We recently published a case study documenting the founding story of Lettermint, most likely one of the first ESPs in Europe built to ensure complete EU data sovereignty. Lettermint is a small but concrete example of a much larger shift underway across European technology procurement: a move away from treating US hyperscaler cloud infrastructure as the default, and toward actively selecting EU-owned, EU-governed alternatives.
The legal root of the issue is the US CLOUD Act, which permits US authorities to compel US-headquartered companies to turn over data they control, regardless of where that data physically sits. That means a European company using a US provider's Frankfurt or Dublin data center has not necessarily escaped US jurisdiction over its data; the location of the servers doesn't change which country's courts can compel disclosure. This distinction between data residency (where data sits) and data sovereignty (whose laws actually govern it) has become the central technical and legal argument driving the sovereign IT movement.
That argument existed well before 2024, rooted in GDPR-era compliance concerns dating back to the first Trump administration and the 2020 "Schrems II" court ruling that struck down the previous EU-US data transfer framework. But sentiment has hardened considerably since the 2024 US election, with European businesses and public institutions increasingly framing the issue not just as a compliance question but as a way to reduce their reliance on a US political and legal environment they cannot control.
The scale of the shift shows up in recent surveys and procurement activity. Industry research from Germany's Bitkom association found that a large majority of German companies want to end technical dependence on US cloud providers, even though a comparable share acknowledge that they remain dependent in practice today — a gap researchers describe as the central sovereignty challenge facing corporate boards in 2026. Trust in US providers among the same surveyed companies has fallen to well under half.
European institutions have responded with meaningful initiatives and funding. The Gaia-X project — a federated effort to build interoperable, European-governed cloud standards — now counts several hundred certified participating providers. The European Commission introduced a formal Cloud Sovereignty Framework in late 2025, creating the first scoring system to measure how exposed a given cloud service is to foreign legal jurisdiction, and has since begun applying that framework to actual EU procurement contracts worth hundreds of millions of euros. Individual EU members have taken their own steps: several German states and federal agencies have mandated migrations away from Microsoft 365 toward EU-hosted alternatives, and multiple national governments have issued large tenders explicitly requiring sovereign cloud infrastructure for mission-critical systems.
Even the US hyperscalers have responded to the pressure. Amazon Web Services launched a legally distinct "European Sovereign Cloud" subsidiary in Germany in January 2026, structured as a separate German entity with EU-based leadership. Critics — including sovereignty researchers and competition economists — have been quick to label this kind of move "sovereignty washing," arguing that as long as the parent company remains US-incorporated, the underlying CLOUD Act exposure hasn't actually gone away, regardless of where the servers or the subsidiary sit.
But national jurisdiction is only one part of IT sovereignty. The broader issue is dependency: whether another party retains the technical or commercial ability to control infrastructure your organization depends on. Moving from a US provider to a European provider may reduce exposure to US jurisdiction, but it does not create full independence if the new vendor still controls your license, your access to the software, or your ability to keep essential systems running.
Self-hosting alone does not solve this problem. Software may operate on servers you own, inside your own country, while remaining dependent on a proprietary license key controlled by a vendor. If that vendor changes ownership, raises prices, discontinues the product, alters its strategy, or withdraws the license, your infrastructure is still subject to decisions made by another organization. The jurisdiction may be closer, but the dependency remains.
The same principle applies to the software itself. When a system handles sensitive business and customer data, organizations must be able to understand what the software is doing with that information. With proprietary software, the customer must largely trust the vendor’s assurances because the underlying code cannot be independently examined. Open source software makes that code visible, giving organizations the ability to inspect, audit, modify, and verify the technology running inside their infrastructure.
Open source also removes a critical point of vendor control. When software does not depend on a commercial runtime license or vendor-operated management layer, the organization retains the ability to continue operating it regardless of what happens to the original vendor. Support can still be purchased, and partnerships can remain valuable, but continued use of the software is not contingent on maintaining that commercial relationship.
This is where KumoMTA enables IT sovereignty for email infrastructure. KumoMTA can be deployed on infrastructure an organization owns or controls, in the country and environment of its choice. It does not require message or operational data to pass through Kumo Corp-hosted services, and continued operation is not dependent on a commercial runtime license or vendor-controlled license key. Organizations decide where it runs, who can access it, how it integrates with their environment, and what information leaves their network.
Market analysts broadly agree that a full, near-term break from US hyperscalers is unlikely. The US providers still account for the large majority of Europe's cloud infrastructure market, and the feature gap in areas like AI services and global scalability remains real. But the sovereign IT movement is ultimately about more than replacing American technology with European technology. It is about reducing dependencies that leave essential systems under someone else’s control.
For infrastructure providers like Lettermint, built with sovereignty in mind from the beginning, this shift represents a genuine and durable market opportunity rather than a temporary compliance trend. True IT sovereignty means retaining control over your data, your infrastructure, and your ability to keep operating, regardless of where your vendors are located.
- - - - - - - - -
KumoMTA is the first open-source MTA designed from the ground up for the world's largest commercial senders. We are fueled by Professional Services and Sponsorship revenue.
Join the Forum | Review the Docs | Read the Blog | Grab the Code | SWAG Shop