SovereignGate

Inspiration

European boardrooms talk about digital sovereignty constantly, but almost no company can answer a simple question about itself: how dependent are we, right now, on non-EU cloud and software providers? The numbers behind that question are stark. Three US hyperscalers — AWS, Microsoft Azure, and Google Cloud — together control more than 70% of the European cloud market, while the largest European providers hold only a couple of percent each (https://www.itsa365.de/en/news-knowledge/2026/07/towards-european-digital-sovereignty). Broader estimates put EU reliance on foreign digital products, services, infrastructure, and IP at over 80% (https://gpg-pdf.chambers.com/information-technology-2026/45/). The dissonance is personal, not abstract: 90% of German companies already use cloud services, and 78% of those same companies openly admit they are too dependent on US providers (https://www.cloudmagazin.com/en/2026/01/08/europe-digital-sovereignty/).

Regulators are moving faster than most companies are. The European Commission's Tech Sovereignty Package, presented on 3 June 2026, introduced the Cloud and AI Development Act, which sets sovereignty assurance levels for cloud and AI services based on control over infrastructure and supply chains, data processing arrangements, cybersecurity, and exposure to third-country interference (https://gpg-pdf.chambers.com/information-technology-2026/45/). Gaia-X's own CTO has been blunt about the stakes, noting that no US company can guarantee a foreign government will never access your data, and framing sovereignty as having strategic options rather than doing everything alone (https://euperspectives.eu/?p=11092).

Meanwhile, the tools available to individual companies haven't caught up with the policy. Directories like Discover European (https://eualternative.eu), Only-EU (https://www.hunted.space/product/only-eu), and EU Vetted (https://peerpush.com/p/eu-vetted) do a good job cataloguing EU alternatives to popular software — but they're static lookup tables. You have to already know what you're searching for, and every visitor gets the same flat list regardless of their actual stack. Nothing personalizes this, scores it, or turns it into something a company can act on. That gap is what SovereignGate closes.

What it does

SovereignGate takes the list of software and cloud tools a company actually uses and runs it through a live assurance pipeline:

1. Matching — every submitted tool is checked against a curated reference database of jurisdiction, sub-processor exposure, and verified EU alternatives.
2. Scoring — a transparent, weighted rubric computes an overall Digital Sovereignty Score out of 100, broken down by category (Cloud, Email, AI/LLM, Communications, CRM). The formula's weights are shown on screen, not hidden — a deliberate choice, since the same criticism of opaque, unexplainable "the AI decided" scoring is exactly what the EU's own CADA assurance-level framework is designed to counter (https://gpg-pdf.chambers.com/information-technology-2026/45/).
3. Explanation — a live call to an LLM generates a plain-language Assurance Report covering the top-priority migrations and why they matter, constrained strictly to recommend only alternatives that exist in the verified dataset, so it cannot invent a vendor that isn't real.
4. Proof — a timestamped, exportable Digital Sovereignty Assurance Certificate is issued, something a company could genuinely file in a compliance folder, attach to an investor update, or submit alongside a public-sector procurement bid, at a moment when the EU is actively encouraging preference for EU providers in public procurement (https://gpg-pdf.chambers.com/information-technology-2026/45/).

Every score and every report is computed live, per submission. There is no pre-filled example anywhere in the app.

How we built it

The frontend is React, TypeScript, and Tailwind CSS. The reference dataset — real tool-to-alternative mappings with jurisdiction and category metadata — lives in a Supabase Postgres table (tools_reference), not hardcoded in the frontend, so it can be corrected and extended without a code change. Every scan is logged anonymously to a second table (submissions) purely as a session record, with no personal or account data required.

Report generation runs through a Supabase Edge Function rather than a direct browser-to-LLM call, so the API key never reaches the client. The prompt sent to the LLM is deliberately narrow: it is given only the matched rows from the verified dataset and instructed to narrate and prioritize from that data, not to generate new recommendations — the single design decision most responsible for making the output trustworthy rather than merely plausible-sounding.

Challenges we ran into

The hardest problem wasn't the UI — it was making the AI report reliable rather than convincing-sounding. An open-ended prompt will happily invent a "great EU alternative" that doesn't exist. The fix was architectural, not prompt-tuning: constrain the LLM to narrate only the rows returned by the real database match, so it functions as an explainer of verified data rather than a second source of facts.

The second challenge was building this against a genuinely hard deadline, which meant deliberately shipping one complete, fully-live flow rather than several partially-built features.

Accomplishments that we're proud of

Every number the user sees is computed live from their actual input — nothing on screen is a static screenshot or a cached demo result. The scoring formula is visible rather than hidden behind a black box, which matters given that the EU's own emerging sovereignty framework is itself built around explainable, tiered assurance levels rather than opaque scoring (https://gpg-pdf.chambers.com/information-technology-2026/45/). And the output is a usable artifact — a certificate — not just a results page.

What we learned

That "digital sovereignty" is as much a visibility problem as a technical one — most companies aren't ignoring the issue, they simply have no fast way to see where they stand today, despite the fact that European sovereign cloud spending itself is projected to nearly double year over year, from $6.9 billion in 2025 to $12.6 billion in 2026 (https://www.cloudmagazin.com/en/2026/01/08/europe-digital-sovereignty/). We also learned that constraining an LLM to a verified dataset, rather than letting it free-generate, was the single highest-leverage engineering decision in the whole build.

What's next for SovereignGate

Expanding the reference dataset beyond its initial seed list, adding a before-vs-after simulator so a company can see the score impact of a proposed migration before committing to it, and offering the certificate as a shareable public badge for organizations that want to signal their sovereignty posture externally.

┌──────────────────┐ │ User (browser) │ └────────┬─────────┘ │ lists SaaS/cloud tools ▼ ┌──────────────────────────────┐ reads reference dataset ┌───────────────────────────────────┐ │ SovereignGate Frontend ├──────────────────────────────────► │ Supabase Postgres │ │ (React + Tailwind, │ │ tools_reference table │ │ built in Lovable) │ ◄────────────────────────────────── │ (tool, category, jurisdiction, │ └───────┬───────────────┬───────┘ logs each scan (anon) │ EU_alternative, risk_weight) │ │ │ │ + submissions table │ │ computes │ renders └───────────────────────────────────┘ │ score live │ ▼ ▼ ┌──────────────────┐ ┌────────────────────────────────┐ │ Live Scoring │ │ Assurance Certificate view │ │ Engine (weighted │ │ (score, breakdown, report, │ │ rubric, visible │ │ timestamp, exportable) │ │ formula) │ └───────────────▲──────────────────┘ └────────┬───────────┘ │ report text │ matched tools + score payload │ ▼ │ ┌────────────────────────────────┐ │ │ Supabase Edge Function ├────────┘ │ (server-side only — │ │ holds the LLM API key) │ └───────────────┬──────────────────┘ │ live API call ▼ ┌────────────────────────────────┐ │ LLM API (Claude or GPT) │ └────────────────────────────────┘

Built With

• html5
• postgresql
• react
• recharts
• supabase
• tailwind
• typescript