For about ten years now, vaicat has had the privilege of helping you take the important next steps in your life. It began with talent mobility, and grew into the apps and platforms many of you use today — CUEBES, mEUvy, EUorigin, Salary Insights and EUnify. We are proud of what we have built, and we cannot wait to show you where we are taking it next.
From the very first day, one thing was non-negotiable: your personal data had to be handled with care. We built our first applicant-tracking system all those years ago from the ground up, to the highest privacy and security standards — beyond what the law required, before the GDPR even existed. We have never stopped since. The major privacy and security updates we announced last December, the Private Compute Cubes (PCC) foundations we began building and testing in October, and the offline, on-device personalisation we are bringing to mEUvy are all part of the same golden commitment: your data is yours, and it should stay that way.
We are introducing and announcing major updates to privacy and security on our platforms.
We're introducing major updates to privacy and security across our platforms For the past ten years, we've built platforms, apps and experiences that help Europeans move, whether that's for work, education or a fresh start. Salary Insights helps you understand compensation across borders. mEUvy lets...
Read article
Private Compute Cubes, making Data Collection a one-way street
This is our most ambitious project yet. At vaic.at, we’ve always believed that intelligence should complement you, not monitor you. Today, we’re thrilled to unveil the first details about a new layer in our vAI architecture: Private Compute Cubes (PCC) which is now undergoing active development and...
Read articleA Preview of What's Next for mEUvy on iOS and iPadOS
YouTube video: https://youtu.be/GeU_AvlO0D0 Moving to a new country is one of life's most significant decisions. At mEUvy, we've always aim to make that decision easier by giving you the data you need cost of living, salaries, healthcare, culture, and more across 243 cities in 39 countries, adding a...
Read articleOur philosophy is almost old-fashioned: the safest data is the data we never collect in the first place. Wherever we can, we keep your information on your device rather than on our servers. mEUvy turns mountains of city data — cost of living, housing availability, safety scores across the UK, EU and EEA, and beyond — into clear, personal summaries, and it does that work privately, on your phone, using on-device intelligence. EUnify does the same for students. EUorigin gathers the public story of Europe's most successful companies — what worked, what didn't, how they solved it — and hands it all to you. None of this requires us to hoard your private (or business) life. That is the whole point.
Building this way is not the cheap way. It costs us real engineering hours to design, maintain and keep improving. We knew what we signed up for, and making Europe more mobile — in talent, in entrepreneurship, in education — is the work we love most. We are grateful for the trust you place in us, and we do not take it lightly.
Which is exactly why I need to write to you about something that worries me.
The ground we build on is shifting
The most effective way for us to bring you these private, on-device experiences has been to build on platforms like Apple's iOS and iPadOS — not out of lack of choice, but out of fit. These platforms give developers like us safe, vetted tools to build on: on-device machine learning, the Secure Enclave, App Review, Privacy Labels, App Tracking Transparency and much more. We lean on that infrastructure because it genuinely helps us build faster and more, plus so that you do not have to take our word alone for your safety. Other systems offer good tools too; these simply suit our privacy-first way of working best.
The single most important of those protections is one most people never think about: the sandbox. On both iOS and Android, the sandbox seals each app inside its own compartment, so that one app cannot reach into another. It is why your banking app cannot read your messages and a game cannot watch your screen. It is, in effect, the last wall standing between your apps and anyone who would misuse them.
We believe that wall (sandboxing), often used as an argument to mandate the weakening of the other safeguards we mentioned, is now itself under pressure from the Digital Markets Act — and that should concern all of us.
What is actually being asked for
Let me be precise, because precision matters here. Your phone's built-in trusted assistant — Siri, or Google's Gemini — can do things ordinary apps cannot and should not be able to do: read across your apps, see your screen, act on your behalf. Those assistants come from the company that made your phone and controls and safeguards the whole system end to end. The DMA now requires that competing AI assistants be given access that is, in the Commission's words, "equally effective" to what the platform's own assistant enjoys.
On its face, that sounds like fair competition. But applied to this capability — and others of similar severity like alternative app distribution and alternative payments — "give everyone the same reach" does not shrink the hole the platform cut for its own assistant. It copies the key, creating privileged cross-app exceptions to the sandbox model. As we read the proposed measures, the practical effect is that the sandbox — that last wall — would have to be opened to far more parties than it was ever designed for. The Commission points to safeguards such as consent and opt-in roles, and we take that seriously; our concern is that the underlying access is simply too powerful, and still too poorly understood, to be safely governed by consent UX or front-loaded consent alone. Even multi-tap educational choice screens may not be enough because of the severity and blast radius of giving these kind of third-party tools access to your data, but educational choice screens are often labeled as non-neutral by the Commission anyway, so I won't go into too much detail on this here.
I want to be clear about what we are and are not arguing. We are not asking for privileged access to your data inside other people's apps — we do not want it, and we would never build on it. The vetted, system-supervised tools we use today/in some cases pre-DMA are exactly the kind of access that should exist: powerful, but mediated by the platform. What troubles us is dissolving the wall itself, and granting deep, cross-app reach to "qualifying" third parties that meet the access conditions, including companies with long records of collecting everything they can and treating privacy fines as a cost of doing business.
Why this matters for you, specifically
Here is the part that keeps me up at night — and it is the flip side and potential implosion of everything we have built on native platforms.
Because we keep so much of your data on your device rather than on our servers, your phone is where your most personal information lives. That has always been the safer choice — right up until the device itself is the thing being opened up. An AI assistant able to break out of the sandbox could, in principle, reach the very data we worked so hard to keep local and private: what you have explored in mEUvy, your plans in EUnify, your numbers in Salary Insights. The model we chose precisely to protect you would become the surface most exposed. We did not lock your data away in some distant vault; we left it close to you, where it belongs — trusting the wall to hold.
None of this means we are against AI, against competition, or against new entrants. We are a new entrant, and we love this technology. There are ways to open these platforms that do not require tearing the sandbox down: trusted, system-mediated interfaces that let competitors do genuine work without ever touching the raw data underneath. That is a conversation we would gladly join. What we cannot accept is the version that treats the last wall as nothing more than an obstacle.
Where we stand
So I will be honest with you about what this could mean. If the platforms we build on are pushed into a state where we can no longer vouch for the safety of the data you have entrusted to us, we would face a hard choice. We would not, in good conscience, leave your information inside a system whose legal obligations no longer let us vouch for its safety. We would rather step back than pretend otherwise.
I sincerely hope it does not come to that. We are doing everything we can — publicly, and with the people who write these rules — to make the case for a Europe that is both open and safe: one where a small, privacy-first company can compete on the strength of its design rather than the size of its legal team. That is the Europe we are building for, and the reason we get up in the morning. Vaicat therefore supports Apple's response to the public consultation: "DMA.100220 - Alphabet - OS - Google Android - Art. 6(7) Apple Response to Public Consultation on Draft Measures" and asks both Alphabet and Apple to remain committed to data privacy and platform security. Do not turn the sandbox into a general-purpose interoperability layer.
Thank you for trusting us with your next steps. We do not intend to let you down.
Mitchel, Founder at vaicat
