Is 'EU-Only' Just Marketing? Verifying Sovereignty Claims After Pushin.eu and Statichost.eu

Two European hosting products trended on Hacker News within a day of each other in early September 2026. Pushin.eu ("Git hosting that never leaves Europe") pulled in roughly 370 points and 169 comments on 5 September (HN thread). Statichost.eu ("European static site hosting") did even better the day before -- about 502 points and 244 comments (HN thread). Both pitches lean on the same word: sovereignty. Both threads produced the same kind of reply: developers asking, politely but pointedly, how do we know that's actually true?

That's a fair question, and it's answerable. Below is what we found when we checked both claims ourselves -- against the live sites, the actual page source, and the public HN record -- plus the checklist we used, so you can run it against any "EU-sovereign" pitch you're evaluating, including ours.

Case 1: Pushin.eu -- a real infrastructure claim, zero trust signals at launch

Pushin's core technical claim checks out. The founder states the platform runs "on bare-metal servers that we operate in Scaleway's Paris datacenters. Scaleway is a French company, and nothing fails over to a US region" -- and separately commits that "we don't use your code to train models, and we don't let partners either -- no exceptions, no fine print, no quiet opt-out buried in the terms." Those are specific, checkable claims, not vague marketing copy.

What the launch was missing was everything around that claim. The top comment on the HN thread, from user sevenseacat, put it bluntly: "Nice idea, zero trust signals. Don't even see company details or the folks behind and no legal pages." Another commenter, rapnie, generalized the pattern: "So often when something launches, these are missing... People apparently just sign up for such services, but I would want to know these details in advance." The founder, posting as pjullrich, owned it directly: "Sorry this escaped containment before I was able to update the landing page... I focused on the UX of the platform instead of the marketing materials aka. Landing page."

Credit where due: by the time we checked the live site, Terms of Service and a Privacy Policy were both linked in the footer -- added within roughly 48 hours of the criticism, which is a genuinely good signal about how the founder responds to feedback. Still missing as of writing: an Impressum-style legal notice (company registration number, registered address independent of the founder's personal details), and a public pricing page -- the FAQ says pricing will be "comparable to GitHub and GitLab" but names no figures. Combined with the single-founder, invite-only-beta status, that's less a sovereignty problem and more a continuity question: if the founder disappears tomorrow, what happens to your repositories? That's a real, separate risk from "does my code stay in the EU," and threads like this tend to bundle the two together.

Case 2: Statichost.eu -- documentation exists, but it says something the site doesn't do

Statichost.eu is not actually a new launch -- HN's own record shows submissions about it going back to February 2024, plus a widely-read post about a Google Safe Browsing false-positive incident in October 2025 (HN Algolia). The September 2026 thread was a resurgence of attention on an already-running product, based in Stockholm ("c/o Knackeriet, Sankt Paulsgatan 25") under founder Eric Selin, with legal pages already in place: /about, /terms, /dpa, /privacy.

That's a stronger starting position than Pushin's launch-day state -- but the HN thread found a real discrepancy inside those documents, and we verified it independently rather than taking the thread's word for it. Statichost's own privacy policy states: "We do not use any third party data processors for website data," and separately that it collects "anonymous website usage statistics... without processing any personal data." We pulled the live homepage source directly:

$ curl -s https://www.statichost.eu/ | grep -io "simpleanalytics[a-z0-9./_-]*"
simpleanalyticscdn.com/latest.js
simpleanalyticscdn.com/noscript.gif

The Simple Analytics script is loaded on the homepage -- which is exactly what HN commenter gls2ro flagged during the thread. That's a genuine inconsistency between what the privacy policy claims ("no third party data processors") and what the page actually does (loads a third-party script).

Here's the nuance worth getting right, since it's easy to overstate: Simple Analytics is itself a Dutch company that stores data in the Netherlands and Germany, uses no cookies, and states it does not collect personal data or fingerprint visitors. This isn't a CLOUD Act or third-country-transfer problem in the way it would be if the script were, say, Google Analytics. It's a narrower but still real issue: a privacy policy that says "we don't use third-party processors" is factually wrong the moment any third-party script loads, regardless of how privacy-respecting that script is. Precision in a privacy policy is not optional, and "technically it's a privacy-friendly vendor" isn't the same claim as "we don't use one."

