US tech giants are a single point of failure. Trade tariffs shift overnight. Administrations change their minds about data-sharing agreements. The transatlantic privacy framework could collapse again with one court ruling. If you run your own infrastructure, the move is obvious: self-host and buy European.
I run a software studio out of southern Spain. I operate under GDPR, and my users expect real privacy. The simplest way to keep user data out of a cross-border jurisdictional mess is to not let it cross the border in the first place.
There is a difference between an app that collects no data and a business that collects no data. The app is a deliberate technical choice. The business is a fiction.
Even with a strict local-only design for something like Kofte, the real world breaks in. Building decent software means talking to the people who use it. You keep a list of beta testers. You get a panicked email when an OS update torches someone's local storage. The moment a user writes to your support address, you are processing personally identifiable information.
Running a studio means running under GDPR. The lazy version of compliance is bolting a cookie consent modal onto your website and moving on with your life. The serious version is structural.
Working in security and compliance teaches you a specific kind of paranoia. You learn to pour the legal foundation before the house is finished, because retrofitting compliance into a live product with actual users is a nightmare you do not want. Scaling is not just about database queries. It is about the compliance overhead that scales right alongside them.
The rule at Lethio is blunt: if I do not need the data, I refuse the liability of holding it. For data I cannot avoid collecting, the constraints are rigid.
Purpose limitation is an engineering constraint, not a policy document. A beta tester's email address distributes builds and collects feedback. It does not get piped into a marketing CRM. It does not end up in a custom audience list on an ad platform. One function, firewalled from everything else.
This is where the hosting decision matters. When a bug gets logged from user feedback, it goes into a Meister project board. Meister is Austrian. The personal data never leaves the European legal jurisdiction. No Standard Contractual Clauses, no adequacy decisions, no transfer impact assessments. You skip the entire paperwork industry that exists to justify shoving data across the Atlantic.
You do not need a sprawling AWS deployment for everything. For a blog, a static site, a small server project — Hetzner is excellent. German company. Bare metal performance is strong, and bandwidth costs do not feel like a cartel shakedown. Pair a cheap Hetzner box with a European CDN and you have a solid stack for a fraction of the hyperscaler price.
If you want to audit your own setup, European Alternatives is a straightforward directory of EU-based software and services. It manages to list them without the foaming-at-the-mouth political rhetoric that usually poisons tech sovereignty conversations. Refreshing.
Retention is the part most developers skip. We hoard data out of habit. A support email from three years ago has zero operational value, but it sits in an inbox until the heat death of the universe. The fix is automated deletion with aggressive retention windows. Fix the bug, close the ticket, let the server purge the record.
You cannot ship useful software in a vacuum. You will touch user data. The point is to handle that unavoidable minimum with the same paranoid, privacy-first engineering you put into the application code itself.