Digital Sovereignty Is the Word Self-Hosters Have Been Missing

I host a lot of my digital infrastructure from a cupboard in my house, everything from cloud storage to my own streaming platforms, in fact this year I've reduced £700 worth of subscriptions by finding open source self-hosted alternatives. It also means my data sits on disks I own.

Someone at a barbecue asks why asks why run your own digital infrastructure when Gmail is free & better. I'd say something about privacy. They nod, politely, the way people nod at a man explaining his sourdough starter, & the conversation moves on. I've had that exchange a dozen times & the answer never lands.

It keeps coming out weak because you've been making a technical case for something that is actually political. Privacy is a preference. Preferences lose arguments to convenience, every time, because convenience is measurable & preference is just taste. Convenience is definitely the most expensive thing that we keep buying. Meanwhile the exact same argument, made about countries instead of servers, has spent three years acquiring serious language & serious money.

Imagine this: Washington just flicking one switch & half of Europe's hospitals, banks & ministries are just going to go dark. That's a real possibility. It's the setup that has been built on purpose. For 30 years, Europe has picked the cheap, easy option & handed its cloud, chips & software all to a handful of US firms. It's not that American tech is necessarily better, but they are much more capable at scaling that technology. But I think Europe is figuring out very quickly that better stops mattering the second the US president uses access as a lever in a trade fight.

There are three major trade-offs that I see right now. Cheaper tools today mean weaker leverage tomorrow. Faster rollout now means slower home-grown skills in the future. Every euro that is spent on US-only tech stacks is a vote against Europe ever having its own.

The EFF laid this out in a Deeplinks post this month, "Digital Sovereignty: What It Is, What It Could Be", & their honesty is the useful part. They admit the term is everywhere & frustratingly vague, that policymakers, regulators & civil society all mean different things by it, & that there is no single position even inside the digital rights world. The broad version they offer is having the capacity to control your own digital destiny. Read that as a person rather than a state & it is an unusually good description of what you're doing on a Sunday afternoon with a Raspberry Pi.

The sharper version is in the Franco-German joint paper the EFF cites, which defines digital sovereignty as the "capability & capacity to develop, provide, use, adapt & control digital technologies including hardware in an independent, self-determined & secure manner". Two governments went through the whole official process to arrive at a sentence that describes a homelab. Germany has gone further & put money behind it through the Sovereign Tech Agency, which funds the open software components underneath European competitiveness. The state has started paying maintainers who did that work unpaid for years.

So the vocabulary exists now, at the level of treaties & budget lines. You can borrow it.

That same language gives citizens & smaller nations a real argument for infrastructure they can inspect & repair. It also gives governments a respectable word for data localisation, filtering & building walls across the internet. Sovereignty & control are the same capability pointed in different directions, & the EFF is right that the word carries both. What I won't split the difference on is the marketing. A "sovereign cloud" sold by a company whose parent answers to another country's courts is a sticker on a box. The jurisdiction follows the corporate structure, whatever the data centre postcode says, & everyone selling it knows that. My view is this is a sovereignty story that is dressed up as a procurement choice.

Owning the stack stops being taste here. I've reviewed a fair number of AI-assisted builds over the past two years & found security flaws, compliance gaps & accessibility failures in almost all of them. All of it came down to access. I could open the thing & read it. On a managed platform, when you ask what went wrong, you get a status page & a sympathetic tone of voice.

Sovereignty in practice is the right to look.

The belief worth dropping is that you need a policy job or a rack in a colo before any of this counts as a position. It counts at the scale of one server. When your board or your CTO asks why you're maintaining something a vendor would host, you no longer have to say you prefer it. You can say the capacity to adapt & control our own tools is a stated European policy objective, we hold it at department scale, & here is what we can inspect that our competitors cannot.

There is a red button for almost all aspects of our lives. They can stop us from paying, because we depend on Visa & Mastercard. They can stop us from using our phones, because we depend on Google & Apple. From messaging friends on WhatsApp, or even getting treatments at hospitals or booking trains, because of Amazon Web Services.

One thing to try this week: list every service your team depends on & write next to each one which country's courts could compel it & who, in practice, could switch it off tomorrow. Pick the entry that bothers you most & find out what replacing it would actually cost.

My bet: within eighteen months, "what is the jurisdiction of your ultimate parent company" becomes a standard line in UK public-sector procurement questionnaires, sitting beside the data-residency question that is already there. The mechanism is straightforward, because the Sovereign Tech Agency model gives finance ministries a way to spend on this, & spending creates definitions. The signal to watch is whether any UK or EU department copies that fund before the end of 2027. If sovereign-cloud branding gets waved through as sufficient instead, I'm wrong & the term dies as marketing.

Until then, the strongest argument for running your own stack is sitting in a Franco-German policy paper, waiting for you to quote it, & the practical end of it looks a lot like the tools & skills I keep out in the open.

Frequently Asked Questions

What does digital sovereignty actually mean?

Digital sovereignty means having the capacity to control your own digital destiny, which the EFF offers as a deliberately broad starting definition because no single agreed one exists. The Franco-German joint paper sharpens it to the capability & capacity to develop, provide, use, adapt & control digital technologies, including hardware, independently & securely. The implications differ enormously depending on whether you are an individual or a country.

Is self-hosting really a political act, or am I overthinking it?

It is a political act, because the capability you hold by running your own services is the same one governments are now writing into policy & funding. Germany's Sovereign Tech Agency invests in the open software components underneath European competitiveness, which is the code most self-hosters already run. Only the scale differs.

Does a "sovereign cloud" product from a big vendor solve this?

No, not on its own. Jurisdiction follows the corporate structure, whatever the location of the data centre, so a sovereign cloud sold by a provider whose parent company answers to another country's courts is just a label. It may still reduce some risks. Treat the branding as a starting question.

What is the real benefit of controlling my own stack?

The practical benefit is the right to look inside it. Across AI-assisted builds I have reviewed, the security flaws, compliance gaps & accessibility failures were findable only because I could open the code & read it. On a managed platform the equivalent request usually returns a status page.

Can digital sovereignty be used for bad ends too?

Yes, & that tension is real. The same vocabulary that supports infrastructure people can inspect also gives governments a respectable term for data localisation, filtering & internet fragmentation. The EFF is explicit that there is no single coherent position in the digital rights space on this. Sovereignty & control are one capability aimed in different directions.