OpenStreetMap
Verified“UK-incorporated, community-run, EU-resident data.”
- Members (voting)
- ~1,929
- Primary database
- Amsterdam 🇳🇱
- Data model
- Open data
- Paid staff
- ~2
58 = midpoint of Control 53 & Data 63
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 12 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
45
Incorporated and registered in England (post-Brexit, so a third country, not the EU), which caps this below the EU-incorporated band. But it is a non-distributing nonprofit that voluntarily adopts GDPR as its governing data-protection standard and stores data in the EU/UK, so EU law substantively reaches its data practices. Friendly, adequacy-recognized third country running an EU-compliant posture rather than a foreign-controlled commercial entity.
Why 45? 4 sourced facts · click to expand
Legal form and registry
UK Companies House · as of 2026-06-12
Company number and incorporation date
UK Companies House · as of 2026-06-12
Registered office (England, not EU)
OSMF wiki — Incorporation · as of 2026-06-12
Self-adopted data-protection law
OSMF Privacy Policy · as of 2026-06-12
Control & Ownership
60
No shares and no owners: control rests with ~1,929 worldwide members who elect the board, and ~64% of members are European. No foreign corporate parent, no stock listing, profits cannot be distributed. European plurality/majority in the electorate lifts this, but the legal seat and a globally distributed (non-EU-anchored) board keep it out of the top band.
Why 60? 4 sourced facts · click to expand
No share capital / non-distributing
OSMF wiki — Incorporation · as of 2026-06-12
Control by member vote
OSMF wiki — Membership · as of 2026-06-12
Membership is European-majority
OSMF Membership Drive 2024 · as of 2024-01-16
No commercial parent / not listed
OSMF wiki — About · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
72
Unusually self-sovereign: OSMF operates its own servers on colocation/dedicated/academic hardware rather than renting from a US hyperscaler. The primary database sits in Equinix Amsterdam (EU); API servers and databases are in the UK, Ireland and Netherlands; backups are in the EU. Heavy EU footprint (Amsterdam, Dublin, Paris/Scaleway, Warsaw/CloudFerro, Umeå, Zagreb). The main foreign-law exposure is the public tile CDN on Fastly (US) plus a few US tile nodes (OSUOSL, AWS Ohio), which see tile-request IPs but not account data.
Why 72? 4 sourced facts · click to expand
Primary database location
OSMF hardware inventory · as of 2026-06-12
Personal data residency
OSMF Privacy Policy · as of 2026-06-12
Core servers self-hosted, EU/UK/IE
OSMF Services & tile privacy FAQ · as of 2026-06-12
Foreign-law CDN exposure
Fastly customer page — OpenStreetMap · as of 2026-06-12
Operations & People
50
Operational center of gravity is global and community-driven rather than EU-centered. Legal/registered HQ is in the UK (not EU); reporting currency is GBP. The board is geographically spread (chair in South Africa; members in Italy x2, Kenya, Bangladesh, US), and the paid footprint is tiny (an administrative assistant and a long-term SRE contractor). European-majority membership pulls this toward the middle, but there is no concentrated EU operating base.
Why 50? 4 sourced facts · click to expand
Board geography (mixed, non-EU chair)
OSMF Board Member Bios · as of 2026-06-12
Officers and board
OSMF wiki — Officers & Board · as of 2025-09-25
Very small paid staff
OSMF wiki — Officers & Board · as of 2026-06-12
Reporting currency
OSMF AGM 2024 Treasurer's report · as of 2024-12-31
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Exact governing-law and dispute-resolution clauses for users outside the UK, post-Brexit
Determines whether enforcement against OSMF runs through UK courts/UK-GDPR or EU GDPR for EU data subjects
- ?
Precise split of which services/IP-bearing traffic flow through Fastly (US) vs OSMF-operated EU origins
Sets the real scope of US CLOUD Act / foreign-law exposure for tile-request metadata
- ?
Whether any account/auth or analytics components touch US providers (e.g. third-party login, Gravatar/Automattic)
Could add foreign-law exposure to otherwise EU-resident personal data
EU Cloud Sovereignty Framework lens
SEAL targets commercial cloud providers; OSM is a nonprofit data commons, so this is an analogous sovereignty mapping, not a certification.
Strategic
Independent, non-distributing nonprofit with no commercial parent or acquirer; open data removes strategic lock-in.
Legal & jurisdictional
UK-incorporated (third country post-Brexit), but voluntarily GDPR-governed and data held in EU/UK.
Data & AI
ODbL-licensed open database, freely downloadable and self-hostable; minimal personal data collected.
Operational
Globally distributed volunteer governance with tiny paid staff; resilient but thin, no EU operating base.
Supply chain
Core compute self-operated on EU/UK colocation; public CDN depends on Fastly (US).
Technological
Open-source stack, self-operated servers, primary DB in Amsterdam; not dependent on a US hyperscaler for core.
Security & compliance
Documented GDPR privacy policy and EU/UK data residency; policy notes some legacy systems not fully documented.
Environmental sustainability
No public carbon/energy disclosures found for OSMF infrastructure.
EU alternatives
Already the leading open, EU-data-resident mapping commons; UK seat (not EU) and Fastly US CDN are the only real caveats.
German company providing OSM data extracts, hosting and consulting; an EU-incorporated commercial complement to OSM.
French OSM-based maps/tiles/geocoding provider, EU-hosted, for those needing a hosted commercial alternative.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology