Flags don't count

Time for another rant about services advertising their European credentials and it all turning out to be a giant fib.

I received an email from someone planning to migrate their small business to sovereign European services. They’d shortlisted four candidates for the first phase and wanted a gut check.

Only one was fully European.

The other three were sending personal data to foreign sub-processors. Two of them were hosted on US cloud platforms. One was headquartered in Delaware. And they all played up their “European” pedigree. It’s a little depressing.

When evaluating potential services, ask:

• Is the company headquartered in Europe?
• Does it have a parent company headquartered elsewhere? Keep climbing the ownership chain until you hit the ceiling.
• Who are the sub-processors? A legit company will list them, usually in their privacy policy. If they don't, email and ask (that’s how I figured out one of the above).

A cute European flag on the page isn’t proof of anything. Always dig deeper. You can use my scanner as a first step.

Colin