“Sovereign” has become an easy word to use
“Sovereign” has become a common software selling point. To me, the word is only useful when it describes concrete technical and operational choices.
A company can be French while relying almost entirely on non-European infrastructure or providers. That is not necessarily bad in itself, but it is not the definition I use for tarteaucitron.io.
Infrastructure hosted in France
tarteaucitron.io is hosted in France. This is deliberate, just like my preference for French or European providers for the vast majority of the services needed to run my business.
This consistency matters to me because a CMP sits in a particular place on a website: its purpose is precisely to manage third-party services and privacy choices.
It would feel strange to defend control in the browser while building the entire product infrastructure around a chain of dependencies I do not control.
Sovereignty does not stop at the company address
I therefore look more at the architecture than at the flag displayed on a marketing page. Where are the servers? Which intermediaries are required? Which providers are involved in daily operations? Which dependencies can affect the product?
These questions give the term meaning. Relying heavily on a US cloud provider or routing traffic through a global infrastructure such as Cloudflare is not the same architecture as directly hosting a service in France.
Fewer dependencies are also an architectural choice
This follows the same logic as my choice to stick to plain JavaScript. tarteaucitron does not need a stack of external browser libraries to work.
Every dependency avoided is one less component to monitor, update, audit or depend on. This is not only about performance; it is also about keeping control of the product.
Open source and sovereignty are not synonyms
Open source provides another form of control: the code can be read, audited, modified and self-hosted. That matters for tarteaucitron and will remain part of the project.
But open-source software can still rely on many external services. Conversely, a hosted service can retain a tightly controlled architecture. The two ideas complement each other without being identical.
A choice I have made for years
I do not want to turn “sovereign” into a marketing label. It is mainly a constraint I set for myself: French hosting, mostly French or European providers, few dependencies and an architecture I can understand and maintain.
Sometimes that is less convenient than immediately using the most popular global service. But for a product dedicated to consent and privacy, that consistency matters to me.
