COMPLIANCE met?
Europe's digital US dependence · read from public DNS and homepages
0.2% of the 1,347 European institutions, banks and listed companies we checked run all seventeen layers without an American company.
Seventeen layers in four families: what an organisation runs on, what its people work in, where its records, contracts and code live, and what its visitors meet. For each organisation we asked the public DNS who answers — the same question every mail server on the internet asks it — read its homepage once, and followed every answer to the company that owns the machine. American companies answer to the CLOUD Act, wherever their data centre stands, and to American sanctions, whoever their customer is.
Infrastructure
Workplace
Operations
Audience
1,347 organisations · scan 17 in all: 70,592 DNS questions · 1,183 homepages read · 883 networks
Beyond privacy
Who can switch it off
The CLOUD Act decides who can be made to hand the data over. Sanctions decide who can be made to switch the service off. On 6 February 2025 Executive Order 14203 put sanctions on the International Criminal Court in The Hague; under it Washington has listed the court's prosecutor, several of its judges and a UN special rapporteur. Banks cut off one judge's credit cards, she lost access to her Amazon accounts, and sending money to her family became a struggle. Every layer an organisation rents from an American company is a layer an order like it can reach.
“…small annoyances, but when they all come together at once in your life, it's paralysing.”
Source of the facts and the quote: “Executive Order 14203”, Wikipedia.
01 · Layers
Seventeen layers in four families, and who owns each
Each ring counts every platform found on a family's layers — a Teams tenant, a Slack workspace, a DocuSign account — by where the company behind it answers to. Beside it, every organisation counts once per layer. On every layer but email, the office suite and DNS an organisation often runs several platforms at once, and it takes the colour of the one furthest from EU law: an organisation that sends through Mailchimp depends on it, whatever else it uses. Hover a band or a ring for the numbers; switch the group above.
Infrastructure
What the organisation runs on
5,210 platforms found
Workplace
What its people work in
7,397 platforms found
Operations
Where its records, contracts and code live, and who watches them
2,416 platforms found
Audience
What its visitors and subscribers meet
3,601 platforms found
02 · Depth
How deep the dependence goes
Every organisation, once, by how many of the seventeen layers it rents from an American company. Hover a column for who is in it.
layers at American companies, of 17 · median 9
03 · Top 10s
The 10 least and the 10 most locked in
The 10 organisations that rent the fewest layers from American companies, and the 10 that rent the most — then the fewest or the most from US Big Tech, then the fewest or the most American platforms found in all. Pick a layer to rank on that one: the best run it on a European company, the worst on an American one, US Big Tech first. Ties share a rank. Click a name for the evidence.
Everything · 1,347 organisations
Best 10
1,115 rankedFewest layers at American companies
Worst 10
1,344 rankedMost layers at American companies
04 · Everyone
Every organisation, one square
Each square is an organisation, sorted by who runs the layer you pick. Hover for the evidence, click to open it.
The chart needs JavaScript; the table below has the same numbers.
05 · Providers
Who they rent from
The companies the most organisations rent a layer from. On every layer but email, the office suite and DNS every platform found counts, so the shares can add up to more than all. A network nobody has named yet is listed as its registration says.
06 · The stack
Who holds which layer
The companies that hold at least one layer for the most organisations, and the share of organisations each holds every layer for. Read across a row for a company's reach, down a column for a layer's providers.
