Our editorial process

1. 1

   We start from the vendor, not from a press release

   Every tool page begins with the company's own material: pricing page, terms, privacy policy, data processing agreement and sub-processor list. Where a vendor publishes a security whitepaper or a status page, we read that too. We do not build a review from other directories' summaries, because that is how a wrong "EU-hosted" claim spreads from site to site without anyone checking it.

2. 2

   We establish where the company actually is

   "European" is the whole point of this site, so we treat it as a factual claim rather than a marketing one. For each tool we record where the legal entity is established, and separately where the data is stored. Those are often not the same: a US company with an EU data centre is still a US company subject to US law. Our directory currently classifies 340 tools as established in the EU/EEA or Switzerland, 38 elsewhere in Europe, and 12 as open source projects with no company behind them. Tools whose vendor sits outside Europe do not belong in this directory and are removed when we find them, however good the product is.

3. 3

   The draft goes back against the sources

   Every draft is read again against the material it came from. It goes back when a claim has no source behind it, when a pricing figure is older than the vendor's current page, or when the tone is more enthusiastic than the evidence supports. This is also where we check that the alternatives we suggest are genuinely comparable, rather than the ones that happen to have an affiliate programme. This site is written by one person, so that second pass is a separate step in time, not a separate pair of eyes — we would rather say so than imply an editorial department that does not exist.

4. 4

   Compliance claims are checked separately

   Anything regulatory gets checked on its own: GDPR posture, data residency, sub-processors, certifications, and whether an eIDAS or ISO claim points at a real, current certificate. If we cannot verify a claim, we either drop it or say plainly that the vendor asserts it and we could not confirm it.

5. 5

   We re-check, and we date what we re-checked

   Pricing and hosting arrangements change. Every tool page carries the date it was last reviewed, and that date only moves when someone has actually looked at the page again. A page that has not been re-checked keeps its old date, even if that looks less impressive.

How we handle affiliate income and paid placement

Some links on this site are affiliate links, and we may earn a commission when you sign up through them. Plenty of tools we recommend, particularly the self-hosted open source ones, pay us nothing at all.

Placement on a category page can also be paid, and paid placement can affect the order in which tools appear. Every category page says so above the list. We do not publish the commercial terms, but we are precise about the limit: payment never buys a place in the directory, never removes a criticism, and never changes a claim we have checked. A tool that fails the European ownership or compliance check is not listed at any price, and a vendor can ask us to correct a factual error — not to delete an inconvenient one.

Which is why order is the least interesting thing on the page. The write-ups are where we say who each tool is actually for, and that part is not for sale.

Corrections

If something on this site is wrong, tell us and we will fix it. Email business@gcas-digital.com or use our contact form. Corrections to a factual claim are made on the page itself, and the "last reviewed" date is updated when we do.

Who does this work

One person, named and reachable. Until 31 August 2026 this section listed three editors who did not exist; they have been replaced by the person who actually does the work.