In partnership with
France, Germany, Poland, the Netherlands, Luxembourg, and Belgium have all begun phasing WhatsApp and Signal out of government use.
Not banning citizens from using them. Banning ministers and civil servants from using them for state business.
What happened. Belgium was the first to ship a replacement, an app called BEAM, built and run by the Belgian federal government's own secure communications agency. Germany is rolling out chat infrastructure from a company called Wire. NATO and the German armed forces have standardized on Matrix, an open protocol they can host themselves. The European Commission wants its own alternative live by the end of this year. In the meantime, the Commission has already told some of its most senior officials to shut down a Signal group they were using for coordination.
Why it happened. Nobody is arguing that WhatsApp or Signal's encryption is weak. It isn't. Both still meet the gold standard for protecting message content in transit. The problem is everything encryption doesn't cover. Consumer apps give a government no way to control who's in a chat, no way to audit access after someone leaves a ministry, and no visibility into the metadata, who messaged whom, when, and from where. That metadata is exactly what an intelligence service would want, and last month multiple European cybersecurity agencies warned that Russian-linked hacking groups were running targeted phishing campaigns against politicians and officials specifically through WhatsApp and Signal.
Brandon De Waele, who runs Belgium's secure communications agency, put it simply: "For us it is data sovereignty."
What it signals. This is the same instinct behind the Digital Euro excluding Amazon and Microsoft, behind Denmark's move to LibreOffice, behind France pulling Teams for civil servants. Except this time it isn't cloud storage or office software. It's the conversation layer itself, the place where the actual decisions get made before they ever touch a document. Europe spent years treating sovereignty as a data-residency question. Now it's treating it as a who-can-listen question.
Six governments switched apps in the same season. None of them called it a coordinated policy.
What it means. Every one of these replacement platforms, BEAM, Wire, Matrix-based systems, needs vendors who can build to government-grade access control, metadata retention rules, and EU hosting requirements, and none of the American messaging giants are structurally able to bid for that work. That's a procurement gap with real budgets attached, not a hypothetical one. If you build collaboration tools, compliance software, or secure infrastructure for European clients, the specification for what "compliant" means just got rewritten by six governments at once, and the vendors who understand metadata sovereignty as the actual requirement, not encryption strength, are the ones who'll get the contracts.
404 Found covers AI developments from a European Insider, three times a week.
One brand shipped 30+ landing pages last week. No developers.
A DTC brand briefed Viktor inside Slack: one landing page per Meta ad group, mapped to a different headline variant. He wrote the code, deployed each page to their subdomain, posted the URLs back in #marketing, and now monitors performance across the set.
Their content team uses him to draft email flows, generate creative variants, and audit Klaviyo segments every Friday. Their growth lead uses him to catch spend anomalies before the day starts.
20,000+ teams now have the same setup: one AI employee across every marketing tool. A teammate who ships work in Slack and Microsoft Teams.