| Infrastructure | Workplace | Operations | Audience | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Company | Cloud | DDoS | DNS | Suite | Drives | Devices | Video | Chat | AI | Apps | E-sign | Dev | Monitor | Tracking | Consent | Marketing | Any layer | |
| Microsoft | 55% | 15% | 5% | 6% | 92% | 92% | 48% | 54% | 54% | 92% | 3% | 2% | 3% | 3% | 0.4% | 7% | 95% | |
| Amazon | 0.2% | 23% | 8% | 3% | 0.1% | 0.1% | 0.1% | 1% | 2% | 0.3% | 1% | 13% | 37% | |||||
| 2% | 3% | 1% | 3% | 3% | 3% | 3% | 3% | 0.4% | 33% | 37% | ||||||||
| Atlassian | 36% | 36% | ||||||||||||||||
| Intuit (Mailchimp) | 31% | 31% | ||||||||||||||||
| Twilio (SendGrid) | 30% | 30% | ||||||||||||||||
| Cisco | 3% | 25% | 0.1% | 27% | ||||||||||||||
| Cloudflare | 21% | 9% | 0.2% | 0.3% | 2% | 1% | 24% | |||||||||||
| Akamai | 16% | 9% | 0.1% | 0.3% | 1% | 0.4% | 0.2% | 20% | ||||||||||
| DocuSign | 20% | 20% | ||||||||||||||||
| Mailjet | 18% | 18% | ||||||||||||||||
| OneTrust | 17% | 17% | ||||||||||||||||
07 · Countries
Country by country
The share of each country's organisations that rent the layer you pick from an American company. Listed companies count where they are headquartered, banks where they hold their licence; each government and central bank counts for its own country. Click a country for its list.
08 · Cohorts
Index by index, tier by tier
Share of each group with an American company in each layer (the office suite: Microsoft 365 or Google Workspace), and how many layers the median member rents from one. Click a column to sort, a row to see the group.
| Infrastructure | Workplace | Operations | Audience | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Group | Orgs | Any US | Cloud | DDoS | DNS | Suite | Drives | Devices | Video | Chat | AI | Apps | E-sign | Dev | Monitor | Tracking | Consent | Marketing | Median | |
| Euronext Amsterdam — AEX | 25 | 100% | 92% | 80% | 84% | 72% | 92% | 92% | 56% | 80% | 76% | 92% | 72% | 52% | 76% | 28% | 52% | 60% | 84% | 13/17 |
| Euronext Brussels — BEL 20 | 21 | 100% | 71% | 38% | 62% | 52% | 100% | 100% | 62% | 81% | 71% | 100% | 62% | 62% | 52% | 10% | 71% | 33% | 90% | 11/17 |
| Euronext Paris — CAC 40 | 41 | 100% | 71% | 59% | 85% | 59% | 100% | 100% | 54% | 95% | 85% | 100% | 61% | 71% | 83% | 51% | 56% | 46% | 76% | 13/17 |
| Euronext Lisbon — PSI | 15 | 100% | 80% | 40% | 33% | 33% | 93% | 93% | 53% | 80% | 73% | 93% | 27% | 13% | 40% | 20% | 80% | 40% | 33% | 10/17 |
| Euronext Dublin — ISEQ 20 | 20 | 100% | 65% | 70% | 75% | 75% | 100% | 100% | 75% | 80% | 75% | 100% | 35% | 45% | 35% | 5% | 60% | 65% | 85% | 12/17 |
| Deutsche Börse — DAX | 42 | 100% | 74% | 71% | 83% | 71% | 95% | 95% | 48% | 90% | 79% | 98% | 64% | 74% | 93% | 31% | 43% | 38% | 79% | 13/17 |
| Wiener Börse — ATX | 22 | 100% | 77% | 68% | 45% | 27% | 100% | 100% | 55% | 77% | 64% | 100% | 27% | 27% | 59% | 18% | 45% | 23% | 64% | 10/17 |
| Borsa Italiana — FTSE MIB | 41 | 100% | 88% | 51% | 61% | 46% | 100% | 100% | 34% | 95% | 68% | 100% | 61% | 39% | 54% | 37% | 63% | 34% | 66% | 11/17 |
| BME — IBEX 35 | 35 | 100% | 91% | 34% | 71% | 43% | 100% | 100% | 34% | 83% | 80% | 100% | 46% | 34% | 54% | 31% | 74% | 40% | 66% | 11/17 |
| Nasdaq Stockholm — OMXS30 | 32 | 100% | 84% | 69% | 81% | 59% | 97% | 97% | 66% | 91% | 84% | 97% | 53% | 56% | 69% | 34% | 56% | 56% | 91% | 13/17 |
| Nasdaq Copenhagen — OMXC25 | 25 | 100% | 96% | 56% | 72% | 64% | 96% | 96% | 84% | 80% | 80% | 96% | 56% | 52% | 72% | 28% | 68% | 40% | 76% | 12/17 |
| Nasdaq Helsinki — OMXH25 | 25 | 100% | 96% | 80% | 80% | 56% | 100% | 100% | 60% | 92% | 96% | 100% | 64% | 52% | 84% | 48% | 64% | 52% | 92% | 14/17 |
| Warsaw Stock Exchange — WIG20 | 20 | 100% | 40% | 25% | 45% | 40% | 95% | 95% | 30% | 55% | 55% | 95% | 5% | 5% | 45% | 5% | 70% | 5% | 15% | 7/17 |
| Athens Exchange — Large Cap | 20 | 100% | 75% | 15% | 95% | 85% | 90% | 90% | 55% | 65% | 40% | 90% | 25% | 30% | 30% | 20% | 45% | 20% | 60% | 10/17 |
| Central and Eastern Europe — lead indices | 37 | 100% | 57% | 27% | 41% | 46% | 100% | 100% | 62% | 78% | 59% | 100% | 19% | 22% | 59% | 3% | 54% | 8% | 41% | 9/17 |
| SIX Swiss Exchange — SMI | 22 | 100% | 73% | 55% | 86% | 77% | 100% | 100% | 55% | 86% | 68% | 100% | 59% | 59% | 86% | 27% | 59% | 68% | 91% | 12/17 |
| Oslo Børs — OBX | 25 | 100% | 96% | 60% | 72% | 60% | 100% | 100% | 64% | 88% | 84% | 100% | 36% | 44% | 68% | 20% | 72% | 16% | 88% | 12/17 |
| London Stock Exchange — FTSE 100 | 100 | 100% | 73% | 60% | 93% | 80% | 95% | 95% | 65% | 89% | 83% | 95% | 51% | 52% | 71% | 28% | 56% | 48% | 80% | 13/17 |
| Europe's systemically important banks | 174 | 100% | 51% | 30% | 65% | 57% | 91% | 91% | 40% | 64% | 52% | 91% | 20% | 27% | 49% | 21% | 55% | 22% | 39% | 8/17 |
| European System of Central Banks | 28 | 96% | 32% | 25% | 64% | 39% | 89% | 89% | 32% | 86% | 50% | 89% | 11% | 0% | 29% | 11% | 50% | 7% | 25% | 7/17 |
| Central banks outside the EU | 4 | 100% | 50% | 25% | 50% | 50% | 75% | 75% | 50% | 50% | 25% | 75% | 25% | 25% | 75% | 50% | 50% | 0% | 50% | 6/17 |
| EU institutions and bodies | 17 | 100% | 59% | 53% | 65% | 12% | 88% | 88% | 18% | 76% | 53% | 88% | 29% | 12% | 29% | 6% | 0% | 0% | 35% | 8/17 |
| EU agencies and joint undertakings | 51 | 100% | 84% | 63% | 57% | 59% | 96% | 96% | 65% | 75% | 51% | 96% | 10% | 6% | 29% | 4% | 25% | 22% | 51% | 9/17 |
| Governments of the member states | 27 | 93% | 22% | 15% | 37% | 26% | 70% | 70% | 22% | 15% | 15% | 70% | 0% | 4% | 7% | 0% | 26% | 4% | 15% | 4/17 |
| Ministries | 12 | 100% | 0% | 8% | 92% | 8% | 83% | 83% | 0% | 92% | 17% | 83% | 0% | 0% | 25% | 0% | 0% | 0% | 33% | 5/17 |
| Agencies and independent bodies | 137 | 100% | 50% | 30% | 51% | 25% | 87% | 87% | 52% | 71% | 47% | 87% | 7% | 1% | 22% | 2% | 30% | 5% | 47% | 7/17 |
| Provinces | 12 | 100% | 83% | 58% | 42% | 25% | 100% | 100% | 83% | 83% | 75% | 100% | 33% | 0% | 8% | 0% | 33% | 0% | 67% | 9/17 |
| Water boards | 21 | 100% | 90% | 38% | 33% | 10% | 100% | 100% | 67% | 48% | 48% | 100% | 48% | 0% | 24% | 5% | 24% | 0% | 43% | 8/17 |
| Municipalities | 342 | 100% | 82% | 40% | 6% | 8% | 100% | 100% | 63% | 48% | 61% | 100% | 11% | 1% | 7% | 1% | 21% | 0% | 48% | 7/17 |
| Banks licensed in the Netherlands | 34 | 100% | 88% | 44% | 74% | 62% | 100% | 100% | 62% | 79% | 76% | 100% | 44% | 53% | 56% | 18% | 41% | 35% | 62% | 11/17 |
09 · Look up
Look up an organisation
Type a name or a domain. You get what DNS said, and what we concluded from it.
