Funding OSS in EU: NLnet, Sovereign Tech Fund

Funding is the fundamental challenge of open source sustainability. In Europe, public institutions and dedicated funds like NLnet, Sovereign Tech Fund, and NLNET Fund for Natural Internet Technologies are transforming how OSS developers receive economic support. In this article from the "OSS Sustainability" series, we discover how to access these funding mechanisms, who qualifies, and what strategies to employ to ensure the success of a European OSS project.

Why OSS funding is critical in Europe

Unlike the United States, where venture capital and tech giants finance OSS as a positive externality, Europe has adopted a more structured approach: public institutions recognize that OSS is critical digital infrastructure. The European Commission estimates that 90% of European software depends on open source components — yet only about 4% of OSS developers receive regular compensation.

This gap has spawned targeted programs:

• NLnet Foundation (Netherlands) — funds radical internet projects and digital infrastructure
• Sovereign Tech Fund (Germany) — supports OSS critical for European technological sovereignty
• NGI (Next Generation Internet) — Horizon Europe program funding research and innovation
• ISC (Internet Software Consortium) — grants for internet infrastructure security

NLnet Foundation: the Dutch radical funding model

NLnet is the most established intermediary for European OSS projects. Founded in 1997, the foundation has distributed over €25 million in grants since 2019, with average amounts of €5,000–€50,000 per project.

Structure of NLnet programs

NLnet manages several parallel funds:

How to apply to NLnet

The application process is extraordinarily democratic:

1. Register your project on NLnet.nl — no need for an incorporated company; just a personal tax ID or nonprofit association.
2. Write a brief proposal (2–3 pages) describing:
   • The problem you solve and its impact on European technological sovereignty
   • Current project status (version, user base, critical dependencies)
   • Technical roadmap for the next 12–18 months
   • Detailed budget (salaries, infrastructure, security audits, testing)
3. Submit via the portal — NLnet evaluates applications in batches (every 4–6 weeks for continuous programs).
4. Await community feedback — NLnet publishes all proposals and gathers anonymous reviews from OSS peers.
5. Milestone-based funding — receive payments upon reaching verifiable milestones (merged pull requests, releases, security audits).

Primary selection criterion: public impact and common good. NLnet doesn't fund companies using OSS as a "storefront"; it seeks projects solving real problems for communities that are replicable and independent of a single actor.

Sovereign Tech Fund: Germany's digital independence initiative

The Sovereign Tech Fund (STF) is a €300 million fund promoted by Germany's Interior Ministry (BMI) in 2022, with the explicit goal of reducing European dependence on US and Chinese technologies.

STF philosophy and target

Unlike NLnet, which finances radical innovation, STF has a geopolitical mandate: supporting OSS that:

• Is critical for European digital infrastructure (internet standards, cryptography, databases, container orchestration)
• Has European maintainers (or who relocate to Europe for the project)
• Aims to remove dependencies on non-European vendors
• Supports technical sovereignty (data residency, auditing, customization)

Typical budget: €50k–€500k per project, for periods of 18–36 months. STF funds both individual maintainers and teams (up to 5–10 FTE).

STF application process

STF uses a two-stage selection model:

# Stage 1: Expression of Interest (2–3 pages)
- Description of the OSS project
- Problem it addresses in the European context
- Current team (CVs of maintainers)
- Funding requested (initial range)
- Timeline

# Stage 2: Full Proposal (after invitation)
- Detailed technical plan for the next 24 months
- Breakdown of monthly FTEs (developer, security, community manager, etc.)
- Itemized budget (salaries, infrastructure, conferences, audits)
- Measurable success metrics
- Risk assessment and contingency plan
- Governance and decision-making process

Timeline: Expression of Interest at any time; feedback within 4–6 weeks. Full proposal requires 2–3 months of review, including a live session with the STF committee.

Important: STF funds people, not just code. If you're a solo maintainer, it requires you to work full-time (or nearly) on the project for the funding duration, and demonstrate residence (or relocation to) Europe.

NGI (Next Generation Internet): the Horizon Europe program

NGI is the European umbrella within Horizon Europe dedicated to open, trustworthy, and human-centric internet. It has allocated €1.5 billion for the 2021–2027 period split across multiple thematic calls.