Two other points from the thread are worth citing for balance, because they cut against a simplistic "sovereignty violation" reading. Commenter ruuda noted the site's TLS certificate is issued by Let's Encrypt, whose operator (Internet Security Research Group, ISRG) is a California-based 501(c)(3) nonprofit. That's true -- and it's true of the overwhelming majority of TLS certificates on the internet, EU-sovereign marketing sites very much included (we checked; more on that below). It's a fair thing to know, not a smoking gun specific to Statichost. Commenter woadwarrior01 raised the marketing site's own hosting location as a separate, minor inconsistency. Pricing drew its own thread: sparkling called the entry tier "weird" ("you can get a decently sized VPS for that money") and FabCH/gbxbxbcbd flagged the bandwidth overage cost as high versus AWS. We pulled the actual tiers from the live pricing page to check:

That's a fair, verifiable pricing complaint -- a completely different axis from the sovereignty question, and one every buyer should evaluate on its own terms rather than as evidence for or against the EU claim.

What both cases actually show

Neither Pushin nor Statichost lied about where their servers sit. What both threads surfaced is a gap between the headline claim ("never leaves Europe," "European infrastructure, European values") and the trust surface a developer needs to verify that claim without just trusting the copy: legal entity details, an accurate privacy policy, and a page source that matches what the policy says it does. That gap is common enough across the "EU-sovereign" hosting category right now -- fueled by real, justified demand for CLOUD Act-free infrastructure -- that it's worth having a repeatable way to check it, rather than re-litigating it thread by thread on Hacker News.

A developer's verification checklist

None of this requires legal training. It requires five minutes and a terminal.

1. Legal entity, not just a founder's name. Look for a company registration number and registered address (Germany: Impressum with HRB number; most EU states have an equivalent). "c/o [address], founder [name]" is a start; a registration number you can look up independently is the actual signal.

2. Read the privacy policy against the page source, not against the marketing copy. Policies get written once and pages get updated constantly -- they drift.

# what third-party domains does the homepage actually load?
curl -s "https://TARGET_DOMAIN/" \
  | grep -oE 'https?://[a-zA-Z0-9.-]+' \
  | sed -E 's#https?://##' | sort -u

Cross-check every domain that isn't the target itself against the privacy policy's list of processors/sub-processors. If the policy says "no third parties" and something shows up, that's your answer -- as it was here.

3. Check the DPA for a named sub-processor table, not a vague "trusted partners" clause. A real Data Processing Agreement lists who processes data on the provider's behalf, what for, and where -- so you can evaluate GDPR's transfer rules yourself (Art. 28 GDPR governs processor obligations including sub-processor disclosure; Art. 44 GDPR sets the general principle that any transfer outside the EU/EEA needs a valid legal basis). A DPA that names zero sub-processors either means there genuinely are none, or means it hasn't been written carefully -- worth asking directly.

4. Note the TLS certificate authority, but weight it correctly. openssl s_client -connect TARGET_DOMAIN:443 -servername TARGET_DOMAIN 2>/dev/null | openssl x509 -noout -issuer will very likely show Let's Encrypt (ISRG, US-incorporated nonprofit) for almost anyone, sovereignty claim or not -- it's the default CA for the entire web. Don't treat it as a unique red flag against one vendor; do treat "we've solved this with an EU-based CA" as a real differentiator if a vendor actually claims it.

5. Separate pricing/reliability concerns from the sovereignty question. They get argued in the same thread but they're different risk categories -- one is "where does my data legally sit," the other is "will this vendor still exist, and can I afford it, in a year."

Running the same check on us

We ran step 2 against our own marketing site before publishing this. It loads Google Tag Manager (googletagmanager.com) -- a US company, on the public marketing pages, for the usual reasons every SaaS marketing site has analytics. That's a fair thing for a reader to flag, and it's a good illustration of why step 5 above matters: our product infrastructure and DPA are a separate scope from our marketing site's analytics stack, but a checklist run from the outside doesn't know that distinction unless it's stated -- so we're stating it here.

What we do publish, and what we'd point any reader running this checklist at us toward: a legal entity with a public registration number (mamarx GmbH, HRB 213877 B, Amtsgericht Charlottenburg), and a DPA that names actual sub-processors with locations -- including the two that aren't purely EU-incorporated (Supabase Inc. and Anthropic PBC, both scoped to specific, opt-in features -- the Anthropic entry applies "ONLY if the Controller chooses to install the sota.io Claude connector," backed by Standard Contractual Clauses under Art. 46 GDPR plus explicit consent under Art. 49(1)(a) GDPR as an additional safeguard), rather than a blanket "100% European" claim that a five-minute check could contradict. If you're evaluating any hosting vendor's sovereignty pitch -- ours included -- that's the level of detail worth asking for before you trust the headline.

For the underlying legal reasoning on why data location and jurisdiction matter for a US-owned versus EU-owned host in the first place, see our GitHub EU alternatives guide, which covers the CLOUD Act mechanics this whole category of product is built to avoid.