European alternatives for the services Laravel calls

Moving a Laravel app to European hosting answers the question of where it runs. It does not answer where its data goes next. A typical app sends mail, takes payments, reports errors, counts visitors and loads fonts, and each of those is a company that sees part of your data.

This post lists European options for the services Laravel apps call most. It is not a ranking and there are no affiliate links. Every company here is, as far as we know at the time of writing, owned and headquartered in the EU. Ownership and data locations change, so verify the current details with each provider before you rely on them.

Why do the services around a Laravel app matter for sovereignty?#

Because each one receives data from your app, and its owner decides which laws can reach that data. A Laravel app on a European cloud that sends its mail, errors or analytics to American companies has moved that data back within reach of the US CLOUD Act. The CLOUD Act explainer covers why the owner counts, not just the region.

The overview#

Mail#

Transactional mail carries names, addresses and often the content of an order or a password reset. It is usually the outside service with the most personal data.

• Lettermint (the Netherlands) is a transactional mail service. Brewless sends its own mail through it.
• Brevo (France), formerly Sendinblue, does transactional and marketing mail.
• Scaleway Transactional Email (France) runs at the same provider as your app, if you already host there.

Every one of them accepts SMTP, so the smallest change is in .env:

MAIL_MAILER=smtp
MAIL_HOST=smtp.example-provider.eu
MAIL_PORT=587
MAIL_USERNAME=
MAIL_PASSWORD=

Some also offer an HTTP API or a Laravel transport, which is faster than SMTP inside a request. Check the provider's own documentation for the host and port.

Payments#

• Mollie (the Netherlands) supports the methods European customers expect, such as iDEAL, Bancontact, SEPA Direct Debit and cards, and has an official PHP client, mollie/mollie-api-php. Brewless uses it for its own subscriptions.
• Adyen (the Netherlands) is a payment platform aimed at larger merchants, with its own PHP library.

The payment provider is a controller for much of the payment data in its own right, under financial regulation. That does not make the choice less relevant: it still decides where your customers' payment details are kept.

Error tracking and logs#

Error trackers receive stack traces, request URLs, headers, and often the logged-in user and the request body. Review what yours sends before anything else.

• Flare (Belgium) is an error tracker made by Spatie for Laravel and PHP.
• Scaleway Cockpit (France) collects the logs and metrics of your Scaleway resources. When you deploy with Brewless, brewless logs reads an environment's logs live from Scaleway; Brewless does not store them. See Logs.

You can also run an open-source error tracker yourself, at a European provider. Then the stack traces stay in your own infrastructure, and you take on its maintenance.

Tip

Whatever you use, scrub before you send. Laravel's exception context and most SDKs let you drop request bodies, passwords and tokens from a report. Fewer fields sent is less to account for.

Analytics#

• Plausible (Estonia) is cookieless, open source and hosts its data in the EU.
• Simple Analytics (the Netherlands) is cookieless and stores no personal data about visitors, according to its own documentation.

Both work with a single script tag. Whether you still need consent depends on your setup and your country's rules; neither sets cookies.

Search#

• Meilisearch (France) is an open-source search engine with a hosted cloud. Laravel Scout has a Meilisearch driver.

If your search needs are modest, Laravel Scout's database engine searches your own PostgreSQL or MySQL tables and adds no outside party at all.

Uptime monitoring#

• Oh Dear (Belgium) checks uptime, certificates, broken links and scheduled tasks, and is popular with Laravel teams.

Warning

On serverless, an uptime check is a request. A check every minute can keep a container that would otherwise scale to zero awake, and you pay for that time. Choose a longer interval, or check a cached page that bunny.net answers without reaching your app. This is also why Brewless itself never sends requests to your app to measure it.

Transactional SMS#

• CM.com (the Netherlands) offers SMS and other messaging channels through an API.
• Sinch (Sweden) is a large messaging provider with SMS APIs.

Phone numbers are personal data, and the message often says more: a login code, an appointment, a delivery. Treat SMS like mail.

Fonts and scripts from CDNs#

Every font or script loaded from a third-party CDN sends the visitor's IP address to that CDN, on every page view.

• Self-host the files. Packages from Fontsource put a font in node_modules, and Vite bundles it with your assets:

npm install @fontsource-variable/inter

import '@fontsource-variable/inter';

• Bunny Fonts (Slovenia) serves the same font families as Google Fonts from bunny.net, without logging visitors' IP addresses, according to bunny.net.

Self-hosting is the cleanest option: no outside party at all.

Before you switch#

Check these for each provider, and write the answers down:

1. Owner and headquarters. Is the company, and its parent, headquartered in the EU? Acquisitions happen.
2. Data location. Where are the data and the backups stored? Some European companies use American clouds underneath.
3. Sub-processors. Which other companies does it use? The list is usually linked from the DPA.
4. Data processing agreement. Is there one, and does it cover what you send?
5. Exit. Can you export your data and leave?

The answers go straight into rows 10 to 15 of the EU-sovereignty checklist.

What Brewless covers, and what it does not#

Brewless deploys your Laravel app to Scaleway (France) with bunny.net (Slovenia) in front, in accounts you own. That covers the runtime, database, files, queue, secrets and edge, as the EU-sovereign hosting guide describes. The services your app calls are your choice, and Brewless does not change them. If one of them is outside the EU, the data it receives is too.

Summary#

• The services your app calls see personal data, and their owners decide which laws reach it.
• There are European options for mail, payments, error tracking, logs, analytics, search, uptime, SMS and fonts.
• Start with the error tracker and the mail provider: they see the most.
• On serverless, keep uptime checks from waking your app.
• Verify the owner, data location and sub-processors of each provider before you switch, and again when they change hands.