Who Funds the Digital Commons?

A lot of civic tech runs on code nobody is paid to maintain. The portal is funded. The library under the portal usually isn't. If you maintain one of those libraries, or run a three-person team building on them, the question isn't whether funding exists. It's which door fits your work, and whether that door is still open this year.

We checked the funders people usually name, on their own sites, in October 2026. Several have changed names, scope, or money since the last time most lists were written.

Start with Germany, because that's where the largest public program sits. The Sovereign Tech Agency runs several programs. The Sovereign Tech Fund itself invests in open base technologies like programming language libraries, package managers, and protocol implementations, and it says plainly that it does not fund prototypes or, for now, user-facing applications. The work you propose must cost more than €50,000, it can't already be publicly funded for the same activities, and you should expect an answer within about ten weeks and roughly six months to a contract start. For individuals, the Sovereign Tech Fellowship pays maintainers directly, either as freelancers on 3 to 12 month contracts or as employees in Germany. The 2026 call closed on April 6, and the agency says it will announce future rounds through its newsletter. Its Resilience program offers vulnerability management services, code audits, and a bug and fix bounty platform rather than cash.

The Netherlands-based NLnet Foundation is where most small teams should look first, and it's also where the biggest change happened this year. NLnet distributed EU money through the Next Generation Internet program for years. In June it paused new submissions while it wrapped up NGI Zero, reporting that 1,215 projects were funded from almost 8,500 applications across five NGI Zero programmes. The NGI Zero Commons Fund that many civic projects used is closed to new applications. Its successor is Restack, funded through Horizon Europe, which seeks proposals between €5,000 and €50,000 for core internet infrastructure and open alternatives to closed services, with about €7 million planned through 2030. Most AI work is out of scope. A smaller pilot, CodeSupply, covers software supply chain security, metadata, and license compliance. NLnet's deadlines now fall on the third day of every odd month, the next on November 3, 2026, and anyone can apply: individuals, nonprofits, public bodies, companies. Note one new rule: NLnet says work mostly generated by LLMs isn't eligible.

NGI Zero at NLnet, five programmes

applications

~8,500

applications

projects funded

1,215

projects funded

funded

~14%

funded

The Prototype Fund is the German program most explicitly built for civic tech. It has historically been funded by the federal research ministry and aimed at individuals and small teams without professional grant-writing skills, and it planned a relaunch for January 2025 with a stronger focus on project sustainability. A Prototype Fund talk at FediDay 2026 announced two new tracks, Up and Coming and Resilience, opening for applications this October. Its own site blocked our automated checks, so we can't confirm current amounts or residency rules here. Read the call itself before you plan around it.

Outside Europe, the picture narrows fast. The Open Technology Fund supports tools for people facing censorship and surveillance, through an Internet Freedom Fund, a Rapid Response Fund, and a FOSS Sustainability Fund, among others. It's also the clearest example of how fragile this money is. OTF gets most of its funding from the U.S. government, and in March 2025 that agency terminated its grant. OTF sued, and a year later a federal judge ruled the termination unlawful. The funds page lists programs with active application links, but a funder that spent a year in court over its own budget is not one to build a multi-year plan on.

Industry money is mostly security money. Alpha-Omega, run under the Linux Foundation with an annual budget of over $7 million, funds security work in critical projects and ecosystems. We found no public application form, and its project page lists active engagements rather than open calls. The Linux Foundation has also announced $12.5 million from Anthropic, AWS, GitHub, Google, Google DeepMind, Microsoft, and OpenAI, to be managed by Alpha-Omega and OpenSSF, aimed at maintainers buried in automated security reports. If your project is foundational, it's worth getting on their radar. If it's a city budget visualizer, it probably isn't in scope.

The GitHub Secure Open Source Fund is the most accessible option for an individual. It pays $10,000 per project in tranches, requires about 20 hours across a three-week security program and later check-ins, and accepts applications on a rolling basis from any current maintainer in a GitHub Sponsors region. Ten thousand dollars won't hire anyone. It will pay for a hardened release process and a threat model, which most civic projects don't have.

Some names on older lists are winding down. The Digital Infrastructure Insights Fund, backed by Ford, Sloan, Omidyar, and others, funded research on how open infrastructure is built and maintained. Its final open call closed on September 7, 2026, offering $5,000 per short report, and it now plans to continue as an advisory network.

Then there's the plumbing. Open Source Collective is not a funder. It's a fiscal host that handles accounting, taxes, invoices, and contracts for open-source projects, so you can accept donations and grants without forming your own nonprofit. It charges a fixed 10% host fee on incoming funds. Don't confuse it with the Open Collective Foundation, the host many civic and community groups used, which ended its fiscal sponsorship program in September 2024 and dissolved.

Finally, the fund that doesn't exist yet. Advocates led by OpenForum Europe have proposed an EU Sovereign Tech Fund, modelled on Germany's. The Commission's June 2026 open source strategy didn't create one by that name. Instead it proposes an "Open Source Maintenance Instrument" and estimates that EUR 2 billion will need to be mobilised by public and private sectors over seven years. The Open Source Initiative reads the maintenance instrument as a possible stand-in for a sovereign tech fund. The FSFE points out the funding isn't yet secured. Both are right. Until the money passes the EU budget process, it's a plan, not a call you can apply to.

Put it together and two things stand out. Almost all the public money is European, and much of that is German or routed through one Dutch foundation. A team in Lagos or São Paulo has far fewer doors, and some of the ones listed here quietly require residency. And the money is fragile. Since 2024 a major U.S. funder lost its grant, the main EU pipeline paused for a transition, and a widely used fiscal host shut down. Plan as if any single source can disappear, because several just did.

Mir Labs hasn't received money from any of the funders listed here.