Open standards are an important way to become more digitally independent. They make it easier to switch applications and give organisations more control over their own systems.

That is why DataOwn uses open standards wherever possible. For data transformations, we use SQL: a language that many BI platforms understand. This is an advantage over solutions where the logic is mainly built in a specific drag-and-drop tool.

Yet Business Intelligence still lacks interoperability in many areas. There is no standard for dashboards, including their charts, layouts and interactions, so they cannot readily be exchanged between tools. There are also still no widely adopted standards for the semantic layer — the place where you define metrics, dimensions and relationships between tables. As a result, the semantic layer and the dashboard are often closely connected. Organisations end up choosing one platform for both, even when they would prefer to choose those components separately.

Apache Ossie could change that. Ossie is an open standard for exchanging semantic models. The aim is to reuse definitions across different analytics and BI tools. For example, you could manage your semantic layer in one tool and your dashboards in another. That ideal has not yet been achieved: the standard and support from different tools need to develop further and be widely adopted.

Microsoft joins in

Microsoft has announced that it will contribute to Apache Ossie. That is good news for the development of the standard. The more vendors participate, the greater the chance that organisations will be able to exchange the definitions they have built between platforms. Microsoft's contribution focuses on the semantic models in Power BI and Fabric. An open-source converter can convert models to Ossie and back. In principle, this lets organisations take their model with them and reuse it elsewhere. Microsoft explains its contribution here.

The reports themselves are outside the scope of this contribution. Charts, page layouts and interactions are therefore not converted automatically. Anyone switching to another dashboard tool will still need to rebuild those reports for now.

Exchanging a model also does not guarantee that everything will work the same way on another platform. Power BI uses DAX for calculations, for example. This has now (unfortunately) been accepted by Ossie. Another platform must also be able to execute those calculations to produce the same results — and that is not yet the case. Settings such as access permissions can also be stored in the model without another tool understanding or applying them. Exporting a model is therefore a step forward, but always check which components the receiving tool actually supports. The converter documentation describes the current capabilities and limitations.

If you want to combine DataOwn with Power BI, you can connect Power BI to the transformed tables in DataOwn. You then define the relationships and metrics in Power BI. The new Ossie converter does not currently change that workflow.

Open standards make switching more feasible

DataOwn uses dbt to transform data. dbt is open source and now also supports defining and exchanging semantic models in Ossie format. This aligns with our choice of open tools and standards. The exact capabilities depend on the versions you use and the support offered by the BI tool you connect to it. More about Ossie in dbt.

The development of Apache Ossie is therefore encouraging. Organisations spend years investing in reliable metrics, clear definitions and useful reports. As much of that knowledge and logic as possible should be preserved when they switch applications or vendors.

Ossie can help increase that freedom of choice. The next step is for more tools to support the standard and for definitions, calculations and permissions to become readily transferable in practice. Until then, building with open tools and standards helps keep a switch to another vendor feasible.

Protecting your data is a priority at DataOwn. We work on security in two complementary ways: building secure processes as we work towards ISO 27001 certification, and testing how well our technical safeguards hold up in practice.

Preparing for ISO 27001 certification

We are currently carrying out an internal audit in preparation for the external certification audit. DataOwn is not yet ISO 27001 certified.

The work goes beyond writing policies. It means putting clear procedures in place, following them consistently and documenting how we do so. Security and data minimisation need to be part of our daily work, from the decisions we make to the way we manage customer data.

Testing the platform in practice

A few weeks ago, we completed a penetration test with security expert Max. He assessed whether he could gain unauthorised access to our systems or access one customer's data from another customer's environment.

The assessment included access to the source code and covered authentication, tenant isolation, authorisation, and SQL and dbt workflows. In other words, it examined both how users gain access and whether the boundaries between customer environments hold up.

The test did not identify a direct compromise, but it did uncover several weaknesses. For example, some identifiers were exposed that could help an attacker investigate other vulnerabilities. Those findings gave us concrete opportunities to strengthen the platform.

Fixing findings and checking the results

DataOwn's team has addressed more than ten high-priority security findings. Retesting confirmed substantial improvements to tenant separation, credential protection, internal service exposure, brute-force protection, and the security of Lightdash and dbt functionality.

These changes reduce DataOwn's attack surface and strengthen the safeguards around customer data. They do not make security a finished task: we continue to assess risks and improve our defences. The next penetration test is already being planned.

