Security & Privacy

ExpressVPN / PIA 🇻🇬🇺🇸 non-EU

Offshore VPNs owned by a single advertising-adjacent group.

• Mullvad VPN Gothenburg's account-number-only VPN; you can literally pay in cash. 🇸🇪
• OVPN Swedish provider running diskless servers it owns outright. 🇸🇪
• AirVPN Italian activist-run VPN with deep configuration control. 🇮🇹
• Surfshark Amsterdam-headquartered VPN with unlimited devices. 🇳🇱

Google Authenticator & Microsoft Authenticator 🇺🇸 non-EU

The codes guarding everything else, kept by the companies you were guarding against.

• Proton Authenticator Geneva. Free, open source, no account required, and it runs on Windows, macOS and Linux as well as your phone. 🇨🇭
• Aegis Authenticator Dutch and open source. Android only, everything stays on the handset, and the encrypted backup is yours — the part Google Authenticator does worst. 🇳🇱
• Yubico Authenticator Stockholm. The secrets live on a YubiKey rather than on the phone, so a lost handset is not a lost account. 🇸🇪
• Nitrokey Teltow, near Berlin. Open-source security keys, hardware and firmware both published for anyone to audit. 🇩🇪

Norton / McAfee 🇺🇸 non-EU

The antivirus that came with the laptop.

• ESET Bratislava-built, consistently top-rated, light on resources. 🇸🇰
• Bitdefender Bucharest security vendor that regularly tops independent tests. 🇷🇴
• G DATA Bochum vendor that wrote one of the first antivirus products, in 1987. 🇩🇪
• WithSecure Helsinki enterprise security, formerly F-Secure Business. 🇫🇮

Okta / Auth0 🇺🇸 non-EU

Single sign-on, single foreign dependency.

• Ory Munich open-source identity infrastructure; self-host or EU cloud. 🇩🇪
• Univention Corporate Server Bremen-built identity and domain management for the public sector. 🇩🇪
• ZITADEL Swiss open-source identity platform (outside the default EU scope). 🇨🇭

Sign in with Google, Apple & Facebook 🇺🇸 non-EU

Three American companies hold the keys to the rest of your accounts.

• MojeID Run by CZ.NIC, the .cz registry. Standard OpenID Connect, free for services, non-profit operator. 🇨🇿
• Bank iD Czech bank-backed identity — most of the country already has it. 🇨🇿
• itsme Belgian, bank and telco backed, used for public services and private sites alike. 🇧🇪
• FranceConnect The French state's single sign-on, built on existing public accounts. 🇫🇷