News organisation drops Cloudflare for European alternative

Using US technology leaves us vulnerable, says Follow the Money

Follow the Money, the Netherlands-based investigative journalism organisation, has replaced Cloudflare with an alternative DDoS protection provider as part of a long-term effort to wean itself off US technology.

While Cloudflare has been broadly effective at mitigating DDoS attacks for the past two years, Follow the Money (FTM) says it “comes with a risk,” namely the reach of the US administration.

“Cloudflare can see everything you, as a member of FTM, do on our site,” said Erik Willems, project manager for digital autonomy.

Cloudflare says it does not store information such as passwords and usernames, but in order to distinguish humans from bots it needs access to such information; and, as FTM points out, the company “provided data to the US government about 500 times last year out of a total of 820 legal requests. By comparison, there were only 18 requests from EU countries during that time.”

The search for European alternatives to US tech

The trigger for FTM’s search for European technologies was the cancellation of the chief prosecutor of the International Criminal Court’s email account after he issued an arrest warrant for Israeli prime minister Benjamin Netanyahu in 2025.

This was a clear red flag for a journalistic organisation that unearths information powerful people would rather keep buried. A “kill switch” could paralyse the organisation, or even put it out of business, and there is an obvious need to keep sensitive data out of the hands of state actors.

“For a newsroom like ours, that possibility undermines our core journalistic principles: protecting sources, maintaining confidentiality, and preserving independence,” FTM says in a blog post written in February. “In light of recent political developments across the Atlantic, one thing is clear: using US technology leaves us vulnerable.”

FTM drew up a list of around 20 SaaS services it wants to replace with non-US alternatives, including Google Workspace, Slack, Stripe, 1Password and Shopify.

From Cloudflare to Bunny

FTM’s first move was to hop from Cloudflare to Slovenia-based CDN Bunny.net. So, how is it going?.

“Bunny has performed well so far,” Willems told Computing. “For the most part, the migration was straightforward, and most of the features we relied on in Cloudflare are also available in Bunny. We have not seen any major performance or availability issues since the move.”

For FTM’s use case, the two services are similarly priced.

Willems is aware of other organisations making similar moves but said: “few are doing it as publicly as we are.”

Indeed, FTM’s determination to publish its experiences of moving away from US cloud services should make it a valuable test case for others seeking to put themselves out of reach of the US CLOUD Act and similar intrusive legislation.

The hardest dependency to replace is likely to be Google Workspace, said Willems.

“It contains some of our most sensitive data and sits at the centre of our organisation. Unlike a CDN or a newsletter tool, replacing Workspace affects virtually every employee. The challenge is not just finding an alternative, but finding one that is a solid long-term choice and managing the organisational change that comes with it.”

For now, the focus is to replace US SaaS services, but in time FTM may look at alternatives for the other technologies it uses.

“I do think the discussion should eventually broaden beyond software services,” Willems said.

“Hardware, operating systems and even social media platforms are all part of the wider question of digital dependency.”