10 · The long tail
What else the records give away
Services ask their customers to prove a domain by publishing a record in it, and the records stay. These are the ones seen most beyond the seventeen layers, from certificates and security tools to whiteboards and design.
11 · Method
How this was measured
What we ask
For each organisation's mail domain: MX, NS (walking up to the zone that has them), TXT and SPF with its includes, _dmarc, the names Microsoft and Google tenants publish — autodiscover, selector1._domainkey, lyncdiscover, _sipfederationtls._tcp — Matrix's federation records, _matrix-fed._tcp and _matrix._tcp, the names Windows and phones look up to enrol with device management and register with a directory, enterpriseenrollment and enterpriseregistration, the names organisations hand to platforms — status, support, help, careers, jobs, git, gitlab, jira, nextcloud, owncloud — beside a name nobody uses that gives a wildcard away, and the DKIM selectors bulk-mail platforms sign with: Mailchimp's, SendGrid's, Brevo's, Mailjet's, Mandrill's, Salesforce Marketing Cloud's. For the website: A and AAAA and the CNAME chain behind them.
Every address met is looked up in Team Cymru's IP-to-ASN service, over DNS too. All 70,592 questions went to public resolvers run in Europe: DNS4EU, the EU's own, and Quad9, a Swiss non-profit.
What we read
Tracking, consent banners and chat windows live in a page, not in DNS, so each homepage was fetched once, as a browser's first visit without running its scripts: 1,183 of 1,340 answered with a page. We keep what it refers to — the scripts, frames, images and forms it loads, the addresses in its inline code, the hosts it links to — and look up the organisation's own hostnames it names, up to twelve, so the cloud layer sees more than the website.
Infrastructure
Email is whoever the lowest-preference MX host belongs to, a filtering gateway included: it reads every message first. Cloud is where the organisation's public hostnames run, the website's, the bare domain's and the ones its homepage names. DDoS protection is the CDN, DDoS shield or web firewall in front of them. DNS is the company most of the zone's name servers belong to.
Workplace
Office suite is a Microsoft 365, Google Workspace or other tenant proven by at least one of its records. Drives are where the files live: OneDrive and SharePoint, which come with a Microsoft 365 tenant, Google Drive, which comes with a Google one, Box's, Dropbox's and Tresorit's domain proofs, links to shared files and folders, and a nextcloud or owncloud server of its own, placed where it runs. Device management is where the laptops and phones enrol and register — Intune and Entra ID, Workspace ONE, MobileIron, Citrix — and the services the domain has proved itself to, such as Jamf; an enrolment server of its own counts where it runs. Video calls are Teams' discovery and federation records, the meeting services' domain proofs, and Google Meet, which comes with a Google tenant. Messaging is Teams again — a chat application first — Google Chat with a Google tenant, Slack's and Workplace's domain proofs, WhatsApp, Telegram and Signal links, the chat window on the homepage, and a Matrix server, placed where it runs. AI assistants are Copilot Chat, which comes with a Microsoft 365 tenant, Gemini, which comes with a Google one, the domain proofs ChatGPT, Claude, Mistral, Perplexity, Cursor, Kiro and others ask of a business customer, and the chatbots the homepage runs. An Amazon tenant brings no assistant: WorkMail comes with none, and Amazon Q and Bedrock are bought apart and publish nothing, so Amazon counts only where a record proves it.
Of OpenAI, Anthropic and xAI we have no information beyond a domain proof, and of xAI not even that: no record of Grok's was found. ChatGPT, Claude and Grok come with no office suite, and a proof says only that a domain was proved to them, not who uses them or how much; staff on accounts of their own, or calling the API, leave nothing in DNS or on a homepage.
