EU-owned, EU-operated, EU-hosted, and the one that matters

Every auth vendor selling into Europe right now can say something European about itself. Three phrases do most of the work, and they get used as if they meant the same thing. They don’t, and only one of them decides who can be ordered to hand over your users’ data.

EU-hosted is a postcode

It tells you where the servers are. That is worth something: lower latency, and a data centre you could in principle drive to. It is also the easiest of the three to acquire. Any company can rent capacity in Frankfurt this afternoon and put “EU-hosted” on its website tomorrow. It tells you nothing about who holds the keys or who can be made to use them.

EU-operated is staff

It tells you the people running the systems day to day are here. That gets you support in your time zone, engineers under European employment law and an on-call rotation that overlaps your working day. But the people with production access can still work for a company headquartered somewhere else, and when their employer receives a lawful order, where they sit doesn’t change what happens next.

EU-owned is jurisdiction

It tells you which courts can issue an order the company has to obey. This is the one that settles it, and it is the one most vendors cannot claim, because their ownership is American even when their servers and staff are not.

What that means in practice

A US-owned company is reachable by US law wherever its servers happen to sit. European vendors didn’t make this up for their marketing. In June 2025, Microsoft France’s Director of Public and Legal Affairs was asked under oath in the French Senate whether he could guarantee that French citizens’ data would never be handed to US authorities without French consent. His answer:

« Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit. »

— “No, I cannot guarantee it, but, once again, it has never yet happened.” Both halves of that answer matter. It has never happened, and he still could not promise that it won’t. That was an honest answer: the promise isn’t his to make.

A government that treated this as a real question

In May 2026 the Dutch State Secretary prohibited the American company Kyndryl from acquiring Solvinity, which operates infrastructure behind DigiD — the login millions of Dutch citizens use for government services. Kyndryl challenged it. In July 2026 the Rotterdam District Court declined to suspend the prohibition, and its press release records the risk at the centre of the case: that the US government could, under US law, gain access to sensitive information via Kyndryl’s American parent company.

Nothing new happened to trigger this. There was no new law and no breach. A government looked at who would own the company behind a national login system, decided that ownership was what mattered, and acted on it. Your enterprise customers’ procurement teams are starting to ask you the same question.

Where we stand

Authalla is all three. EU-hosted: the service itself, and everything we store, runs on infrastructure from Hetzner, a German company, in its Helsinki data centre. EU-operated: we run it ourselves, from Finland, and production access never leaves the company. EU-owned: Authalla Oy is a Finnish company, business ID 3597022-6, owned by its founders. No US parent, no US holding structure, no outside investors.

If we were buying, ownership is the one we would ask about. There is no American company anywhere above us that could be ordered to produce your users’ data.

Please check rather than take our word for it. The proof for each of the three is on the European page, along with the three places where the claim stops: identity providers you choose to enable, the French company that delivers our email, and the US-operated registries our developer tooling ships through. The full list of every company involved, and where each one’s parent sits, is on the subprocessors page. It is short, and two of the four entries are American. That is why we publish it.