Digital sovereignty: the role of open source in public infrastructure

When discussing digital sovereignty, people often think of data localization, the cloud, or cybersecurity, but there is another layer that is just as important: the technology upon which the digital services that citizens, businesses, and institutions use every day are built. A recent article by the PHP Foundation, “Digital Sovereignty Is Written in PHP,” draws attention to this reality by highlighting several examples of public administrations that use open-source technologies as part of their digital infrastructure.

One of the most notable examples comes from the European Commission itself. The Europe Web Publishing Platform supports 770 websites from 44 different Commission services, with approximately 700 million visits per year. The shared platform, based on Drupal, was developed to reduce technological fragmentation and improve aspects such as security, consistency, and scalability.

In Australia, GovCMS follows a similar approach. This official Australian government platform, also based on Drupal, currently supports hundreds of websites for public entities, including agencies related to health, justice, cybersecurity, defense, and regulation.

These examples show that open source has long since ceased to be limited to projects where cost is the primary criterion; it is now present in large-scale digital infrastructures subject to high standards of security, accessibility, performance, governance, and continuity.

But the issue goes beyond technology.

For a public entity or an organization responsible for essential services, the choice of a digital platform also has implications in terms of control. Who determines how the solution evolves? Is it possible to switch providers without replacing the entire platform? Is there access to the source code? How are security updates handled? To what extent is the system dependent on a single vendor?

This is where open source takes on a strategic dimension.

An open-source solution does not eliminate dependencies, but it can reduce exclusive reliance on a single vendor and allow for greater autonomy over technological evolution. It also creates the conditions for different partners to work on the same foundation, which can be particularly relevant in projects with long-term use cases.

Drupal is today one of the most mature examples of this model. Its use by large-scale public institutions demonstrates that open source, security, continuity, and institutional requirements can coexist within the same technology strategy.

For Portugal, these international examples also provide an opportunity for reflection. The digital transformation of public administration depends not only on the ability to launch new services but also on the technological decisions that determine how those services can be maintained, protected, and evolved in the coming years.

For public entities and operators of essential services, this may be one of the most important questions to ask before embarking on the next digital project: How much control do we want to maintain over the technology that will support our service in the coming years?

Digital sovereignty does not depend solely on where we host information. It also depends on our ability to understand, control, and advance the technologies on which our services come to rely.

At JAVALI, we work with Drupal to build and evolve digital platforms where security, continuity, integration, and scalability are fundamental requirements. If you’re evaluating the evolution of your digital infrastructure, we can help you analyze these aspects and define a sustainable, long-term architecture.