Walk the Talk: Our Journey to Internal Digital Sovereignty
Practicing what we preach
Exolynk exists to give organizations sovereign, connected, Swiss-hosted infrastructure for their operational data. Our platform has always lived up to that promise. Our internal office tools? Not so much. Changing that has been on our agenda for a while, but replacing an entire internal toolstack takes more effort than most people expect.
Like most startups, we built our early workflows around whatever worked fast — Google Workspace for email and docs, a US-hosted SaaS tool here, a free-tier cloud service there. Pragmatic choices, all of them. But over time they accumulate into something that contradicts the very thing we stand for.
The Cloudflare outage in November 2025 made this visible in a different way. A single misconfigured file at one US infrastructure provider briefly disrupted millions of websites, APIs, and services, including some of our own dependencies. It wasn’t a catastrophic failure for us, it only affected some internal services. But it was a reminder: digital supply chains are invisible until they break.
Digital supply chains are invisible until they break.
So we decided to do something about it. This post is our public commitment to that effort — and a transparent record of where we are.
Why internal sovereignty matters
We often talk about sovereignty in terms of our customers’ data. But the principle applies equally to us as a company. When our team’s communication runs through servers we don’t control, when our documents live in US-based clouds subject to foreign jurisdiction, when our analytics platform is Google — we’re not walking the talk.
That’s not a comfortable position for a company selling sovereign infrastructure.
Beyond the philosophical inconsistency, there are practical reasons:
- Legal exposure. Data about our team, our customers, and our business processes has regulatory relevance under Swiss DSG and EU GDPR. Hosting that data in environments subject to US CLOUD Act reach creates unnecessary risk.
- Concentration risk. The more critical functions run through a single large provider, the larger the blast radius of any outage or policy change.
- Vendor dependency. Pricing changes, feature removals, or account lockouts at a cloud provider can disrupt operations in ways that self-hosted alternatives don’t allow.
None of this means we expect to eliminate third-party dependencies entirely. That’s not realistic, and chasing zero-dependency purity creates its own fragility. The goal is conscious, auditable, manageable dependencies — not none.
Our migration tracker
Below is our live status overview. We update this as we migrate. The status column reflects where we actually are — not where we’d like to be.
Status legend:
Replaced — Migration complete, old tool decommissioned
In Progress — Actively migrating; parallel operation
Planned — Decision made, migration scheduled
Evaluating — Shortlisting alternatives, not yet decided
On Hold — Acknowledged but deprioritized for now
| Category | Current Tool | Sovereign Alternative | Status | Notes |
|---|---|---|---|---|
| Web Analytics | Google Analytics | Umami (self-hosted) | Umami live on our own EU infrastructure; GA kept in parallel temporarily to validate migration data — will be removed once comparable  | |
| Email & Calendar | — | Candidate: Proton Business  | ||
| Confluence & Docs | — | outline | self-hosted | |
| Team Communication | — | Candidate: Proton Business | ||
| Video Conferencing | Google Meet | — | Candidates: Proton Meet | |
| Password Management | Apple Passwords | — | Candidates: Proton Pass | |
| Code Hosting & CI/CD | GitHub | — | Migration effort high; evaluating Codeberg 
, Gitea | |
| Design Tools | Miro | — | Candidate: Penpot (open-source Figma alternative) | |
| CRM / Customer Data | — | Exolynk | we use our own platform | |
| Monitoring & Alerts | — | Uptime Kuma | self-hosted | |
| Website | WordPress | Hugo | self-hosted — no 3th party plugins | |
| Newsletter | Mailchimp | Brevo | — |
What we’ve learned so far
It’s harder than the product demos suggest. Every tool we evaluated for replacement comes with friction: import formats that don’t match, workflows that need to be rebuilt, team habits that are deeply ingrained. This is real, and we don’t want to pretend otherwise.
Self-hosted isn’t free. Running your own infrastructure costs time — someone has to maintain it, update it, back it up. For a small team, this overhead is significant. We’ve chosen to absorb it where the sovereignty benefit is highest, and to use trusted European SaaS alternatives where self-hosting isn’t practical.
The supply chain goes deeper than the app. Even when we move to a “sovereign” tool, we still depend on its underlying libraries, CDNs, and infrastructure. True sovereignty is about knowing your dependencies and managing concentration risk — not pretending you have none.
Replacing analytics is not a one-click switch. We’ve already deployed Umami — open-source, self-hosted on our own EU infrastructure, cookie-free, no data leaving our control. But we’re running Google Analytics alongside it for now. The reason is practical: after migrating from our old website, we need a comparison baseline to validate that traffic numbers are consistent and that the new site is performing as expected. Once we’re confident the data is comparable, Google Analytics goes. Not “someday” — it’s already scheduled. This is exactly the kind of transitional honesty we think is worth documenting.
Transparency creates accountability. Publishing this list publicly is intentional. It makes it harder to let things slip. If we update this post six months from now and the statuses haven’t moved, we’ll have some explaining to do.
What’s next
We plan to update this page as migrations complete. Our near-term priorities are email/calendar (highest daily impact), password management (security-critical), and cloud storage (most data exposure).
If you’re on a similar journey — whether as a company or as an individual — we’d like to hear from you. What tools have you found that actually work? Where have the transitions been rougher than expected?
And if you’re thinking about what this means for your own organization’s data, let’s talk .