ISO 27001 preparation and penetration testing reinforce each other. Clear processes help us work securely every day, while practical testing helps us identify and address weaknesses in the platform. Both are part of our ongoing responsibility to protect your data.

The current US administration has a view of foreign policy that differs fundamentally from how we in Europe think about cooperation. We see other countries as partners to work with; US policy increasingly seems aimed at influencing us and supporting far-right parties such as AfD and Reform UK. This goes beyond America's own interests; they also have an opinion on how we live together in Europe. Read more about this policy

How much influence does the US really have?

The risk of surveillance has always been there. Microsoft stated under oath in the French Senate that it secretly shares data with US intelligence services. That means we do not know exactly how often this happens. This spring a concrete case was revealed: Microsoft emails of Dutch civil servants working on the Digital Services Act were handed over to US authorities (NL Times). We would hardly call them the most controversial people — so who knows what other data Americans are requesting.

The 'kill switch' and real threats

More openly, there is another danger: the 'kill switch'. That is why it has been in the news more often. Media occasionally cover International Criminal Court judges and prosecutors sanctioned by the US. So far the ICC as an organisation has not been fully shut down, but the tone has hardened and the risk is real (NOS).

In recent weeks, Autistici/Inventati was added to that picture. This is a small Italian foundation that provides website and email hosting to left-wing organisations. They were suddenly placed on the US sanctions list. It is highly questionable whether a US court would have approved this, because platforms there are typically not held responsible for the content of messages — Facebook and Twitter hide behind that principle. A US or Italian court turned out not to be needed at all: the White House decision had immediate effect. Their donation platform and .org domain stopped working within days — both provided by US companies. Their Italian bank, Banca Etica, also closed the account — virtually all payments still go through US companies such as Mastercard or Visa (NRC).

Not by the US government, but still connected to it: Meta censors advertising for a theatre production because it promotes feminism (The Guardian). And feminism is far less contested in the US than queer rights or even international cooperation.

Is this a trial run?

Autistici/Inventati was only a small foundation, so it may well have been a trial from the White House. If so, the trial succeeded. With relatively little fuss, the goal was reached. What if more organisations face this next? Will politics act if a larger organisation is hit? The risk is already so real that various ICT companies no longer want to supply the International Criminal Court.

Meanwhile, more US court rulings and precedents have given the president more power. The president can now dismiss the leaders of almost all previously independent regulators. It is an open question whether storing personal data with US companies is still safe — though our leaders keep kicking that can down the road. Read more

Why wait?

The International Criminal Court is highly visible — yet it remains conspicuously quiet because everyone thinks it will not happen to them. How sure are you that you will not be targeted if Trump and Vance openly support the AfD? Why a small Italian foundation hosting a left-wing website, and not a Dutch foundation defending LGBTQ+ rights? How many books banned by Republicans sit in your school library?

As an organisation it is almost impossible to work around the full set of sanctions. Without a bank account, operating in the twenty-first century is hard. There you depend on international payment systems. Beyond that, most organisations are heavily dependent on the US. What would happen to your organisation if Google, Microsoft and AWS blocked your account overnight?

What can we do?

That is why we need to move on every level: - The European Central Bank is already working on an independent payment system - The Dutch government can insure our companies against sanctions - Organisations can make their ICT digitally sovereign

All three actions help ensure that White House decisions have less impact on us. That is true practically — and as a signal that we will not simply take it.

No surprise that we speak to more and more organisations that want to become digitally sovereign. More local businesses, schools and NGOs that want to reduce their dependence on the US. De Nederlandsche Bank — hardly a poster child for rapid change — is already bringing our gold back from the US (read more).

Alternatives exist

More alternatives are also emerging. DataOwn was founded because there were limited options in the Netherlands to move away from Power BI, especially for smaller organisations. That is often an easy first step toward digital sovereignty. We offer a ready-to-use Business Intelligence platform where data-driven work is central and more employees can answer their own data questions. We have also kept vendor lock-in as small as possible — even without us, you can continue without starting over as with big-tech BI platforms.

Digital sovereignty starts with awareness, but ends with action. The question is no longer whether we depend on the US — but whether we still want to.

