Assumed audience

Citizens curious about where their national government's data is sitting. Digital policy people, public sector IT staff, and anyone working on European sovereignty. No deep technical knowledge is needed.

Following my blog post about the sovereignty of Belgian municipalities, I wanted to take a higher-level look.

Now that we've seen how local governments fare (at least in Belgium), what about national ones? These are the institutions that should be pushing for sovereignty.

This is a review of the national government websites of Europe. When a citizen portal is available, I use that first. If there is none, I point the scanner at the main government website.

Contents

1. What I analysed
   1. The process
   2. The criteria
2. The results
   1. Sovereignty score
   2. Email
   3. Hosting
   4. Third-party resources
   5. Registrars & DNS
   6. SSL certificates
   7. Conclusion
   8. Full results table

What I analysed

The process

Note: the process is near-identical to the one I used for the Belgian municipality scan. If you've already read about it there, feel free to skip straight to the results.

Each national government website got a digital sovereignty score assembled from a series of criteria, each weighted by its relative importance.

I ran the 32 European national government websites through my sovereignty scanner (you can try it on your own site here).

In the results, I consider a service "European" if the company operating it has its legal headquarters in Europe. That means EU member states, but also the UK, Switzerland, Norway and Iceland, who share similar data protection frameworks and legal traditions with the EU.

What really counts is jurisdiction, not where the servers are physically located. A US-headquartered vendor counts as non-European even if its data centre is in Frankfurt. This is due to laws like the CLOUD Act.

A few caveats: this is not gospel, and certainly not scientific research. A government may rely on plenty of potentially non-European tools that simply don't show up in a scan like this; like cloud storage or video conferencing. Some elements might be misidentified, others missed completely. Please read the post in that spirit.

It's also a snapshot (currently from August 17th 2026) – things change.

The criteria

Email provider 25%

Email is one of the most sensitive layers and one of the hardest to migrate once it's entrenched.

The government's email provider is detected via various means (MX, SPF, autodiscover…) and rated based on its legal jurisdiction.

Website host 25%

This detects where the government website and, by extension data, lives, legally speaking.

This is done via looking up the hosting provider's ASN (autonomous system number) and figuring out what organisation is behind it. This tells me which legal entity is operating the infrastructure, not just the physical location of the server.

A server located in Europe but operated by a US cloud provider, for example, will be considered non-European.

If a service like Cloudflare is sitting in front of the website, it counts as a point of foreign control, even if the origin host is located in Europe.

Domain registrar 15%

The registrar controls the domain itself. It's where you renew it, transfer it, or… have it seized or suspended under a foreign legal order.

This doesn't weigh as much as email and hosting because losing your registrar is disruptive, but will rarely expose citizen data etc.

This one is a control risk rather than a privacy one.

DNS (domain name system) host 10%

This checks who operates the authoritative name servers for the domain. What these do is answer "where is this government's website/email server located?" when a device looks them up.

This gets scored by jurisdiction like the rest. It's weighted lower because switching DNS providers is relatively simple compared to, say, email.

SSL certificate 5%

The SSL certificate is responsible for the encryption of a citizen's connection to a website. That's what the padlock in the browser address bar indicates.

The authority responsible for issuing these certificates is the least important of all the categories tracked here. They're easy to swap and I include them mainly for completeness.

Third-party resources 20%

Modern websites rarely stand on their own and this includes government sites.

They load all manner of things from external (third-party) servers: fonts, analytics scripts, chat widgets, social media trackers, and so much more.

Each one of those is a potential exit path for visitor data to leave Europe, regardless of where the site itself is hosted.

These resources are scanned and, for the most part, identified using a local database complemented by Ghostery's TrackerDB.

The score is then established based on the proportion of these resources that are European or not.

The results

A full table of all results is included at the bottom of this post.

Sovereignty score

The scores start at 3.9 (Malta – the worst) and go up to 100 (Austria, Germany, Hungary, Luxembourg, Latvia and Romania – all tied at the top), with an average of 63.1 out of 100.

It's far from perfect, but it's better than the average of 49.2 from the Belgian municipalities scan. National governments should have more awareness of sovereignty issues, so that does make sense.

The spread is wide, though. Here are the best and worst:

The countries sitting at the top all run their own email and hosting infrastructure. No Microsoft, Amazon, Google, or Cloudflare. Proof that it's perfectly feasible.