Operations
Business apps are CRM, ERP, HR, recruiting, service-desk and data platforms — Salesforce, SAP, Dynamics 365, Workday, ServiceNow, Zendesk, TOPdesk, Snowflake — read from domain proofs, SPF, and the careers, support and help sites handed to them. E-signatures are DocuSign's and Adobe Acrobat Sign's domain proofs and signing forms. Dev tools are where code, tickets and wikis live: Atlassian's, GitHub's, Docker's and others' domain proofs and DKIM keys, links to GitHub, GitLab and Codeberg, and a git, gitlab or jira server of its own, placed where it runs. Monitoring is Dynatrace's and New Relic's domain proofs, the real-user monitoring and error tracking the homepage loads, and a status page.
Audience
Analytics & tracking is what the homepage loads to follow its visitors: analytics, ad and social pixels — Google, Meta, X, LinkedIn, TikTok — and the players and posts of platforms that track, such as YouTube and Vimeo. Matomo on a server of its own counts where that server runs. Cookie consent is the platform that asks visitors' consent — OneTrust, Cookiebot, Didomi — or a banner of the organisation's own, which counts where the website runs. Mail marketing is a newsletter or bulk-mail platform the domain lets send in its name — SPF, DKIM or a domain proof — or a sign-up form on the homepage.
On every layer but email, the office suite and DNS, organisations often run several platforms at once. Each is kept, and the layer counts as American when any of them is. 1,057 rules name the companies; anything unnamed falls back to the network's own registration, so every answer has an owner and a country.
Why the owner, not the data centre
The US CLOUD Act (2018) lets American authorities compel a US provider to hand over data in its possession, custody or control — including data stored in Frankfurt or Amsterdam, and including its foreign subsidiaries. So a provider counts as American if it is headquartered in the US or owned from there, and US Big Tech means Microsoft, Alphabet, Amazon, Apple and Meta, with what they own: GitHub, LinkedIn, WhatsApp, YouTube.
That is exposure, not a verdict of law: renting from an American company can be lawful. The question is who could be made to hand the data over — or, under American sanctions, to switch the service off.
What DNS and a homepage cannot see
DNS shows the front door. A mail gateway can sit in front of mailboxes elsewhere; a CDN hides the servers behind it; a tenant can exist and hold little, and a suite counts for what comes with it — OneDrive and Copilot Chat with Microsoft 365; Drive, Meet, Chat and Gemini with Google Workspace — whether or not its staff use them; of OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok a domain proof is all there is to see, so of their use we have no information; Teams leaves a record only when discovery or federation is set up; devices enrolled by invitation, or through Apple's and Google's own programmes, leave none. A service that asks for no domain proof leaves no trace either — many European e-signature, AI and business platforms do not ask for one, so those layers see American platforms more easily than European ones. A homepage can refuse a visitor it takes for a robot (we count those pages as unread, not as clean), load its trackers only after consent or through a tag manager whose code we do not run, or say nothing about the rest of the site. We report what the records prove and name the record, per organisation, under Look up. Absence of a record is not proof of absence of a service.
Who is included
The constituents of eighteen European stock indices; the banks the supervisors of the EU and EEA, the UK and Switzerland designate as systemically important (O-SIIs), less the European arms of American banks, and every bank licensed in the Netherlands in DNB's register; the EU's institutions and agencies and the heads of government of its 27 members; the European Central Bank and the central banks of the 27 members, Norway, Iceland, Switzerland and the UK; and every Dutch ministry, agency, province, water board and municipality in organisaties.overheid.nl. An organisation in two groups counts once.
How the top 10s rank
On every layer: first the number of layers at American companies, then how many of them at US Big Tech, then how many American platforms were found in all; the best need at least one layer at a European company, the worst at least one at an American one. On one layer: the best run it on a European company (the EU first), the worst on an American one (US Big Tech first, then the most American platforms on that layer), and each then ranks as on every layer. Organisations still tied share a rank.
Corrections
If a verdict is wrong, the record that caused it is on the organisation's card. It is often one left behind: a domain proof for a service long gone, an SPF include or a CNAME for a platform no longer used. Clean up the DNS first — the next scan reads the records as they are, and the verdict follows them.
If a current record is read wrong, tell us at hello@dopecode.com and it will be fixed in the rules, not by hand.