Booking.com Is Dutch. Its Cloud Is Not.

Booking.com is the European travel industry. The company processes a share of EU hotel bookings that most regulators would treat as systemic, employs 6,500 people from a glass campus on Oosterdokseiland in central Amsterdam, and was singled out by the European Commission as one of seven gatekeepers under the Digital Markets Act in 2024.

The brand is Dutch in every sense that matters to the public. The legal structure is not. Booking Holdings Inc. is incorporated in Delaware, with principal executive offices at 800 Connecticut Avenue, Norwalk, Connecticut. The hotel reservations that flow through Amsterdam are processed by a US public company.

This is part two of our series. Spotify, the subject of part one, scored 12 out of 100 on our sovereignty rubric. Booking.com is more complicated, and the complication is interesting.

Methodology. Eight infrastructure layers, scored zero to ten on European ness, weighted by sovereignty impact. Every claim cites a public source. One note before we start: the CLOUD Act applies to US companies regardless of where the data physically sits. Booking Holdings is US incorporated. That alone exposes every layer to US legal process, no matter how many servers live in the Netherlands. Our scoring reflects physical hosting; the CLOUD Act overlay applies to the whole table.

Compute and Orchestration

Booking.com runs on vanilla Kubernetes that they manage themselves, not OpenShift (they tried OpenShift in 2016 and walked away). The mesh is Envoy, packaging is Helm, multi cluster rollouts use their in house Shipper, and host config still runs Puppet. The estate is famously large, tens of thousands of bare metal servers across multiple Booking operated data centres. CTO Rob Francis confirmed during the AWS re:Invent 2023 customer keynote that AI workloads and an increasing share of greenfield services run on AWS. Host: hybrid. Layer score: 5 of 10.

Storage and Databases

The MySQL footprint is among the largest in the world, with 250 plus clusters and thousands of servers. Cassandra backs a JanusGraph deployment used for real time fraud detection. Elasticsearch sits across search and review surfaces. Booking publicly describes its posture as database polyglot. The MySQL fleet runs on Booking infrastructure; backup catalogues have been moved to AWS, which is an interesting tell about the long term direction. Host: predominantly on premises in Amsterdam. Layer score: 6 of 10.

Data Warehouse and Analytics

The historical posture is a self hosted Hadoop and Spark estate. AdTech, however, has moved its Perl and MySQL pipelines into Apache Airflow on Google Cloud Composer. Booking has not publicly confirmed a Redshift or Snowflake deployment despite repeated third party speculation; we treat it as unverified. Host: hybrid, on premises plus Google Cloud Composer for at least the AdTech pipeline. Layer score: 4 of 10.

AI and Machine Learning

The Booking.com AI Trip Planner is built on Llama 2 hosted on Amazon SageMaker, with Amazon Bedrock and Titan powering the recommendation API. The ranking team migrated its ML experimentation framework off on premises infrastructure and on to SageMaker; they report a 5x increase in monthly training jobs. Host: AWS. Layer score: 0 of 10.

Observability and Monitoring

Booking.com migrated from AppDynamics plus an in house proprietary stack to Grafana Cloud (Mimir, Loki, Profiles) with OpenTelemetry as the collection layer. They cite roughly 85 million metrics under management. Grafana Labs is US incorporated, though much of its engineering sits in Stockholm. Host: Grafana Cloud SaaS. Layer score: 1 of 10.

Identity and Access

Workforce identity sits on Okta, with Okta Workflows, Lifecycle Management, and the Okta Terraform Provider. Booking reports that the time to onboard a new SaaS app fell from about two weeks to fifteen minutes. Customer side identity is not publicly evidenced. Host: Okta SaaS (US vendor). Layer score: 0 of 10.

CDN and DNS

No primary public source confirms a specific CDN or DNS vendor. We score this layer as unverified.

Payments

Adyen is the publicly confirmed processor. Adyen is headquartered in Amsterdam, listed on Euronext Amsterdam, and holds a European banking and acquiring licence issued in 2017. The partnership formalised in 2019 and covers more than 40 local payment methods worldwide. Host: Adyen, Netherlands, EU regulated. Layer score: 9 of 10.

Layer	Weight	Score
Compute and orchestration	20	5
Storage and databases	18	6
Data warehouse and analytics	14	4
AI and machine learning	12	0
Observability and monitoring	8	1
Identity and access	8	0
CDN and DNS	not scored	unverified
Payments	10	9

Weighted total: 40 out of 100.

Badge: Mixed.

This makes Booking.com the most European of the companies in this series so far, paradoxically, despite its Delaware parent. The reason is straightforward: Booking runs a lot of its own hardware in Amsterdam, and most of its peer set does not.

• Compute and orchestration. Booking already operates the hardest part, an EU data centre footprint. Managed Kubernetes around that base is offered by Scaleway, OVHcloud, and STACKIT for any cloud burst capacity. The bigger lift is removing the Delaware parent's CLOUD Act exposure, which is a corporate structure question, not an infrastructure one.
• Storage and databases. Already on Booking owned MySQL. Managed Postgres and MySQL are available from Aiven (Helsinki) and from the European hyperscalers above if a managed move is desirable.
• Data warehouse and analytics. ClickHouse hosted on European infrastructure, or self managed Apache Spark on Hetzner or OVHcloud, would replace the Google Cloud Composer dependency.
• AI and ML. Mistral AI, Scaleway AI, and OVHcloud AI all offer inference and fine tuning. For Llama based workloads, Mistral's hosted Mixtral and Codestral models are direct substitutes.
• Observability. Self hosted Grafana and Prometheus, or one of the EU based managed Grafana providers.
• Identity. ZITADEL (Switzerland) and cidaas (Germany) replace Okta for workforce identity. Hanko is a passkey first option for customer identity.
• CDN. BunnyCDN (Slovenia) and CDN77 (Czech Republic) are EU owned with appropriate edge presence.
• Payments. Already Adyen, already perfect.

Browse the European cloud alternatives catalog and the deeper Alternatives to AWS page.

Booking.com's hybrid is not an accident. The bare metal MySQL footprint reflects years of squeezing performance out of well understood hardware at a price point that AWS struggles to match. Moving the search and ranking surface to AWS, while staying on owned hardware for the system of record, is a defensible architecture.

The harder constraint is the corporate one. Booking Holdings was created by merging Priceline (US) and Booking.com (Netherlands) in the late 1990s and early 2000s, with the resulting holding company anchored in Delaware. That structure cannot be unwound without dual listings, tax complexity, and shareholder approval. The CLOUD Act exposure is structural.

Booking.com's privacy notice acknowledges cross border transfers and relies on Standard Contractual Clauses and intragroup Binding Corporate Rules. There is no public statement directly addressing the US CLOUD Act. The company published a Digital Markets Act Compliance Report in November 2024, which is the closest thing to a sovereignty posture document, and which does not mention the CLOUD Act either.

See our coverage of the US CLOUD Act for more on what this exposure means in practice.