Hosted in the Netherlands, still far from independent

You host your website with a Dutch provider. So you are independent of American tech, right? Unfortunately not. From the foundations of the internet to the router in the data centre: almost every layer has an American or Chinese owner. In this article I walk through that chain, with numbers where they exist.

One visit, five layers

Someone types in your domain name. Within half a second your site is on their screen. In that half second, the request passes five layers:

Root DNS: the root of the internet points the way to .nl or .com.
Domain name: the operator of your extension points the way to your server.
Proxy or CDN: often a service sits in between to speed up and protect your site.
Data centre: the building where your hosting provider keeps its servers.
Equipment: the routers, switches and servers that do the work.

The internet feels virtual, but it is very physical. It is cables in the street, fibre in data centres and equipment in racks.

A dug-up street in Amsterdam with bundles of blue, green, orange and red cables and fibre ducts, under scaffolding tubes

Your hosting provider is Dutch. But who runs the other layers?

The root of the internet is in America

DNS is the address book of the internet. Computers find each other by IP address, such as 192.0.2.10. People prefer to remember names, such as example.nl. DNS looks up the right address for a name. That takes three steps:

The root knows who runs .nl and refers to SIDN.
SIDN knows which name servers know example.nl and refers to them.
Those name servers return the IP address of the website.

Usually your internet provider’s server asks these questions for you. It remembers the answers for a while, so not every visit goes past the root. But without the root, eventually nobody would find the way to .nl.

Every DNS lookup starts at the root. It consists of thirteen root servers, lettered A to M. Twelve organisations operate them. Nine of them are American: Verisign (A and J), the University of Southern California (B), Cogent (C), the University of Maryland (D), NASA (E), Internet Systems Consortium (F), the US Department of Defense (G), the US Army (H) and ICANN (L).

There are only three exceptions:

I-root: Netnod in Sweden
K-root: RIPE NCC in Amsterdam
M-root: the WIDE Project in Japan

In October 2026 there are more than 2,000 copies of these servers worldwide, including in Amsterdam. If one fails, you notice nothing. So the risk is not outages, but control. Which extensions exist and which servers they point to is set in one file: the root zone. IANA, part of ICANN, decides on its content. The American company Verisign processes the changes, signs the zone and distributes it. The master key that secures the root zone (DNSSEC) is kept in two vaults: in Culpeper (Virginia) and El Segundo (California).

ICANN: an American organisation with global power

ICANN was founded in 1998 and resembles a foundation. Formally, it is a nonprofit under California law. ICANN manages the address books of the internet: the root zone, the extensions and the distribution of IP addresses around the world.

Until 2016, ICANN did this under a contract with the US Department of Commerce. That contract has ended. Governments, companies and engineers from all over the world now have a say. But ICANN still falls under American law and American courts.

That ICANN holds this power became clear in 2022. Ukraine asked ICANN to remove .ru from the root zone. ICANN refused: it is a technical coordinator and does not impose sanctions. That speaks in ICANN’s favour. But it also shows that such a decision sits in one place, in California.

There are European and Dutch organisations with a key role too:

RIPE NCC (Amsterdam) is an association under Dutch law. It distributes IP addresses in Europe and the Middle East and operates the K-root.
SIDN (Arnhem) is a foundation. It runs the .nl extension.
Netnod (Stockholm) operates the I-root.

The data centre: Dutch address, foreign owner

Your hosting provider has a Dutch name. But its servers often sit in a rented data centre. The largest data centre owners in the Netherlands are American: Equinix and Digital Realty. Digital Realty bought the Dutch company Interxion in 2020. On top of that, Microsoft and Google built their own large data centres in North Holland and Groningen.

What percentage is American? There is no official figure. I found no government study that breaks down the ownership of all Dutch data centres. MT/Sprout cites an industry estimate: 75 percent of available capacity is owned by American parties or rented by non-European parties. That is a rough estimate, but it matches the list of largest players.

China is present too:

Global Switch has a large campus in Amsterdam Nieuw-West. Since 2019 its largest shareholder has been the Chinese steel group Shagang. Shagang has been trying to sell Global Switch for years.
Alibaba Cloud announced in September 2026 that it will open its own cloud region in the Netherlands within a year.

