Know who holds the switch
Every cloud service, service provider and connected device has a switch: a law, an owner or an update channel. Plan EU shows where those switches are in your business, who operates them and how you stay in control, with European alternatives where they exist.
A law or a sanction
A foreign government orders a supplier to stop a service or hand over data. Mostly with American cloud and payment services.
An update channel
The manufacturer can reach the device remotely for updates and diagnostics. On every connected device, from bus to solar inverter, wherever it comes from.
A new owner
Your administrator or software supplier is acquired, and with it the law it falls under changes.
Where the switches are, by sector
- Mail and calendarEuropean: Infomaniak, mailbox.org
- Sign-in to all connected appsEuropean: Keycloak at a European host
- Card payments and PayPalEuropean: SEPA Instant, Wero
- Fund administration on US softwareSee the providers
- Investor portal and reporting
- Market data and price feeds
- Licences, updates and support
- Sanctions screening and KYC databases
- A provider with a new US owner
- Mail and sign-in
- Connected-car services in a US cloudEuropean: OVHcloud, Scaleway
- Card payments in showroom and workshop
- Design and product software with a US licence serverEuropean: Siemens (DE), Dassault (FR)
- ERP and dealer systems in a US cloudEuropean: SAP (DE)
- Parts catalogues and workshop portals
- Vehicle software updates
- Apps through the US app stores
- Licences and support
- Mail and sign-in
- Patient records if they run in a US cloudEuropean: ChipSoft (NL)
- Card payments at reception
- Appointment and patient portals
- Imaging and storage in the cloud
- Rosters and staff planning
- Medical software updates
- Licences and support
- Suppliers with a new US owner
- Mail and sign-in
- Electric buses and trucks with remote updatesAsk: can the channel be isolated?
- Fuel cards and card payments
- Transport and warehouse software in a US cloud
- Customer and carrier portals
- EDI links with shippers
- Map data and route planningEuropean: Galileo for positioning
- Licences and updates
- Apps through the US app stores
- Mail and calendarEuropean: Infomaniak, Proton, mailbox.org
- Card payments and payment buttonsEuropean: Adyen, Mollie (NL), Wero
- EV chargers and solar inverters connected to their manufacturer
- Accounting and CRM in a US cloudEuropean: Odoo (BE)
- Files and shared folders
- Online advertising and search visibility
- Licences and updates
- Apps through the US app stores
- Telephony and video calls
Typical switches per sector. The scan shows which apply to you.
In practice
Ruter looked for the switch, and found it
The Oslo transport operator tested a Yutong electric bus inside a sealed mountain. Through a SIM card, the manufacturer could reach the battery control system. Ruter did not park its fleet. It put a firewall on that single channel and tightened its procurement requirements. The Dutch VDL bus in the same test had no remote update channel.
The ICC chose a European workplace
After US sanctions, the chief prosecutor lost his Microsoft mail. The Court is moving to openDesk, a European open-source office suite. Microsoft disputes the account of what happened.
Both organisations went from concern to a concrete plan. That is what Plan EU is for.
Scan
Your domain and a short questionnaire show which switches you have, what stops in an outage and what keeps running.
Provider reports
Owner, software and hosting of your suppliers, all the way down the chain. With an alert when ownership changes.
Exit routes
A European alternative for each component, or a fallback where none exists. Aligned with NIS2 and DORA.
Not everything can be replaced
For smartphones, app stores and global card payments there is no full European alternative. There, Plan EU focuses on limiting the damage: a copy of your data, a fallback and paying through SEPA. The goal is to reduce the dependency, not to pretend it disappears.
Your chain, link by link
Choose a link. For each provider you see who owns it, what software and hosting the service runs on, and which European alternatives exist. We start with the financial sector.
Four questions for every purchase of connected equipment
- How does the device phone home?Over which connection, SIM card or cloud.
- Who controls that connection?And which law applies to that party.
- Can you isolate the channel?Or hold updates for inspection before they are installed.
- What does the contract say about misuse?If the access is used without your consent.
Derived from the test carried out by Ruter in Norway in 2026.
The first reports for this link are in preparation. Tell us which provider you use and we will review it first.
Reports on named companies are only published after the company has had the opportunity to respond.
Microsoft 365
Mail, documents, collaboration and identity in one environment
Risk by criterion
Register details
- Function under DORA
- Usually supports a critical or important function
- EU contracting party
- Microsoft Ireland Operations Ltd.