Active NGI lines in 2026–2027

• NGI Core — Internet infrastructure, privacy-by-design, data portability
• NGI Search & Discovery — Alternative search engines, ethical crawling, federated indexing
• NGI Taquilla (new) — Economic sustainability models for OSS
• NGI Infrastructure — Critical internet infrastructure (DNS, DNSSEC, BGP security, etc.)

Typical budget: €100k–€500k for 12–24 months. NGI favors consortia (2–5 partner universities/SMEs/nonprofits) over individuals.

Advantage over NLnet/STF: larger funding, access to international peer review, EU-wide visibility. Disadvantage: complex European bureaucracy, extensive documentation, long timelines (9–12 months from call to funding).

How to build a winning application

1. Strategic alignment: the core message

Each funding source has an underlying thesis. You must articulate your project around that thesis:

For NLnet: "I contribute to European digital commons"

Example winning narrative (NLnet):
"Our decentralized federated mail server project reduces dependence on US/Chinese cloud
mail services and enables local communities to manage their own communication infrastructure.
We have 500 active installations in 12 EU countries; this grant consolidates security
(cryptographic audit), scalability (distributed load balancing), and documentation to reach
5000 instances by 2027."

For STF: "I reduce technology lock-in and euro-dependence"

Example winning narrative (STF):
"Today 80% of European Kubernetes clusters use US-proprietary storage solutions. Our open
source distributed storage project at zero royalty enables EU companies to host sensitive data
on-premise guaranteeing sovereignty. We request €200k over 24 months for a team of 3 developers
+ 1 security engineer for CREST audit, and public roadmap for CEPH+Minio interoperability."

For NGI: "I innovate and scale with research rigor"

Example winning narrative (NGI):
"We propose a consortium (University of Helsinki + Dutch startup + Italian public agency)
to develop an open standard for censorship-resistant federated identity on blockchain.
This enables digital sovereignty for e-government, smart cities, and remote communities.
24 months, €380k total budget, 3 peer-reviewed research papers, 2 reference implementations."

2. Technical roadmap: specific and realistic

EU funders require a roadmap that is both ambitious and credible.

## Roadmap Q3 2026 - Q2 2027 (12 months of funding)

### Q3 2026 (Months 1–3): Security audit + architecture refactoring
- Weeks 1–2: Security audit by CREST-certified firm (€15k)
- Weeks 3–4: Backend refactoring for GDPR compliance (CTO full-time)
- Weeks 5–8: Penetration test on crypto layer (€8k contractor)
- **Deliverable:** Public audit report, remediation PRs, version 2.1.0 alpha

### Q4 2026 (Months 4–6): Scalability + performance hardening
- Months 4–5: Load testing for 10k concurrent connections (DevOps engineer)
- Month 6: Optimization cycle: I/O batching, connection pooling, Redis caching tier
- **Deliverable:** Benchmark report, version 2.2.0 stable, performance documentation

### Q1 2027 (Months 7–9): Ecosystem + integrations
- Integrations with Nextcloud, Jitsi, Matrix (3 developers, 1 community manager)
- Community-vetted plugin marketplace
- **Deliverable:** 5 live integrations, plugin submission guidelines

### Q2 2027 (Months 10–12): Handoff to community, sustainability plan
- Training for European contributors
- Fundraising strategy document (open collective, enterprise sponsorship)
- **Deliverable:** Public sustainability roadmap, European maintainer team for post-grant

3. Detailed budget and justification

Budget is when your credibility is tested. Don't throw random numbers.

Example NLnet budget (€35k for 12 months, 1 developer + contractor audit):

Salaries + employer taxes (80%):
  Senior Developer (0.6 FTE, 12 months):
    Gross salary: €48k/year × 0.6 = €28.8k
    Employer taxes (IT): 28% = €8k
    Subtotal: €36.8k ← WARNING: exceeds budget! Reduce to 0.5 FTE

  Senior Developer (0.5 FTE, 12 months):
    Gross salary: €48k/year × 0.5 = €24k
    Employer taxes: €6.7k
    Subtotal: €30.7k

Third-party services (20%):
  CREST security audit (2 days, 40h): €8k
  Penetration testing (1 day, 8h): €2k
  Subtotal: €10k

Infrastructure (optional):
  Hosting + CDN (12 months): €1.3k
  Domain + email: €200
  Subtotal: €1.5k

TOTAL REQUESTED: €30.7k + €10k + €1.5k = €42.2k
ADJUSTMENT: Reduce audit to "Community peer review" (gratis, NLnet arranged), final total €34.2k ✓

Common mistakes and how to avoid them

Mistake 1: Inflated budget without justification

EU funders know development costs well. If you request €200k for a single developer over 12 months, they'll ask why. Compare average costs: Senior Dev €40–50k/year gross in Italy, €55–65k in Netherlands, €65–80k in Germany.