For the US, this was not a problem until now. After all, there is the EU-US Data Privacy Framework treaty, which agreed independent oversight of that data. But is the US still complying? Several conditions from this treaty have been removed by Trump and the Supreme Court. The European Commission is still postponing its decision on the validity of the treaty, but there are also court cases underway. And even without a legal ruling: we also know that US intelligence services have an ever broader definition of terrorism.

Do you want to wait until a legal loophole appears that makes it allowed again, or do you already start moving your data to 100% European companies?

Read more: Can you still transfer personal data to the US?

DNB is bringing our gold back from the US to Europe. Officially for other reasons, of course — but after they warned about geopolitical risks.

Data is the new gold. Yet we still park our data en masse with companies from the US. Yes, it usually sits in a data centre that is physically in the EU, but US law still applies. And that means quite a lot.

If the White House disagrees with your politics, you can suddenly end up on a sanctions list and lose access. That happened to the ICC and recently also to a small Italian internet provider (Autistici/Inventati).

If the CIA wants to see the data, that can happen without you being allowed to know. That is not only for terrorists — this spring it also applied to all civil servants working on regulating Big Tech. And with a US administration whose policy is to support far-right parties in Europe, surely also in many cases we never hear about.

Are your data warehouse and dashboards already beyond the reach of White House whims? Switch from Power BI to DataOwn!

The cause often lies not in the visualisation, but in how the semantic layer is set up: where definitions of dimensions and measures live, and how dashboards are linked to them.

In DataOwn you build that layer centrally with the Model Builder. One place for all your star schemas, one shared definition of every measure — and in every dashboard you can combine all the star schemas you need.

What is a semantic layer?

A semantic layer is the translation layer between raw database tables and what people see in reports. It contains dimensions (fields you group or filter by), measures (aggregations such as sum or average) and relationships between fact and dimension tables in a star schema.

Without a central layer, every report builder copies this logic again. With a central layer, your BI team defines "revenue" once — and every dashboard uses the same definition.

That aligns with how open-source BI tools set up semantic models. Lightdash, which DataOwn uses for dashboards, describes the same principle in their semantic layer: define metrics, dimensions and tables once in YAML (often via dbt), and then use them consistently in the app, via API and by AI agents.

AI-based chat-with-your-data is the current talk of the town in BI. Ask questions in plain language and get a full analysis of your data back. However, reliability is a problem. Research consistently suggests that a semantic layer is essential for reliable answers — and it gives AI a single source of truth for every definition.

One Model Builder, multiple star schemas

In DataOwn, the Model Builder is the heart of your semantic layer. You can build star schemas: a fact table with measures, surrounded by dimension tables (customer, product, time, organisation). That follows common Kimball principles — but a star schema is one option; other modelling approaches are possible too.

The difference from "writing a query per report" is structural:

- You define multiple star schemas — sales, inventory, service costs — each with clear granularity. - Measures are defined centrally — name, aggregation, display format and description. - All star schemas live in the same semantic layer — joins are defined in the Model Builder. - Every dashboard can use all star schemas — including across different star schemas, without a separate data model per report.

How this differs from the standard Power BI workflow

In Power BI Desktop, the standard workflow for many teams is: new .pbix file, load data, model in that file, build visuals, publish. The semantic model sits in or is directly linked to that report. Two dashboards on the same source data easily lead to two parallel models.

Power BI has alternatives: shared datasets with "thin reports", or semantic models in Fabric. That works, but requires extra setup — central dataset management, often Premium/Fabric capacity, and discipline not to fall back on separate .pbix files. Without that setup, the pattern is often: effectively one semantic layer per dashboard.

DataOwn turns that around: by default one semantic layer for the platform, with the Model Builder as the central place. Dashboards consume that layer; they do not redefine it.

Get started

Read the full explanation in our documentation: Model Builder.

That is the essence of digital autonomy: you can continue and are therefore not locked into your current supplier. This comes on top of our offering in which your data stays fully within Dutch jurisdiction.

We are extending this for even more digital autonomy. We will also make our 'glue' between the open source components available as open source. That applies to a variant suitable for running on premise for your own organisation. It will run on Kubernetes and be suitable for HAVEN+.

Are you a municipality, company or other organisation interested in this? Get in touch and let us know when you want to get started.

DataOwn has been listed in the Edu-V quality mark register. That fits perfectly with the direction we are working towards. The actual quality mark assessments are still to come, but the registration itself is already an important step. For schools, it means that when they come to us they know we operate in an ecosystem where privacy, security and standardised data exchange are central.