- Ultimate owner
- Microsoft Corporation, Redmond (US)
- Exit effort
- Medium · 3 to 6 months planned, 72 hours in an emergency with preparation
- Last checked
- 8 October 2026
European alternatives
| Alternative | Replaces | Effort | Note |
|---|---|---|---|
| Infomaniak kSuite (CH) | Mail, calendar, storage, chat, Office online | Low | Swiss, not EU. The Business plan includes Microsoft Office Online. |
| openDesk via partner (DE) | Full suite | Medium | Available through private providers since September 2026; offering still growing. |
| Nextcloud + mailbox.org (DE) | Storage and mail separately | Medium | Two suppliers, two contracts. |
| Element (Matrix) | Teams | Medium | Only needed if Teams is actually used. |
Microsoft 365 exit planTriggers, a 72-hour emergency route, migration steps and contract points, ready for your NIS2 or DORA file.
Request the templateScores are a reasoned judgement under our method, not legal advice.
Which switches sit on your domain?
The scan reads your domain's public DNS records: where your mail arrives, which services send mail on your behalf, who manages your domain and where your website runs. You then see, for each part, whether a foreign switch is attached.
PRIVACYWe do not store your domain or the result. The scan only uses public data and the result stays in your browser.
What the scan checks
- EmailWhich company receives your mail (MX record).
- SendingWhich services send mail on behalf of your domain, such as newsletters (SPF record).
- Connected servicesWhich services have verified your domain, such as Microsoft 365 or Google.
- Domain and websiteWho manages your DNS and where your website runs.
What is not in DNS, such as your bank, administrator or equipment, we map with a short questionnaire.
Scanning …
Result for
What the scan cannot seeYour bank, administrator, payment chain and connected equipment are not in DNS. A short questionnaire completes the picture.
Request the questionnaireHow we assess
Plan EU assesses every switch outside Europe, whether it sits in the US, China or elsewhere. Origin alone is not enough: what matters is who operates the switch, under which law, and how much goes down at once. Each supplier gets a score from 1 (low risk) to 5 (high risk) per criterion, with a one-line rationale and a source. The overall score is a judgement, not a sum: one very high risk can decide it.
- OwnerWhere does ultimate control sit, and is there a parent or subsidiary outside Europe?
- Legal accessCan foreign authorities demand data, as under the US CLOUD Act?
- Sanctions riskCan sanctions or export controls stop the service, and has that happened before?
- ConcentrationHow many functions go down at once if this supplier fails?
- Hosting and remote accessWhere does the service run, on whose infrastructure, and who can reach it remotely?
What we count as European
The countries of the EU and the EEA, Switzerland and the United Kingdom. Switzerland and the UK are outside the EU, but offer comparable data protection and no foreign switch on European services.
Independent, and without a switch ourselves
Plan EU accepts no commissions or affiliate fees from suppliers or implementation partners. Companies we assess can respond before a report is published.
We practise what we advise. Plan EU runs on a .eu domain, managed by EURid in Belgium, and is hosted in Germany by a European provider. Our fonts are served from our own server, and we use no tracking cookies or American analytics services.
Free insight, paid plan
The scan and the public reports are free. You pay for the plan, the monitoring of your chain and help with implementation. During the beta we are setting the plans together with our first customers.
Free
- Scan of your domain
- Public reports
- Nothing stored
Basic
- Full scan with questionnaire
- Exit routes per component
- Alerts when your suppliers change owner
Sector
- Everything in Basic
- Sector module and provider reports
- Exit plan templates for your NIS2 or DORA file
- Questionnaires for your suppliers
Advisory
- Workshop with the board
- Migration support
- Multiple entities or a whole chain
Join the betaThe first participants get the full scan and an exit plan for their most important supplier, and help shape what Plan EU becomes.
Join the betaPlan EU accepts no commissions from suppliers or implementation partners.
Get in touch
Request a template or questionnaire, join the beta, or tell us which supplier we should review first.
Privacy notice
Plan EU collects as little data as possible and keeps it no longer than necessary.
Who we are
Plan EU is an initiative of Luce Holding B.V., Broekweg 2B, 3972 MC Driebergen-Rijsenburg, the Netherlands, Dutch Chamber of Commerce number 82223599. Luce Holding B.V. is the controller for the data processed on this site. You can reach us at info@plan-eu.eu.
The scan
We do not store the domain you enter or the result of the scan. The scan only uses public DNS data and the public IP address registries. To prevent abuse, we briefly count how many scans come from one address, using a code that cannot be traced back to you and that disappears within an hour.
The contact form
We use your name, organisation, email address and message only to respond to your request. We keep them no longer than twelve months after our last contact, unless you become a customer. We share them with no one and never sell them.
Cookies and analytics
We use no tracking cookies and no advertising or analytics services. If you choose a language, we remember it with one functional cookie.
Where your data is kept
The site and the mail run at a European hosting provider in Germany. No data goes to companies outside Europe.
Your rights
You can access, correct or delete your data. Email privacy@plan-eu.eu. If you have a complaint, you can contact the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.