxy often implies using their DNS too.

SSL certificates

The numbers look bad here but, in practice, it barely matters: only 2.1% of certificates are European, because 481 municipalities use Let's Encrypt, a free, automated certificate authority that happens to be US-based.

As mentioned before, this is the lowest-weighted category because swapping a certificate authority is trivial, and Let's Encrypt's dominance says more about it being free as well as the default in every hosting control panel than about anyone's sovereignty choices.

If you want free and European, the only alternative is Actalis. And it's far from being as user-friendly.

Third-party resources

Across every type of third-party element, not just analytics, these five turn up the most. The calls to Flanders government resources or iMio (Walloon IT provider for municipalities) make sense. The rest? All US-based.

Analytics-wise, Google dominates, albeit less than across the broader web. No surprise here, it's free and installed without thinking by nearly everyone. Google Analytics is present on 20.2% of all sites, if you add Tag Manager to that, you get to 22.5%.

Matomo comes in at a respectable second place – far higher than across the web at large.

A lot of progress could be made by many municipalities by switching to European alternatives like Plausible or Simple Analytics, or using a self-hosted solution like Matomo. Or they could simply skip analytics entirely. How many municipalities actually act on these numbers?

Zooming out from analytics specifically, we find Google's footprint everywhere. Taking every service it operates into account: fonts, APIs, Tag Manager, reCAPTCHA, Maps, YouTube embeds and the rest; 69.3% of municipalities load something from Google.

Conclusion

So, what can we take away from all of this? With an average score of 49.2/100, Belgian municipalities are pretty much smack dab in the middle. A solid "could do better" in red pen, then.

The two heaviest categories, email and hosting, are very different. Email is close to a lost cause. Only 12.1% are European, everyone else seems to have made a blood pact with Microsoft. Hosting, on the other hand, at 59% European, fares a lot better. This is probably the easiest win for the municipalities still hosting their sites abroad (or hiding them behind Cloudflare).

Registrars (99.8% European) and DNS (95.9%) are, for all practical purposes, solved.

SSL barely matters at all. Let's Encrypt's dominance says more about it being free than about anyone's sovereignty choices. But grabbing a free or cheap European certificate can still move the needle.

Third-party resources are a mess. This is where, even municipalities that get the fundamentals right, have websites silently phoning home to multiple foreign entities. Google being the biggest offender here.

Regionally-speaking, Flanders and Brussels do a bit better across all criteria than Wallonia. Although, email-wise, Wallonia generally does better and, hosting-wise, Flanders comes out on top. Regional IT providers and their choices probably explain a good part of this.

Mostly, what these results show, is what happens when no one questions the defaults. But defaults can be fixed and should be; if only to keep the value circulating locally.