Sovereignty comes down to three checks: control, headquarters, hosting
Three fields decide whether a European tool is actually sovereign: who controls the owner, where headquarters sit, and which jurisdiction can compel the host. A checklist you can run in ten minutes.
Control first. A brand founded in Europe can be majority owned elsewhere. Check the parent company, not the logo. If a US parent can be served with a legal order, that fact belongs in your decision, whatever the marketing page says.
Headquarters second. The HQ country sets the main regulator, the courts and the employment footprint. A registered office with two staff is weaker evidence than a real head office with engineering and management in place.
Hosting third. Data residency decides which police force and which court order can reach the servers day to day. Self-hosting moves this answer onto your own hardware, which is why so many entries in this directory offer it.
Run the three checks in that order on any tool before a migration. The directory prints all three fields per entry so the check takes minutes, and marks the field Unverified when public sources do not settle it.