Why Aardlijn
European companies are generally told they can be sovereign or they can sell into America. Aardlijn exists because that is mostly a false choice, and mostly an architectural one.
The choice you are told to make
You want data and control to stay in Europe. You also want American customers, and the moment healthcare is involved that means HIPAA. The standard advice is to stand up a US environment and move the data across — which discards the first goal to reach the second, and leaves you running two estates instead of one.
That advice is usually given because retrofitting is expensive, not because the rules require it.
HIPAA does not ask where your data lives
HIPAA imposes no data-residency requirement. Neither does SOC 2. What they require is demonstrable safeguards, a documented risk analysis, agreements with the parties who handle the data, and evidence that all of it genuinely operates. Those are architectural and procedural obligations, not geographic ones.
American buyers do ask for US residency, often out of habit rather than obligation. That is a negotiating position, and it is far easier to hold when the controls already exist and already produce evidence — which is the difference between answering a security questionnaire and re-platforming in order to pass one.
This is what compliance profiles are for: one estate, expressed against SOC 2, HIPAA, PCI-DSS or FedRAMP as configuration, rather than as a document assembled afterwards to describe it.
Sovereignty is a build decision, not a hosting one
An estate built from the first commit to keep data and control inside the EU costs very little extra. The same estate converted later costs a great deal, because by then the assumptions are load-bearing. Sovereignty gets described as a hosting choice, and describing it that way is exactly what makes it expensive.
Where your suppliers are established is part of the same question. Aardlijn is a Dutch company, subject to EU law and to a supervisory authority that expects to be able to check — so the tooling used to keep a business European is not itself operated from outside Europe.
This site is a small demonstration of the same discipline. It loads nothing from a third party, runs no scripts and sets no cookies, and the build refuses to complete if any of that stops being true. The privacy page names every party in the chain that delivers it.
What that means today
Aardlijn develops the software and licenses it to delivery partners, who carry out the engagement. Direct EU delivery — consulting, migrations, compliance uplifts — is intended once the business is run from the Netherlands, and is not available at present. The services page sets out which is which.
Last updated: