How FES scores work
FESIT scores are a shared checklist for European NGOs and public-interest organisations. They help structure a conversation about tools — they are not a product ranking or a seal of approval. Terms are also defined in the glossary.
What Fair, Easy and Secure mean
-
Fair
No vendor lock-in, open standards, and European sovereignty over where data and decisions live.
-
Easy
Tools people can use and operate without a dedicated IT department, and that connect to the rest of the stack.
-
Secure
Sound IT security, safer defaults for users, and a clear story for personal data — including GDPR and exposure under laws such as the US Cloud Act.
Scores are indicative
Every score is guidance for discussion, not legal advice, not a security audit, not a DPIA, and not certification that a tool is “GDPR compliant” or “approved for government use”. Labels such as Illustrative vs Reviewed show how far a dossier has been curated — not that the tool has been formally verified in your organisation’s context.
Always check contracts, DPAs, subprocessors, residency options and security claims with people who know your risk profile.
We rely on public information
Evidence on dossiers is drawn from information that is publicly available: vendor websites, documentation, licence texts, privacy pages and similar sources. Where we can, we keep a source URL next to the score so you can follow the same trail.
Some Fair criteria can also be proposed from catalog facts we already store (for example hosting mode, whether the vendor is marked as an EU legal entity, or whether the licence looks open-source). Those rule-based proposals still need human judgement when the facts are incomplete or contradictory.
We do not test the software ourselves
FESIT does not install, penetration-test, or operationally evaluate products in a lab. We do not claim to have used every tool end-to-end. Scores reflect how public claims and dossier facts map onto the FES rubric — not a hands-on quality or security assessment.
How a score is built
- Scores sit on an offering (a specific hosting mode), not only on the brand name.
- Each criterion uses a 1–5 scale against a published rubric (stronger evidence for higher scores).
- Weak or missing evidence should stay empty or marked draft rather than inflated.
- Curators may accept proposals, adjust evidence, or leave gaps visible on purpose.
Pattern TCO bands
Indicative annual total cost of ownership (€) for one typical productivity / collaboration / mail / file app at this organisation size — seats, licence or hosting, and light ops where the pattern implies them.
FESIT does not invent catalog list prices. When a Target stack item has no spend yet (quote still open / “on request”), Our stack strategy may use a labelled pattern band so the board can still discuss direction — cheaper, similar, or dearer — plus effort. Your Current spend always comes from Our usage or import, never from this table.
Methodology version
pattern_tco_bands_v1
— same honesty bar as the FES rubric.
| Pattern | 1–10 IT users | 11–50 IT users | 51–250 IT users | 251–1,000 IT users | 1,001+ IT users |
|---|---|---|---|---|---|
| Global SaaS (seats) Multi-region / non-EU-centric vendor SaaS — high convenience, weaker residency story. | €500–€2 500 | €2 500–€12 000 | €12 000–€60 000 | €45 000–€200 000 | €150 000–€800 000 |
| EU SaaS (seats) Vendor-operated SaaS with primary EU/EEA hosting — similar seat shape, stronger jurisdiction story. | €600–€3 000 | €3 000–€14 000 | €14 000–€70 000 | €50 000–€220 000 | €180 000–€900 000 |
| Self-host OSS You (or a partner) run open-source software — licence near zero, ops and hosting dominate TCO. | €0–€4 000 | €1 500–€10 000 | €6 000–€45 000 | €25 000–€140 000 | €80 000–€500 000 |
| Managed EU host EU managed hosting / private cloud for the app — middle ground between SaaS seats and full self-host. | €1 500–€6 000 | €5 000–€20 000 | €20 000–€85 000 | €60 000–€260 000 | €200 000–€1 000 000 |
These bands are methodology illustrations for board discussion (cheaper / similar / dearer + effort). They are not vendor quotes, not MSRP, and not a procurement price list. Prefer your own Current spend and Target quotes when you have them. Empty Target spend may fall back to a labelled pattern band.