Eurobase is a fully EU-native backend-as-a-service platform — a free, GDPR-native European alternative to Firebase and Supabase. It provides 6 authentication methods (email, magic links, OAuth with Google/GitHub/LinkedIn/Apple, and phone SMS OTP), managed PostgreSQL, object storage, realtime subscriptions, Deno edge functions, encrypted vault, cron jobs, webhooks, a CLI with 50+ commands, and audit logging — all hosted exclusively on European infrastructure under EU jurisdiction.

How is Eurobase different from Firebase or Supabase?

Unlike Firebase (Google) and Supabase (US-based), Eurobase is 100% European-owned and operated on EU infrastructure. It is not subject to the US CLOUD Act, offers GDPR-native architecture with automated DPA reports, GDPR data export, sub-processor registry, and full audit logging. It includes features like encrypted vault, cron scheduling, webhooks with HMAC signing, and a dedicated CLI — with zero sovereignty compromise.

Is Eurobase GDPR compliant?

Yes. Eurobase is GDPR-native by design — not as an add-on. Every project ships one-click DSAR exports (Article 15 right of access + Article 20 right to data portability), an Article 30 Record-of-Processing report generated from your live configuration, a tamper-evident audit log with actor/action/IP, a per-project sub-processor registry, and row-level security. All data is stored on 100% EU-owned infrastructure (Scaleway, France) — zero US CLOUD Act exposure.

Do Firebase or Supabase offer built-in DSAR exports?

No. Neither Firebase nor Supabase ships a built-in DSAR (Data Subject Access Request) primitive. On Firebase you write a custom Cloud Function that walks every Firestore collection plus Auth and Storage. On Supabase you hand-roll SQL across auth.users and every public table. On AWS Amplify you stitch DynamoDB, Cognito, and S3 buckets together yourself. Eurobase is the only EU-native BaaS that ships GDPR Article 15 + Article 20 exports as a one-click platform feature, available on every project and every tier — free included. We won't paywall a legal obligation.

How much does a DSAR cost to fulfil manually?

Industry surveys put the average cost of fulfilling a single DSAR at around $1,500 — typically 8–12 hours of engineering time spent stitching CSV exports together, searching support tools, and walking application logs. Request volume jumped 246% in the two years to 2024. Statutory response time under GDPR Article 12 is 30 days; missing it carries supervisory-authority risk up to €20 million or 4% of global annual turnover. Eurobase replaces the manual workflow with a one-click console export plus an SDK call (`eb.auth.exportMyData()`) that lets end-users self-serve, rate-limited and audited.

Is Eurobase free to use?

Yes. The Free tier includes 5,000 monthly active users, 512 MB storage, 2 GB bandwidth, 50 realtime connections, and every feature — no credit card required. Projects auto-pause after 30 days idle and wake on the first request. Pro is €25/mo per project (no pausing, custom email templates, BYO SMTP, quota alerts, 100,000 MAU). A Team tier with dedicated PostgreSQL 16 (2 vCPU / 4 GB RAM / 50 GB SSD, France) is €149/mo per project (coming soon). A Legal Team tier for German legal-tech is in closed beta — pricing on request.

What are the limits for auth emails (verification, password reset, magic link) on Pro?

No throughput cap from our side when you use BYO SMTP. Verification, password-reset, and magic-link emails all route through the same dispatcher: if a verified custom SMTP sender is configured on your project, the send goes through your provider and skips our platform sender entirely — your provider's limits apply, not ours. Without BYO SMTP, sends go through our platform TEM; there's no hourly project cap enforced today. Rate-limits page in the console shows what applies.

Can I send verification or password-reset emails to thousands of users at once on Eurobase?

Yes — no recipient-count limit. Distributed real users each come from their own IP, so the two anti-abuse throttles that do apply don't bite a real user base: signup/signin is capped per-IP (up to 30 per 5 minutes on Pro), and token verifications are capped per-IP (up to 150 per 5 minutes on Pro). Password-reset volume itself is unbounded from our side. Pair Pro with BYO SMTP (SendGrid, Postmark, Amazon SES, Scaleway TEM) and your provider is the only ceiling.

Can I fully customize verification, password-reset, and magic-link emails on Eurobase?

Yes on Pro and above — subject line and HTML body are independently customizable per template type (verification, password_reset, magic_link). Templates are picked up automatically on every send with no code change. Free tier uses the default templates.

Does Eurobase support German legal-tech retention (§50 BRAO / §257 HGB / §147 AO)?

