It may seem superficially surprising, then, when one of Europe’s central banks announces that it is moving its essential cloud services away from the tried and trusted U.S. giants of Google, Amazon, and Microsoft to a company more famous for selling groceries at bargain prices. 

Two weeks ago, the Dutch central bank said its cloud services would now be supported by Schwartz Digits, part of the Lidl low-cost supermarket group (latest offer, a five-pack of oranges for $1.34). Schwartz Digits was originally built to support the retail business, bringing value-butter and eggs to grateful consumers. It is now a successful provider of secure data services to European businesses and government organizations. De Nederlandsche Bank is just the latest win. 

A trend is developing in Europe that should give the American corporate world, and particularly the White House, pause for thought. The U.S. tech giants, whose services are lauded for their performance, are being increasingly eschewed in favor of European alternatives. The Dutch government has also announced its first deals with StackIT, a subsidiary of Schwartz Digits. 

Read more: “I had to turn down President Obama”

The country’s justice and security minister, David van Weel, said the agreement was “an important step in reducing our dependence on parties outside Europe and strengthening our digital resilience,” Dutch News reported. Other customers of StackIT include Commerzbank and the Hamburg Port Authority. SAP has also announced moves to strengthen its European-based digital infrastructure. 

This is not an issue of skills or scale–Google Cloud, Amazon Web Services and Microsoft Azure have plenty of both. Rather, geopolitical risk is prompting action as American and European approaches to digital security diverge. Protections against Chinese providers have long been “top of mind”. The same is now true of the U.S. as Europe seeks to become more “digitally sovereign” in how it approaches data security and resilience. 

Read more: “Full blast”—Yara CEO says there is only one way to respond to the crisis in the Gulf: do everything better

Under the U.S. Cloud Act, passed in 2018, American technology operators can be required by law to hand over data to the U.S. authorities. The possible risk of a European country’s data being demanded by a foreign nation, even if the service is provided from a European center, is one too high to contemplate across a myriad of disciplines, including healthcare, government services and banking. The American firm, Palantir, has faced controversy in the U.K. after a data deal was signed with the country’s revered National Health Service. 

Critics of the U.S. Cloud Act say the risks are real. Last year, Donald Trump issued an executive order claiming the International Criminal Court, based at the Hague in the Netherlands, had “engaged in illegitimate and baseless actions” against America and Israel over Gaza and sanctioning its chief prosecutor, Karim Khan. Brad Smith, the President of Microsoft, denied that the ICC’s access to its services had been affected after the Associated Press reported that Khan’s email account had been suspended. “Asset freezes and targeted sanctions against ICC staff have a chilling effect on companies and civil society organizations that might otherwise engage with the ICC,” left-leaning members of the European Parliament said. 

A few months later, the ICC announced that it was moving its data operations to openDesk, part of the ZenDis Center for Digital Sovereignty, which is backed by the German federal government. “OpenDesk embodies our mission to lay the foundation for autonomous, effective digital administration in Germany and Europe by promoting digital independence while enabling modern workflows,” the organization says on its website. 

The President often talks of “America First”. For Europe, “America second” or “America not all” is becoming increasingly true.