At the other end, Malta (3.9) and Iceland (5.9) are pretty much running their online infrastructure through the US. Portugal (11.8) and the UK (15.4) aren't that far behind.

Email

Email is interesting here: 75% of national governments host their email at a European provider. A lot better than what I've seen on a local level (for example: only 12.1% in Belgium were European).

We're still nowhere near perfection, however. Microsoft 365 is the email platform of choice for 8 out of 32 governments. So, 25% of national governments' internal and citizen emails go through a US-headquartered provider.

The countries doing well mostly seem to run their infrastructure through their own government IT agencies: Bundesrechenzentrum for Austria, Statens IT for Denmark, DILA for France,… The rest is mostly a mix of self-hosted setups.

Hosting

Where hosting is concerned, the situation isn't as good: 56.3% score European.

Cloudflare sits in front of 5 out of 32 government sites. Even when the server behind it is European, Cloudflare's position in front counts as a point of foreign control where traffic is handed off in an unencrypted state. AWS, Azure and Akamai host a few more and probably some of the ones hidden behind cloudflare (see below).

These are governments that have explicitly chosen US hyperscalers for their website (or believed their "European sovereign cloud" marketing).

For the 7 sites sitting behind a proxy like Cloudflare, I tried to guess the origin host by using historical data. This is a low-confidence guess and should be taken as directional at best.

Third-party resources

Among every type of third-party resource, not just analytics, these five turn up the most. As always, Google dominates.

What's notable is the non-European resource count: 83 non-EU resources across 32 government websites. That's out of 128 total resources detected. Roughly two-thirds.

Analytics

Analytics-wise, Google dominates here as well. But self-hosted Matomo instances have a very respectable second place. Microsoft Clarity makes an appearance too.

Registrars & DNS

Registrars are the category most often unknown, with 11 of 32 governments not exposing registrar info in a way the scanner can pick up. Of those identified, 62.5% are European. The undetected ones are probably European too, national registrars seem to hide better than regular ones.

DNS tells a similar story: 81.3% European, with Cloudflare being the most common non-European provider. When Cloudflare sits in front of a site, they typically handle DNS too, merging two categories into one foreign dependency.

SSL certificates

Only 25% of certificates are European. DigiCert, an American company, dominates the ranking with 6 of 32 governments using it. Amazon Trust Services (4) and Sectigo (3) follow next.

Harica, a Greek certificate authority, is the only European player with a meaningful presence. As for municipalities, this is the lowest-weighted category because switching certificate authority is relatively trivial.

Conclusion

So, what's the take-away? With an average score of 63.1/100, European national governments are above-average. Certainly compared to municipal websites in Belgium, anyway.

Email, the heaviest category, is decent at 75% European. National governments have the institutional capacity to run their own email, and many do. This is in stark contrast to municipalities where Microsoft 365 dominates (at least in the countries I tested).

Hosting, on the other hand, is not great at 56.3% European. That's actually worse than the municipalities I tested. National governments are more likely to have adopted US hyperscalers or stuck Cloudflare in front of their sites.

Registrars and DNS are mixed bags. SSL is predictably American-dominated but it's also low-stakes.

The countries at the top of the scoreboard mostly run their own IT infrastructure through dedicated government agencies. A few buy local.

The ones at the bottom lean heavily on Microsoft and US clouds. Malta practically being a US-dependency.

Defaults are sticky, even for governments.

Conclusion? Could do better and be an example.

Data collected August 2026 with my digital sovereignty scanner.
Found an error or an outdated result for your country? Let me know.

Assumed audience

Residents curious about where their local municipality's data is actually located. Local officials or municipal staff who want a starting point for questions to their IT providers. Policy and privacy people in the European digital sovereignty space. No deep technical knowledge is needed.

Welcome to the first post in this blog. I wanted somewhere to write more in depth articles than my daily email, and this is where it will happen. First up: digging into the sovereignty of our local administrations.

I've seen multiple mentions of Belgium being a bad pupil as far as digital sovereignty goes. Not that I think any European country deserves a gold star for this one, but, living here, I was curious enough to want to dig deeper.

The only data I could find concerned email. So, having already built a scanner for this exact purpose, I decided to point it at every Belgian municipality to get a better picture.

What follows is what I found out. Take it as a signal, not a verdict.

Note: for simplicity, I use municipality to refer to the administrative entities known in Dutch as gemeenten and in French as communes.

