Is your website actually European?

Enter a domain. We trace where its web and mail really live — and, just as important, who ultimately controls them. Most of the European web is more non-European than it looks.

try github.com · orange.fr · bbc.co.uk · telenet.be

method

How the score works

You get two independent scores, 0–100: one for the web (where the site is served) and one for mail (where email is handled). They're separate on purpose — a company can host its site in-region yet run its email through a US provider, or the reverse.

70% hosting

Is each server both located in the sovereign area and owned by a company from it? It counts fully only when both are true.

30% transit

How much of the network path from our EU vantage stays on sovereign networks rather than routing through foreign ones.

½ ownership

A server hosted in the EU but owned by a non-sovereign company counts half. A German data centre run by a US firm is still reachable under the US CLOUD Act — the disks are here, the jurisdiction is not.

Sovereign area EU-27 Switzerland United Kingdom Iceland everywhere else

Switzerland, the UK and Iceland are included on adequacy / EEA grounds — a line you're free to redraw. See the stance below.

inputs

What we actually check

Web servers — the domain's A / AAAA records: the IPs your browser connects to.
Mail servers — the domain's MX records on the apex, then each mail host's A / AAAA: where your email is delivered.
Physical location — offline GeoIP (DB-IP) for every server and every hop. No third-party API sees your query.
Corporate ownership — the operating network's AS registration, plus a name map for multinationals: an Ireland-registered “Amazon Data Services Ireland” is still US-owned.
The route — a live traceroute from our European vantage to each endpoint, so the path itself is scored, not just the destination.

the catch

CDNs & anycast blur the map

⚠ read this before you trust any location check

Physical location is not legal jurisdiction.

Cloudflare, Fastly, Akamai, AWS CloudFront, Google Cloud and Azure Front Door serve your site from an edge node that may physically sit in Frankfurt or Amsterdam — so a location-only check happily reports “Europe.” But that edge is operated by a non-European company: TLS terminates on their hardware, and the origin, control plane, logs and legal entity are non-European. That's exactly why we halve EU-hosted-but-foreign-owned infrastructure instead of awarding full marks — a deliberate, arguable call.

Anycast also means the IP you get depends on where you ask from. This score reflects the path from our European vantage, not a single global truth — a CDN-fronted site can look different from Paris, São Paulo or Singapore.

stance

Why a score, and not a verdict

“Sovereign” has no single legal definition. Adequacy decisions, the CLOUD Act, Schrems II, GDPR, Gaia-X, EuroStack — serious people draw the line in different places. This tool takes a position so it can produce a number; the number is an invitation to argue, not a compliance rating.

A 100 doesn't mean “safe” and a 30 doesn't mean “illegal.” It means: here is who can be compelled to hand over your data, and under whose law.

We count the UK as sovereign — post-Brexit, some would exclude it. We count Switzerland and Iceland in — others hold the line at the EU-27. Redraw it and the scores move.

The uncomfortable part: run this on European banks, ministries, hospitals and universities, and a great deal of critical infrastructure lands below 50. That's the conversation worth having — not whether one score is off by five points.

fine print

Limits & honesty

Geolocation and ownership are estimated from public IP data and AS registries; ownership is a curated heuristic that won't catch every foreign-owned EU brand (the honest fallback is the AS registration country). This is not legal advice, and a good score is not a guarantee — it's an evidence-based place to start an argument. It's also open source, so improve the data.