What may be even more important: this autumn we are launching six integrations. That sounds technical, but the impact is simple. Schools will soon have their dashboards live in two clicks. No months-long implementations, no complex installations, no intricate PowerShell scripts running on a server somewhere. Just log in, connect, done.

That is what we are aiming for. BI platforms that are not only secure and European, but also genuinely workable for teams that have to do more with fewer people. Schools do not have to be locked into Microsoft ecosystems with opaque costs and data flows that nobody understands anymore when the original builder retires.

The Edu-V affiliation fits that vision. It gives schools the assurance that we meet the right standards, and it creates room to work faster on solutions that really help in practice. Because in the end it is not about certificates. It is about dashboards that work tomorrow, data you understand and a platform you do not have to check every week to keep it running.

More information about Edu-V is available at www.edu-v.org. Questions about the upcoming integrations? Feel free to email us.

DataOwn was founded to make open source Business Intelligence and dashboarding achievable for small and medium-sized organisations such as schools. Open source tools like DBT are already used by the largest companies, and in this way they also come within reach of the smallest school. It offers both business operations and learning analytics, and certainly the combination of HR with student information. The use of data can help make education better in every respect.

DataOwn's vision aligns perfectly with that of the Coalition for Fair Digital Education (CEDO), which is committed to fair and sovereign digital education. DataOwn is therefore glad to help advance CEDO's mission. Although Big Tech often seems easy, especially for organisations with limited technical expertise, DataOwn offers an accessible way to migrate entire Business Intelligence environments to open source. Schools can also choose the standard dashboards that DataOwn provides. In this way, schools and other organisations of all sizes can benefit from the flexibility and sovereignty that open source offers.

Founder Jesse de Wit says: "Data about teachers and especially about students deserves to be handled with care and to remain entirely with European companies. We always start with data minimisation, but in practice it always involves highly personal data. You need to handle that carefully. A child's privacy can affect the rest of his or her life."

Through this collaboration between DataOwn and CEDO, an important step is taken towards a future in which educational institutions themselves control their data and the logic in which it is processed.

As early as 2025, experts warned that the US could restrict access to American SaaS services for organisations that were not aligned with them — think of criticism of Israel policy. This spring, the Digital Autonomy Competence Center outlined a scenario in which the US government demanded data from policy officials to steer European policy. And last Thursday, thinkers published the "Europe 2031" scenario: what happens if the US restricts access to the best AI models?

The common thread is clear: the warnings are becoming reality, step by step. And it affects more than AI chatbots. Organisations that run their data, reports and analytics in American cloud environments build a dependency that can become a political instrument at any moment.

At what — seemingly far-fetched — scenario would your organisation want to be independent from the US? And are you already prepared for it?

Today we were at the Public Spaces conference and on 31 May at the Unconference Digital Autonomy. Everywhere we met people who speak with the same urgency about digital sovereignty — including in Business Intelligence. It was energising: this topic is alive, and not only in cloud and infrastructure, but also in the dashboards and reports organisations rely on every day.

This is how we talk about the news that Microsoft shared the names of Dutch civil servants with the US government (see Vrij Nederland). Microsoft will undoubtedly host the data in the Netherlands. But even then you are not safe if the US government wants to know something under the CLOUD Act. And this is probably just the tip of the iceberg — most of the time we will never hear about it.

What data sits in your Power BI environment? Personnel records, financial figures, customer insights, operational KPIs — often more than you think. Time to place that with a Dutch BI platform from a Dutch company. That is why we are building DataOwn: your data, your control, without dependence on Big Tech.

I already had experience with open-source tools such as Superset, DBT and Airflow, which were even used by large companies like Microsoft themselves. Why couldn't we build a platform that combines the power of these tools, but without the complex dependencies and high costs? A platform that is not only technically strong, but also makes best practices the default – so organisations don't get stuck in creative but unmaintainable solutions. I wanted to create something for the many mid-sized organisations that have to make do with small, flexible teams. For them, every day a team member spends maintaining the environment is a day not spent on valuable insights.

DataOwn was born out of frustration that organisations often choose 'safe' solutions that in practice turn out to be limiting and expensive. It's time for an alternative: a platform that is not only technically strong, but also truly fits the needs of organisations – without vendor lock-in, without unnecessary complexity, and with the freedom to choose where your data resides. This way organisations can focus on what really matters: extracting value from their data.