Contents

1. What I analysed
   1. The process
   2. The criteria
2. The results
   1. Sovereignty score
   2. Email
   3. Hosting
   4. Registrars
   5. DNS
   6. SSL certificates
   7. Third-party resources
   8. Conclusion
   9. Full results table

What I analysed

The process

Each municipality got a digital sovereignty score assembled from a series of criteria, each weighted by its relative importance.

I did this by running all 565 current Belgian municipalities through my sovereignty scanner (you can scan your own site here). One, Herstappe, has no standalone website as far as I can tell, so was skipped; 564 returned a usable result.

In the results, I consider a service "European" if the company operating it has its legal headquarters in Europe. That means EU member states, but also the UK, Switzerland, Norway and Iceland, who share similar data protection frameworks and legal traditions.

What really matters is jurisdiction, not wherever the servers are physically located. A US-headquartered vendor counts as non-European even if its data centre is in Frankfurt. This is because of laws like the CLOUD Act.

A few caveats: this is not gospel, and certainly not scientific research. A municipality may rely on plenty of potentially non-European tools that simply don't show up in a scan like this, such as cloud storage or video conferencing. Some elements might be misidentified, others missed completely. Please read it in that spirit.

It's also a snapshot (currently from August 6th 2026), things change.

The criteria

Email provider, including email marketing tools 25%

Email is one of the most sensitive layers and one of the hardest to migrate once it's entrenched.

The municipality's email provider is detected via various means (MX, SPF, autodiscover…) and rated based on its legal jurisdiction.

Email marketing/newsletter tools are also detected since these often expose the same (citizen) data.

Side note: email marketing detection sometimes surfaces multiple services, since old configurations tend to linger on long after a service has been dropped.

Website host 25%

This detects where the municipality's website and, by extension data, lives, legally speaking.

This is done via looking up the hosting provider's ASN (autonomous system number) and figuring out what organisation is behind it. This tells me which legal entity is operating the infrastructure, not just the physical location of the server.

A server located in Europe but operated by a US cloud provider, for example, is considered non-European.

If a service like Cloudflare is sitting in front of the website, it counts as a point of foreign control, even if the origin host is in Europe.

Side note: this detects the actual infrastructure owner. Many smaller web hosting companies lease space from these larger entities and will not show up themselves. For example: sites hosted by LCP show up as Datacenter United, where the actual servers are.

Domain registrar 15%

The registrar controls the domain itself. It's where you renew it, transfer it, or… have it seized or suspended under a foreign legal order.

This doesn't weigh as much as email and hosting because losing your registrar is disruptive, but will rarely expose citizen data etc.

This one is a control risk rather than a privacy one.

DNS (domain name system) host 10%

This checks who operates the authoritative name servers for the domain. What these do is answer "where is this municipality's website/email server located?" when a device looks them up.

This gets scored by jurisdiction like the rest. It's weighted lower because switching DNS providers is relatively simple compared to, say, email. A municipality could probably do it in an afternoon without touching anything else.

SSL certificate 5%

The SSL certificate is responsible for the encryption of a citizen's connection to a website. That's what the padlock in the browser address bar indicates.

The authority responsible for issuing these certificates is the least important of all the categories tracked here. They're easy to swap and I include them mainly for completeness.

A fully sovereign setup would ideally have a European certificate too but, in the grand scheme of things, this is a detail.

Third-party resources 20%

Modern websites rarely stand on their own and this includes municipality sites.

They load all manner of things from external (third-party) servers: fonts, analytics scripts, chat widgets, social media trackers, and so much more.

Each one of those is a potential exit path for citizen's data to leave Europe, regardless of where the site itself is hosted.

These resources are scanned and, for the most part, identified using a local database complemented by Ghostery's TrackerDB.

The score is then established based on the proportion of those resources that are European or not.

This is weighted second-highest below email and hosting, because it's the category most often overlooked. A site could be sovereign on its own but leak visitor data to dozens of other places.

The results

A full table of all results is included at the bottom of this post.

Sovereignty score

Scores range from 11.8 (Antoing, Verlaine, Malmedy and Vresse-sur-Semois, all tied at the bottom) to 94.1 (Lubbeek), with an average of 49.2 out of 100. No one gets top marks but I don't think there are any lost causes either.

Ties are common at both ends, so here are the 5 highest and 5 lowest scores:

The regional split is interesting: Wallonia averages 38.6, against 58.4 for Flanders and 59.2 for Brussels. It shows up province by province too: Walloon Brabant, Hainaut, Liège, Luxembourg and Namur all sit in the 30s, while every Flemish province sits above 55.

