Digital sovereignty: what your ERP must demonstrate.

The essentials.

• Digital sovereignty is not about flags. It is about being able to make an informed choice regarding where your data goes, who can reach it, and how to get it out.

• Odoo offers three things you can actually verify: a European vendor subject to EU law, open source code you can audit, and a standard PostgreSQL database you can export at any time.

• Three hosting modes, three levels of control: Odoo Online, Odoo.sh, or an installation on infrastructure you choose.

• Odoo Online and Odoo.sh run on Google Cloud Platform. You pick a European region, but the infrastructure still belongs to a provider subject to the Cloud Act. It is not SecNumCloud qualified hosting.

• On the AI side, the providers built into Odoo 19 as standard are OpenAI and Google Gemini. A European or self-hosted model requires a connector module or custom development.

Your ERP tenders now come with a cybersecurity section and a legal section. Your enterprise customers ask where their data is hosted. Your IT director wants to know who can access it. Your finance director reads the liability clauses line by line.

Digital sovereignty never shows up as a concept. It shows up as a specific question, in a specific contract, at a specific point in the project. Usually too late to change the architecture.

This article answers one question: what guarantees an ERP really provides on where your data sits, who can access it, and how you get it back. And which ones are just talk.

What does digital sovereignty mean for a business?

Digital sovereignty is the ability to make an informed choice about where your data goes and how it is processed.

It is not a doctrine of buying French. A company that hosts in France without knowing who administers its servers controls nothing. A company that hosts in Europe, knows who can access its database, has a complete export, and has costed out an exit keeps the upper hand.

Three questions are enough to frame the subject:

• Where is your data stored, and under which legal system?

• Who can access it, both in operations and in support?

• What does a full exit cost, and how long does it take?

A vendor who cannot answer all three has already answered.

Which sectors and which decision makers are driving this?

Five sectors are bringing this into their ERP projects today.

• Defence, space and aerospace subcontracting.

• Healthcare, biotech and diagnostics.

• Industry and manufacturing.

• Finance and insurance.

• Public and semi-public sector.

Within these companies, the decision is spread across four roles:

• The IT director or CISO decides on hosting and security.

• The finance director owns the contract, the liability clauses, and compliance.

• The executive team owns the independence argument.

• The DPO steps in on personal data.

How the question lands in a project.

The requests we see are concrete, and they almost never use the word sovereignty. They ask about location and hosting type, sometimes before the demo. They come as cybersecurity and legal grids to fill in during a tender. They come as personal data and liability clauses renegotiated late in the cycle. They come as hosting changes decided mid-project, when the customer wants to know where their data goes and who handles it.

Why does a European open-source ERP change things?

Odoo brings together four verifiable elements that most ERPs on the market cannot combine.

• A European vendor. Odoo SA is headquartered in Belgium and falls under EU law.

• Open code. The Community edition is open source. You can audit the code and its dependencies, or have a third party audit them. No black box.

• Three hosting modes to choose from, Enterprise licence included.

• Real reversibility. The database is a standard PostgreSQL database. It exports.

Against SAP, Microsoft Dynamics, NetSuite, or Salesforce, the argument rests on a fact rather than a promise: the vendor falls under European law and the code is readable.

The flip side is worth stating. Open code only protects you if somebody reads it. Third-party modules and OCA modules fall inside the scope of your data just like everything else. Audit them before you call them controlled.

Where does your data actually sit, by hosting mode?

The hosting mode determines everything else: location, access, and who carries the liability when something goes wrong.

One thing to know about Odoo Online and Odoo.sh.

Odoo Online and Odoo.sh run on Google Cloud Platform. You pick a European region, and the infrastructure still belongs to a US provider subject to the Cloud Act. It is not SecNumCloud qualified hosting.

For a large share of companies, that level is fine: the operational security, the cost, and the simplicity of keeping it running are hard to beat. For a defence subcontractor or a space company, it is not. That call belongs in the scoping phase, not after go-live.

DynCloud.

DynCloud, the managed hosting service from Dynapps, covers what most growing companies need. We run our own Kubernetes platform, built specifically for Odoo. High availability, scalability, and direct access when you need it. We take care of the infrastructure so your team can focus on what it does best.

Read more about DynCloud

Keeping control of your data when you add AI.

AI moves sovereignty from storage to processing. The question is no longer where your data sleeps, but where it travels when a model reads it.

The providers built into Odoo 19 as standard are OpenAI and Google Gemini. Some features, including AI fields, only work with OpenAI. A European or self-hosted model requires a connector module or custom development.

The three use cases that deliver the most value:

1. Automatic reading of supplier invoices and incoming documents. OCR and extraction, tied directly to electronic invoicing.

2. Natural-language search across your ERP data. Stock, orders, open items, queried by business teams without going through a report.

3. Writing assistance. Customer replies, product descriptions, support case summaries.

Three levels of control, to be chosen use case by use case:

• Default built-in provider. Quick to switch on. Processing leaves your perimeter and sits with a US provider.

• Connected European model. Through an MCP connector module to another provider. We have explored options for connecting Odoo to Mistral and offering a French provider. No partnership is in place to date.

• Self-hosted model. A local AI deployed on your own infrastructure. The data never leaves your perimeter.

We apply the same rule internally. Market tools for our own work, with no customer production data stored in them. And a local model on an internal server for handling certain responses.

What we guarantee, and what we do not.

An integrator who promises you compliance is selling you something they do not control.

We do not promise:

• Guaranteed NIS2, AI Act, or GDPR compliance. Compliance remains your responsibility. We provide a first-level assessment and work with specialist partners when the subject calls for it.

• Sovereign or SecNumCloud qualified hosting when you are on Odoo Online or Odoo.sh.

• Immunity from the Cloud Act or from any foreign legal request.

We present ourselves as an integrator who advises, not as a legal expert on NIS2 or the AI Act.

What we do take on:

• The choice of hosting mode, documented: where the data sits, who can access it, what an exit costs.

• The implementation: hosting, access management, backups, reversibility.

• Integrating AI with a perimeter you control, from the built-in provider to a self-hosted model.

• Migration between hosting modes, including once the system is live.

Why Dynapps?

We implement Odoo for European mid-sized companies: 900+ references, 280+ Odoo experts, 13 offices across 5 countries. Odoo Gold Partner. On sovereignty, we bring the implementation and a first-level assessment, not legal expertise. We have already migrated customers from one hosting mode to another. We do not present ourselves as a sovereign host or as a compliance consultancy.