The editorial argues the sovereignty/Schrems II framing misses the real engineering story: AWS wins because it offers managed Postgres with PITR, a well-understood IAM model, working Terraform providers, and a hiring pool that already knows the console. European hosts have credible IaaS but lost the developer platform war beneath the marketing war.
CipherCue's crawl of EU+UK company websites resolves domains through CDN indirection to ASN owners, showing Cloudflare, AWS/CloudFront, and Google Cloud/CDN take the largest shares. They argue the methodology's ambiguity is the point — even self-hosted European origins terminate inside US-controlled edge networks.
Submitted the CipherCue report to HN where it drew 231 points and 163 comments, amplifying the finding that US-headquartered vendors serve the majority of European company websites in 2026.
The report notes Hetzner is the fastest-growing EU-native host but attributes the growth to hobbyists and small SaaS teams chasing aggressive per-euro-per-core pricing. OVHcloud, IONOS, and Scaleway each remain in low single-digit share with strong home-country concentration and near-zero footprint outside their borders.
A new dataset from CipherCue crawled the public websites of European companies across all 27 EU member states plus the UK, resolving each domain to its hosting provider via IP ranges, ASN data, and CNAME chains. The headline finding: US-headquartered vendors serve the majority of European company websites in 2026, with Cloudflare, Amazon (AWS + CloudFront), and Google (GCP + Cloud CDN) accounting for the largest slices.
The methodology is straightforward — resolve the apex domain, follow any CDN indirection, map the terminating IP to an ASN, and attribute the ASN to a vendor's legal parent. It's imperfect (self-hosted origin behind a US CDN gets counted as US), but that ambiguity is arguably the point: even when European companies rent European metal, the traffic terminates inside a US-controlled edge network.
European players show up but stay small. OVHcloud (France), Hetzner (Germany), IONOS (Germany, formerly 1&1), and Scaleway (France) each land in the low single digits of share across the continent, with strong home-country concentration and near-zero footprint elsewhere. The report notes Hetzner has grown fastest among EU-native hosts, largely on the back of hobbyists and small SaaS teams price-shopping against Hetzner's aggressive per-euro-per-core numbers — not enterprise migration.
The political framing around this data will be predictable: sovereignty, GAIA-X failure, Schrems II. That framing isn't wrong, but it misses the engineering story underneath. European hosts have lost the developer platform war, not just the marketing war. When a Berlin startup picks AWS, they're not choosing American — they're choosing managed Postgres with point-in-time recovery, an IAM model their auditors already understand, a Terraform provider that actually works, and a hiring pool that shows up on day one knowing the console.
OVH and Scaleway both have credible IaaS offerings. Both have object storage, managed databases, and Kubernetes. Neither has the ecosystem gravity — the third-party tools, the Stack Overflow answers, the ex-employee network of consultants — that turns a cloud into a default. Hetzner, the fastest-growing of the bunch, deliberately doesn't compete on managed services at all. Its pitch is dedicated boxes and cheap VMs; you bring your own orchestration. That's a legitimate business, but it caps the ceiling at teams comfortable running their own Postgres.
The Cloudflare number deserves separate attention. A large share of "US hosting" in the report is actually Cloudflare in front of European origin infrastructure — meaning the compliance story isn't just "where does the data live," it's "whose court order can compel the TLS terminator." For a lot of GDPR reviews, that distinction has been quietly waved through. Schrems II said data transfer to the US requires supplementary measures; a US CDN terminating TLS on EU traffic is a transfer, even if the origin sits in Frankfurt.
Community reaction on Hacker News split cleanly along two lines. One camp — mostly EU-based developers — argued the data confirms what they've been saying for a decade: the EU spent billions on GAIA-X policy theater while shipping approximately zero developer-usable product. The other camp pushed back that US vendors won on merit, and forcing European companies onto worse infrastructure to satisfy a sovereignty checkbox is exactly the kind of regulation that produced GAIA-X in the first place. Both are correct, which is why the situation hasn't moved in five years.
If you're building in the EU and telling customers you're "GDPR-compliant hosted in Europe," audit what that actually means end-to-end. Terminating TLS at Cloudflare's Frankfurt PoP is legally different from terminating TLS at OVH's Roubaix datacenter, even though both are physically in Europe — and the difference is exactly what your DPO is supposed to catch. The report's data suggests most companies aren't catching it.
Practically, the alternatives exist but require tradeoffs. Scaleway has a full-stack managed offering with Kubernetes, object storage, and managed Postgres that a small team can operate without heroics. OVH's public cloud has improved substantially and now has a functional Terraform provider. Hetzner is the price-performance winner if you're willing to run your own control plane. Bunny.net and Fastly's European PoPs offer CDN options that don't route through US legal jurisdiction, though Fastly is US-parented so the CLOUD Act question reappears.
The honest answer for most teams: staying on AWS Frankfurt or GCP europe-west3 with a documented Schrems II supplementary-measures analysis is defensible and shippable. Moving to Scaleway or OVH is defensible, shippable, and slower. Moving to Hetzner is cheap but you're now running SRE for a living. Pick the tradeoff that matches your compliance surface, not the one that matches your politics.
The EU Data Act and NIS2 both come into fuller enforcement through 2026, and neither of them will change the hosting share numbers meaningfully — regulation without a competitive product just produces more compliance paperwork on top of the same US infrastructure. The interesting variable is whether Hetzner or Scaleway ships a genuinely competitive managed-services tier in the next 18 months. If they don't, expect this same report in 2028 with the US share slightly higher and a fresh round of GAIA-X-style announcements that nobody deploys against.
I did a similar study but analyzing actual API subdomains, and ignoring those fronted by Cloudflare, Akamai, etc and the conclusion was the opposite: European companied are more likely to be using OVH and Hetzner than AWS/Azurehttps://bloomberry.com/blog/we-analyzed-50k-apis
This tries to capture Europe as a single coherent market, which it is not and by far.It's comparing countries with vastly different socio-economical landscapes and sizes.Is "using Cloudflare as a CDN but hosting everything at, say, Hetzner using generic systems/opensource components&q
As an Italian solo-founder, I have to admit that the US vendor dependency is really strong, but when you look at what you need to build a serious product, what can you actually use from European vendors that is even close to US products?Take Stripe as an example: is there a real alternative that cov
"What it means and what it does not": article is clearly written by claude, which for me at this point means that I pay as much attention to it as I do to Claudes output: I skim it and then move on. It actually requires far more effort of me to read it than it was to generate the content.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
A lot of these US vendors have data centers in the EU operating under EU law via legal entities in the EU. So, it's not all that black and white. And there are a growing amount of EU based alternatives.And just to make a counter point, there are also US dependencies on the EU for some things as