I'm guessing shared regional IT service providers (some seem to specialise in local municipalities) explain a good portion of this.

Email

Microsoft 365 alone accounts for 483 of 564 municipalities.

That means 86% of all municipalities are running their citizens' and internal correspondence through a US-headquartered provider.

That leaves only 12.1% of municipal email setups scoring as European overall. The rest is a long tail of small, mostly Belgian, self-hosted or regional providers. A rounding error, basically.

Email-marketing-wise, the top tool is French: Brevo (ex-SendInBlue). Globally, Mailchimp still dominates but, in some European markets – and that seems to include Belgium – Brevo has overtaken the big chimp.

Hosting

Hosting has a more even split. 59% score European, mostly thanks to Belgian hosts like Datacenter United, Combell and Level27 being quite popular.

The complication is Cloudflare. It sits in front of 192 municipal sites as a US-controlled reverse proxy. Even when the actual server behind it is Belgian, Cloudflare's position in front counts as a point of foreign control where traffic is handed off unencrypted.

For the 172 sites sitting behind a service like cloudflare, I tried to guess the origin host by using historical data. This is a low-confidence guess and should be taken as directional at best.

Still, you can see OVH, a French webhost, is quite popular once you rip away the proxy layer, mostly in Wallonia.

Registrars

This one is the closest to being solved: 99.8% of registrars are European, with Belgian players like Combell, Proximus, and LCP covering most of the market. It makes sense, most people will buy a .be from a local reseller. Nice to have one category that's not on fire.

DNS

Same story as for the registrars, and for pretty much the same reason: 95.9% European, dominated by the same handful of Belgian companies that also handle hosting and registration. The exception is when Cloudflare is invoved: using their proxy often implies using their DNS too.

SSL certificates

The numbers look bad here but, in practice, it barely matters: only 2.1% of certificates are European, because 481 municipalities use Let's Encrypt, a free, automated certificate authority that happens to be US-based.

As mentioned before, this is the lowest-weighted category because swapping a certificate authority is trivial, and Let's Encrypt's dominance says more about it being free as well as the default in every hosting control panel than about anyone's sovereignty choices.

If you want free and European, the only alternative is Actalis. And it's far from being as user-friendly.

Third-party resources

Across every type of third-party element, not just analytics, these five turn up the most. The calls to Flanders government resources or iMio (Walloon IT provider for municipalities) make sense. The rest? All US-based.

Analytics-wise, Google dominates, albeit less than across the broader web. No surprise here, it's free and installed without thinking by nearly everyone. Google Analytics is present on 20.2% of all sites, if you add Tag Manager to that, you get to 22.5%.

Matomo comes in at a respectable second place – far higher than across the web at large.

A lot of progress could be made by many municipalities by switching to European alternatives like Plausible or Simple Analytics, or using a self-hosted solution like Matomo. Or they could simply skip analytics entirely. How many municipalities actually act on these numbers?

Zooming out from analytics specifically, we find Google's footprint everywhere. Taking every service it operates into account: fonts, APIs, Tag Manager, reCAPTCHA, Maps, YouTube embeds and the rest; 69.3% of municipalities load something from Google.

Conclusion

So, what can we take away from all of this? With an average score of 49.2/100, Belgian municipalities are pretty much smack dab in the middle. A solid "could do better" in red pen, then.

The two heaviest categories, email and hosting, are very different. Email is close to a lost cause. Only 12.1% are European, everyone else seems to have made a blood pact with Microsoft. Hosting, on the other hand, at 59% European, fares a lot better. This is probably the easiest win for the municipalities still hosting their sites abroad (or hiding them behind Cloudflare).

Registrars (99.8% European) and DNS (95.9%) are, for all practical purposes, solved.

SSL barely matters at all. Let's Encrypt's dominance says more about it being free than about anyone's sovereignty choices. But grabbing a free or cheap European certificate can still move the needle.

Third-party resources are a mess. This is where, even municipalities that get the fundamentals right, have websites silently phoning home to multiple foreign entities. Google being the biggest offender here.

Regionally-speaking, Flanders and Brussels do a bit better across all criteria than Wallonia. Although, email-wise, Wallonia generally does better and, hosting-wise, Flanders comes out on top. Regional IT providers and their choices probably explain a good part of this.

Mostly, what these results show, is what happens when no one questions the defaults. But defaults can be fixed and should be; if only to keep the value circulating locally.