Mistake 2: Ignoring tax jurisdiction

If you're a freelancer in Italy, the grant is taxed as self-employment income (43% rate + INPS contributions). If you're a startup, you have R&D deductibility advantage. Consult your accountant before applying.

Mistake 3: Non-credible technical promises

If your roadmap says "Port 100k LOC to Rust in 6 months" and you're a 2-person team, they won't believe you. Keep promises conservative and exceed expectations in delivery.

Mistake 4: Lack of measurement method

Don't say "We'll increase security." Measure: "We'll reduce attack surface via (a) CREST audit, (b) formal penetration testing, (c) continuous fuzzing. Target: 0 critical vulnerabilities by Q4 2026." European funders love numbers.

Case studies: Winning projects from the European OSS community

Matrix.org (funded via NGI + Germany's BMWK)

Matrix is an open federated communication protocol. It received over €1M in European public funding for:

• Modern client implementation with secure end-to-end encryption (E2EE)
• IETF standards for federation protocols
• Annual security audits by specialized firms

Lesson: Position yourself as infrastructure, not consumer app. Impact is maximum on lower layers where network effect is evident.

Nextcloud + OwnCloud (annual NLnet + STF funding)

Both received €100k+ annually from NLnet for:

• Security: cryptography audits, storage hardening, GDPR compliance
• Performance: scalability to 1000+ users per single deployment
• Portability: migration tools from Google Drive/Dropbox without data loss

Lesson: Recurring funding is achievable if you demonstrate sustainability. Year 1 finances R&D, year 2+ finance hardening and community.

Frequently Asked Questions (FAQ)

Can I apply to NLnet if I'm non-European but the project is hosted in EU?

NLnet favors European maintainers but it's not a hard requirement. If 70%+ of contributors are EU-based, you have good odds. For STF, European residency is mandatory to receive EUR payments.

How long between application and first payment?

NLnet (continuous programs): 4–6 weeks from application to decision; if approved, payment within 2 weeks. STF: 6–9 months (Expression of Interest → review → full proposal → negotiation). NGI: 9–12 months from call to kick-off.

If I receive funding, does the code stay open source?

Yes, mandatory. All programs require FOSS license (GPL, MIT, Apache 2.0, etc.). Furthermore, deliverables and documents are public by default. There is no "proprietary development" funded by European public funds.

What if I miss milestones?

NLnet is flexible: if you fall behind but communicate progress regularly, they can extend the project or rescale milestones. STF is stricter: missing milestones can result in payment suspension and partial repayment requests. Early communication is everything.

Can I apply simultaneously to NLnet, STF, and NGI for the same project?

No, prohibited. All funding requires an exclusivity declaration (no double-funding for same milestones). You can however have parallel funding for different aspects: e.g., NLnet funds core engine, STF funds European security hardening, NGI funds research. But these must be clearly delineated to avoid "overlaps".

Practical resources to get started

• NLnet.nl — open applications, database of funded projects, proposal template
• SovereignTechFund.de — application guide, examples of STF grantees
• NGI.eu — open calls for all NGI programs, Horizon Europe documentation
• ISC.org/grants — Internet Software Consortium, small grants (€5k–€25k) for internet security
• SIDA (Swedish International Development Cooperation Agency) — minor grants for global-focused OSS

Conclusion: The future of European OSS sustainability

Europe is choosing to invest in technological sovereignty through publicly funded OSS. This model differs from Silicon Valley (capital-driven) and China (state-controlled): it is commons-based peer production with structured public funding.

If you are a European OSS developer or maintainer, this is the time: funding is available, criteria are clear, and demand for OSS infrastructure is imminent. Don't wait to be "discovered" by a venture capitalist — apply directly to NLnet, STF, or NGI. The bureaucracy is less intimidating than it seems, and community support for applications is strong.

In the next article in the series we'll explore sustainable funding models (open collective, Patreon, enterprise sponsorship, dual licensing) and how to combine them with public funding to build an economically "antifragile" OSS project.