The trend is real, and it has numbers behind it
On May 27, 2026, the European Commission put out its Tech Sovereignty Package, and one piece of it — the Cloud and AI Development Act — would stop EU public bodies from putting their most sensitive data on cloud platforms run by companies outside EU jurisdiction. It is not a ban on AWS, Azure or Google Cloud. It is a signal, and the money had already started moving ahead of it. Gartner puts European spending on sovereign cloud infrastructure at $6.9 billion in 2025, rising to $12.6 billion in 2026 — up 83% in a single year, and forecast to nearly double again in 2027. So the question is not whether to look around. It is what actually counts as a European alternative once you do.
What is actually driving the move
Three forces, in roughly this order of weight.
The CLOUD Act. The 2018 US CLOUD Act lets US law enforcement compel any US-incorporated company to hand over data it controls, no matter where that data physically sits. A datacenter in Frankfurt does not put data out of reach if the company running it answers to a US parent. This is not theoretical. On June 10, 2025, in front of a French Senate committee, Microsoft France's director of public and legal affairs, Anton Carniaux, was asked under oath whether he could guarantee that French citizens' data would never be handed to the US government without French agreement. His answer: "No, I cannot guarantee that." He added that it had never happened — but the legal exposure stands whether or not it has been used yet.
The new rules for sensitive workloads. The Cloud and AI Development Act, if it passes, would apply across all 27 member states and push public-sector data — health records, judicial files, financial supervision — toward EU-incorporated, EU-jurisdiction infrastructure. Private companies are not in scope. But governments set the tone, and France already moved ahead of the rules: its Health Data Hub, more than 10 petabytes of health records, was pulled off Microsoft Azure and reassigned to the French provider Scaleway.
Concentration risk. AWS, Azure and Google Cloud together hold somewhere around 70% of the European cloud market. For a CISO, that is most of the continent's digital operations sitting underneath a single foreign legal regime. Trade friction and shifting US policy turned that from an abstract dependency into a board-level question.
Where "EU region" stops being enough
The most common mistake is treating a datacenter's location as the whole answer. Most hyperscalers offer EU regions, and for plenty of workloads that is genuinely fine — latency, data residency for low-sensitivity data, raw performance. Concede that honestly. What an EU region does not change is who legally controls the company holding your data. Jurisdiction follows incorporation, not the server rack. An eu-central-1 region run by a US-incorporated entity is still reachable through that entity's home legal system.
So the real test is layered: where the data sits, who controls the company, who can compel disclosure, and — the layer most providers quietly skip — whether the provider can read the data at all. That last one is the line between minimizing legal exposure and eliminating it. If a subpoena lands and the provider only holds ciphertext it cannot decrypt, there is nothing meaningful to hand over. That is the posture worth checking for, and it is what separates a real switch from a lateral move.
A checklist before you switch
Switch for substance, not for the headline. Run any candidate through these before you sign anything.
- Corporate jurisdiction. Who incorporates the company, and under what law? A French, German or Dutch entity with no US parent is outside CLOUD Act reach. Read the legal entity, not the marketing. Beebeeb is operated by Initlabs B.V., registered in the Netherlands (KvK 95157565), with no US parent.
- Where the data physically lives. Name the city, not the continent. A vague "EU servers" line is a flag. Beebeeb stores data on dedicated servers in Falkenstein, Germany.
- Who holds the encryption keys. This is the one that actually matters. If the provider can decrypt your files on its side — to index them, build previews, or answer a request — then "encrypted" protects their datacenter, not you. Ask it plainly: can you read my files? A zero-knowledge provider answers no, and can explain why at the architecture level.
- Sub-processors. A European front end backed by a US analytics, email or CDN vendor quietly reintroduces the exposure you were trying to leave. Get the sub-processor list and read it.
- Verifiability. "Trust us" is not a security model. Open-source clients let anyone inspect how keys are derived and where they go. Published audits let you check the claim instead of believing it. Be wary of "audited" with no report you can read.
How Beebeeb maps to that checklist — stated honestly
We built Beebeeb against exactly this list, so here is the unvarnished version, limits included.
The encryption is client-side. Your passphrase derives your keys on your own device with Argon2id, and those keys never leave it. Files are encrypted with AES-256-GCM before they ever upload. Per-recipient sharing is sealed with X25519; login uses OPAQUE, so your password is never sent to the server even over TLS. The server only ever receives ciphertext. That is what lets us say, plainly, that we cannot read your files. It is also why we cannot recover them if you lose both your passphrase and your BIP39 recovery phrase. That tradeoff is the honest cost of real zero-knowledge, and it holds on every tier, no exceptions. You can read the full mechanism on our security page.
The product clients — web app, CLI, mobile and the core crypto library — are open source, so the key handling is inspectable rather than asserted. The server and this marketing site are not open source, and we say so precisely, because "open source" gets stretched constantly. An independent audit is planned and the findings will be published when it is done. We have not been audited yet, and we will not pretend otherwise.
On what is live today: the web app, CLI, WebDAV access via the CLI, and encrypted sharing with expiry, revocation and passphrase protection all ship now, alongside file versioning with configurable retention, file requests, TOTP 2FA and passkeys. Native mobile and desktop apps, and one-click import from Google Drive and Dropbox, are coming soon — not live yet. If your migration depends on that import, plan around it or wait for it.
The cost side, without the asterisks
Sovereign cloud gets pitched as a premium you pay for peace of mind. It does not have to be. Beebeeb is a flat per-terabyte price with no egress fees and no request charges: Starter at €1.99/mo for 100 GB, Basic at €3.99/mo for 200 GB, Pro at €10.99/mo for 1 TB, scaling up to 99 TB self-serve at +€10.99 per extra TB, with a custom quote beyond that. Every plan opens with a 14-day free trial on full zero-knowledge encryption — enough to test the claim yourself before you move anything important. Full breakdown on the pricing page.
If you are specifically leaving Dropbox, we wrote a feature-by-feature look at what carries over and what is still in progress: our honest Dropbox alternative comparison. Read it for the gaps as much as the wins.
The point
The regulation is at the back of this move, and the money is following it. None of that makes any given alternative the right one. A European flag on a pricing page is not jurisdiction, and "encrypted" is not the same as private. So run the checklist. Read the legal entity, find out who holds the keys, get the sub-processor list. If a provider passes on substance, the headlines were just the reason you finally looked.