Ethical Tech

The Ethical, EU-First Tech Stack for Small Businesses

The tools I run this practice on and set up for clients, chosen for EU data residency and independence from Big Tech, and the catch behind each choice.

19 Jul 2026 · 5 min read · By Sophie Kazandjian

In February 2026 I cancelled ChatGPT the week OpenAI signed its Pentagon deal. I switched straight away. An afternoon of exporting my work and it was done. The most capable tool I run is still American, and I have chosen to keep it: Claude does the hardest work here, and I stay uneasy about depending on it. That is the real shape of leaving Big Tech: a sequence of small migrations, each with a trade-off you have to be willing to name, and one or two you decide to live with.

What follows is the stack I run Sophie's Bureau on, and the one I set up for the consultants and founders I work with as their digital operations partner. It is arranged by the job each tool does. Behind every choice sits a longer piece with the full working, and a catch, because there is always a catch.

The deadline that made this less optional

The next set of EU AI Act obligations lands on 2 August 2026, and most of the writing about it is pitched at enterprise compliance teams. The rules reach solo consultants and small values-led businesses too, quietly, which is why I wrote a plain-language guide to what is actually in scope. Underneath the deadline sits an older problem. American software answers to the US CLOUD Act, so once an American company controls the server, where your data physically lives stops being the whole story. For a practice that recommends European hosting to its clients, running its own operations through US tools had become hard to account for.

The database: SeaTable

Airtable ran the CRM and project tracking here for two years. It is a fine product, and an American one whose free tier keeps narrowing. I moved to SeaTable, a German-built no-code database with EU data residency by default, and the migration, which I documented in full, hurt less than I expected. For a solo operator the free plan now covers more than Airtable's does.

The trade is real though. SeaTable's community and template library are smaller, so you build more from scratch. If your work leans on a specific Airtable integration, check it exists before you commit to the move.

Automation, and the catch nobody mentions

Zapier is the default, and it is American. When I went looking at the European alternatives, the surface answer came easily. Make, n8n and Activepieces all exist, and several host in Frankfurt. The catch sits underneath. Hosting in the EU is not the same as being controlled from the EU. n8n Cloud runs on Microsoft Azure; Activepieces is an American company whatever its licence says. For broad client work I have settled on Make for now, and where a flow needs to stay fully in Europe, a small self-hosted n8n on a rented European server is the cleanest answer, provided you accept that you are the support desk when a node stops firing on a Friday.

There is a third route that bends the rule. For a defined job, a Cloudflare Worker is American infrastructure, and I reach for it anyway. The free tier swallows the volume, the logic sits in one file I can read, and the credentials stay with me, scoped to exactly what the job needs. Owning the code turned out to buy more control than avoiding an American flag does. That is the kind of trade this whole exercise keeps throwing up. Cloudflare is still American, which is why the direction I am moving is Scaleway, a French cloud with the same serverless building blocks. The code stays mine; the infrastructure under it turns European.

AI: the part I have not solved

I moved to Claude as my primary tool after cancelling ChatGPT, and I will say plainly that it is the most capable thing I have used for complex, multi-step work. Claude is also US-based. So the position is a compromise, and I would rather say so than dress it up.

The research that used to run through Perplexity now goes through Mistral Le Chat, French-headquartered, GDPR-compliant, and built on open-source models. It came out on top of my scored review of the ethical alternatives, and the pairing I actually work in is those two: the European one for most of the searching, the American one for the hardest reasoning. Where a job can carry lower accuracy, GreenPT is the greener choice, Dutch and EU-only, though not yet at the level of the other two. For client work where the data should not leave Europe at all, I mapped out a fuller EU-residency AI stack separately. One rule sits over all of it, and it does not bend: no identifiable client data goes into any of them.

The everyday two: browser and analytics

Two smaller changes did more for the daily feel of the work than any of the big migrations. I replaced Chrome with Brave, which blocks trackers by default and, as a side effect, makes the web quieter. And I pulled Google Analytics off every site I run, moving to Simple Analytics after a short detour through Fathom. Writing about data sovereignty with Google's script loading on my own pages had started to feel like a small hypocrisy.

A caution on the AI-browser wave, since it overlaps here. The agentic browsers that promise to click around the web for you are useful and not yet safe from prompt injection. I use them, carefully, and never on anything holding client credentials.

Talking to people without Meta in the middle

Messaging carried the most social friction, because it depends on other people moving too. For most clients my advice is small: install Signal and shift one important conversation there. If you want to go further, Delta Chat builds on email infrastructure rather than one company's servers, which is why I started there myself. The one to avoid is Telegram, whose ordinary chats are not end-to-end encrypted despite the reputation.

Leaving the Meta platforms took longer and needed doing in order. I exported the data first, checked what relied on Facebook login, then moved across to Mastodon, Pixelfed and Bluesky, a move I wrote about. The first two are federated and open; Bluesky is American and the busiest of the three, which is the trade that keeps me findable. The reach is smaller than Instagram. Conversations are better, though, and nobody is selling the room.

Forms: Tally

The smallest decision, and the one I was most careful about, because forms carry the most sensitive data. I needed something I could trust with Cyber Essentials evidence. After testing six builders, Tally came out ahead, with one contender disqualifying itself by being acquired by an American company partway through the review.

None of this is finished, and I have stopped treating it as a project with an end. Claude, the tool I lean on most, is still American. My automation still runs on someone else's server more often than I would like. Sovereignty turned out to be a direction rather than a place you arrive at. What I can answer now, when a client asks, is where every piece of their data sits and who ultimately controls it. A year ago I could not.

If you would like an operations setup that keeps your clients' data in Europe and out of Big Tech's hands, get in touch. It is the kind of work I do as a digital operations partner.

Back to the Journal