The Amsterdam Internet Exchange (AMS-IX) runs in these buildings too. AMS-IX is one of the most important hubs of the Dutch internet. There, more than 900 networks connect to each other: internet providers, hosting providers and cloud services. When someone views your website from home, that traffic often travels via AMS-IX from the internet provider to your hosting provider.

AMS-IX is present in fifteen data centres. Ten of them belong to American companies, such as Equinix and Digital Realty. One belongs to Global Switch. The core of the platform consists of two routers: one at the American Digital Realty and one at Global Switch, which has a Chinese owner. Every AMS-IX data centre connects to both. So the platform is redundant, but both core locations are American or Chinese.

One nuance matters. If you rent a rack in an Equinix data centre, Equinix manages the building, the power and the access. It does not manage your data. The risk lies mainly in continuity and physical access. It is different when your hosting provider itself is in American hands. Under the CLOUD Act, an American company must hand over data it controls, even when that data is stored in the Netherlands.

The equipment: Cisco, Juniper and Huawei

Three racks in a data centre full of network equipment and yellow fibre cables

Every data centre and every network runs on routers and switches. These too come mainly from America and China. Research firm IDC measured worldwide revenue in the first quarter of 2025:

Routers: Cisco 31.9 percent, Huawei 28.4 percent. Together, six out of ten.
Switches: Cisco 30.9 percent, the American company Arista 13.9 percent, Huawei 6.0 percent.

For the heaviest routers, the ones that carry the internet, Cisco, Huawei and Juniper lead. Juniper has been part of the American company HPE since July 2025. Finland’s Nokia is the largest European player. I found no figures for the Netherlands alone. On top of that, the chips in almost every server come from Intel, AMD or Nvidia. American as well.

Why does this matter? Network equipment sees all your traffic. A few examples:

Cisco and the NSA: the Snowden documents revealed in 2014 that the NSA intercepted Cisco routers on their way to customers abroad. It installed surveillance implants and then sent them on. Cisco says it never works with any government to weaken its products.
Juniper: in 2015 Juniper found unauthorised code in the software of its firewalls. It allowed an attacker to decrypt VPN traffic.
Salt Typhoon: Chinese hackers broke into American telecom networks through Cisco equipment, mostly with stolen credentials.
Huawei at KPN: according to a secret report from 2010, Huawei could listen in on mobile calls of KPN customers. KPN and Huawei deny this happened. Since 2022, Dutch providers may only use trusted suppliers in the core of their mobile networks.

The cloud: American money, European lag

American cloud companies are investing billions in Europe. A few examples:

Microsoft is expanding its capacity in Europe by 40 percent in two years. That way, Microsoft doubles its European data centre capacity between 2023 and 2027.
Google is investing 600 million euros in a new data centre in Winschoten, next to its data centre in Eemshaven.
Amazon opened the AWS European Sovereign Cloud in Brandenburg in January 2026. Amazon is investing 7.8 billion euros there until 2040.

Microsoft is also responding to sovereignty concerns. Since June 2025 it has offered the Microsoft Sovereign Cloud. European customer data stays in Europe, and only staff in Europe get access. But Microsoft remains an American company, so it still falls under the CLOUD Act.

And the European cloud? It lags far behind. Amazon, Microsoft and Google together hold 70 percent of the European cloud market, according to Synergy Research (July 2025). All European providers together hold 15 percent. In 2017 that was still 29 percent. The largest European players, SAP and Deutsche Telekom, each hold 2 percent. European providers are growing, but the market is growing faster.

My view as an Azure architect

I work with Microsoft Azure myself. That is American too. In April 2025, Microsoft promised it would go to court if a government ordered it to shut down its European cloud. That is a promise, not a guarantee.

So the honest story is: a Dutch hosting provider does not make you independent, and an American cloud does not necessarily make you vulnerable. What matters is that you know what you depend on.

Want to know how dependent your organisation is, or how to build an exit plan? Get in touch and we’ll look at it together.