01Sovereignty
Full sovereignty is impossible for most of your stack. For analytics, it isn't.
Nobody can run a European phone, a European GPU fleet or a European office suite today. Analytics is different: every component of an analytical data platform exists as open source or as a European service, so a European company can run all of it. We do, and we publish who touches what so you can check.
02What sovereign means here
Three facts, not an adjective.
Where
Your tables, their metadata, the daily backups and the maintenance that compacts them run in Germany: Nuremberg for compute and block storage, Falkenstein for backup object storage, on infrastructure from Hetzner Online GmbH.
Who
Tablemere SL, a company in formation in Spain. The Terms and the data processing agreement are drafted under Spanish law with the courts of Madrid. They are still drafts, and the Terms say so at the top.
What you leave with
Apache Iceberg tables and Parquet files. DuckDB, PyIceberg and Spark read them today, on our service or after you copy them out. Nothing here is a format you would have to leave behind.
03Who touches what
Every party in the path, by name.
Services we buy. Each row names the company, its role and the place where the work happens.
| Role | Provider | Where |
|---|---|---|
| Compute and block storage | Hetzner Online GmbH | Nuremberg, Germany |
| Backup object storage | Hetzner Online GmbH | Falkenstein, Germany |
| Transactional mail | Scaleway SAS | Paris, France |
| Company mailboxes | Infomaniak | Switzerland |
| TLS certificates | Let's Encrypt (ISRG) | United States |
| Operator | Tablemere SL | Spain |
Let's Encrypt is a certificate authority. It signs the certificate for our hostnames; it is not in the data path and never sees your traffic or your data.
Software we run ourselves, on our servers. All of it is open source; the licences are permissive and the code is already in our hands.
| Software | Role | Licence |
|---|---|---|
| Apache Iceberg | Table format | Apache-2.0 |
| SeaweedFS 4.47 | Catalog and object store, one system | Apache-2.0 |
| DuckDB | Query engine in the browser panel, served from tablemere.com | MIT |
| Caddy | TLS termination and reverse proxy | Apache-2.0 |
| Rauthy | Sign-in for people (OpenID Connect, passkeys) | Apache-2.0 |
Ports, credentials, backups and what is not yet done: the security overview.
04Four questions
Data location is the weakest form of sovereignty. Ask three more.
| Level | The question | Tablemere |
|---|---|---|
| Residency | Are the bytes, the metadata and the backups in the EU? | Yes: bytes, metadata, backups and maintenance in Germany. |
| Operator | Who operates the service, and under which company law? | Tablemere SL, Spain. No US-controlled company operates any part of the service or holds your data; no managed service from a US provider is in the data path. |
| Format | Can you leave with your data, in a form standard tools read, without asking? | Yes: Apache Iceberg and Parquet; export with standard tools at any time. |
| Software | Does the platform depend on a licence a vendor can revoke? | Open source we run ourselves; the list is above. |
05Ledger, checked 2026-09-20
What we still depend on outside the EU.
A hostile reader will check, so we list it first. None of these parties holds customer data or sits in the data path. Each entry says what an outage or a withdrawal could affect. We re-check this list and change the date when we do.
| Dependency | Who | What it can affect | What it cannot affect |
|---|---|---|---|
| Source code hosting | GitHub (Microsoft, US) | Where we collaborate on the code and where CI runs. Every checkout is a full copy of the repository. | The running service, your data. |
| Container images | Docker Hub (SeaweedFS, Caddy) and ghcr.io (Rauthy), US registries | Pulling images for a new deployment. Images are pinned by digest; a registry outage delays a deploy, not the service already running. | The running service, your data. |
| TLS certificates | Let's Encrypt (ISRG, US) | Certificate renewal for our hostnames. A withdrawal would mean changing the certificate authority. | Your data; the certificate authority never sees traffic. |
| DuckDB extensions on your side | DuckDB's extension repository, on your machine when you run INSTALL iceberg | Installing the engine where your agent runs. Our browser panel serves DuckDB and its extensions from tablemere.com instead. | Your stored tables; any Iceberg reader can read them. |
Mirrors for the source code and the container images inside the EU are planned; there is no date. When they exist, this ledger will say so with the date of the check.
06The other answer
Or run it yourself.
Use our managed service or deploy Tablemere on your own infrastructure. The same containers run on your own servers, in your own jurisdiction, with your own identity provider, and the tables they hold are the same Iceberg tables. If the question is not who we are but who anyone is, that is the answer: Self-hosted.
The documents behind this page
- Security overview: who operates it, isolation, credentials, backups, and what is not yet done.
- Data processing agreement (draft).
- Privacy policy (draft).
- Terms of Service (draft, Spanish law, courts of Madrid).
Check it yourself.
Create a catalog on the free plan, 5 GB stored, no card. Read the security overview, then the ledger above, and write to us with what you find.