Yes, on the Legal Team tier (closed beta). §50 BRAO Aufbewahrungspflicht is 6 years flat; §257 HGB is split (10 years for Handelsbücher / Rechnungen / Jahresabschlüsse, 6 years for Handelsbriefe); §147 AO mirrors the §257 HGB split. Legal Team ships WORM per-prefix object-storage locks, ad-hoc retention holds (per record / per prefix), DSAR erasure that respects legal holds, a 10-year audit-log retention window, signed §203 StGB Verschwiegenheitsverpflichtungen from every staff member with data access, and a GoBD Verfahrensdokumentation. See eurobase.app/security#de-legaltech for the full dossier and the linked v2 legal documents.

What backend does a German legal-tech / Kanzlei-facing product actually need?

Four hard blockers you cannot solve with a plain EU-region Firebase or Supabase deployment: (1) §203 StGB / §43e BRAO staff-secrecy paperwork — signed declarations from every staff member with data access; (2) statutory retention with WORM enforcement — §50 BRAO 6y, §257 HGB 10y books / 6y letters, §147 AO mirror; (3) GoBD-conformant exports plus a Verfahrensdokumentation; (4) 10-year tamper-evident audit-log retention. Eurobase closes all four on the Legal Team tier (closed beta) via an addendum to the DPA. Region-only EU hosting does not satisfy any of them.

Does Eurobase have BSI C5, ISO 27001, and IT-Grundschutz coverage?

Actual certificates are on the post-beta roadmap. Today the dossier at eurobase.app/security#de-legaltech includes a dated BSI C5 roadmap (target Type-1 attestation 12 months post-launch), an ISO 27001 Statement of Applicability draft covering 2022 Annex A controls, a BSI IT-Grundschutz self-declaration under the Basis-Absicherung profile for SME, a NIS-2 positioning document (below employee/revenue thresholds today, voluntary cascade-obligation compliance, commitment to register on crossing), and an AI Act positioning document (Eurobase is infrastructure, not an AI system; the Customer is the deployer for any high-risk build).

Is Eurobase available today?

Yes — sign up at console.eurobase.app, no credit card required. The complete backend platform — including auth, database, storage, realtime with row-level filtering, edge functions with scheduled jobs, vault, cron, webhooks, CLI, GDPR self-serve export, MCP server, and audit logging — is built and in production. Free tier: 5,000 monthly active users, 512 MB Postgres, all features included. Pro: €25/mo per project.

Is Eurobase good for vibe coding?

Absolutely. Eurobase is designed for fast iteration — sign up, get your API keys, and start building in minutes. Auth (6 methods), database, storage, realtime, functions, vault, cron, and webhooks are ready out of the box with simple SDKs and a CLI with 50+ commands. No infrastructure setup, no DevOps, no compliance paperwork. Just vibe and build.

Where is Eurobase data stored?

All data is stored exclusively on European infrastructure operated by EU-owned providers, specifically Scaleway in France. Eurobase has zero exposure to the US CLOUD Act or similar extraterritorial legislation. Your data never leaves EU jurisdiction.

Is there a Supabase alternative in the EU?

Yes. Eurobase is a Supabase-compatible backend built and hosted entirely in the EU. Same Postgres foundation, same auth + storage + realtime + edge functions surface, same SDK shape. The difference is the corporate parent (Estonian OÜ vs Delaware) and the infrastructure floor (Scaleway in France vs AWS). That removes the CLOUD Act exposure that survives even when Supabase is deployed in an EU region.

Is a Supabase EU-region deployment enough for GDPR?

Picking Supabase's EU region gives you physical data residency in the EEA and a standard SCC-based DPA — a competent baseline, but not immunity from the CLOUD Act. Because Supabase Inc. is a Delaware corporation using AWS, US authorities can compel data access even for EU-region deployments. Eurobase removes that exposure by having no US corporate parent and no US-owned processor in the critical path.

How do I migrate from Supabase to Eurobase?

Use the Eurobase CLI: `eurobase import supabase assess` for a read-only report against your existing Supabase project, then `eurobase import supabase schema | data | storage | functions` to move each surface. Auth-user import is next. The CLI reads your Supabase project directly and emits an executable plan; no rewrites required on your app code.

My app is built on the supabase-js client. Do I have to rewrite my client layer?

The honest picture on three levels. (1) Shape-parity: @eurobase/sdk mirrors @supabase/supabase-js deliberately — same .from(table).select().eq() chain, same channel(name).on('postgres_changes', …) subscribe shape, same auth methods. In practice this is search-replace on imports + package name, not a rewrite of query call sites. (2) Drop-in supabase-js wire-compat (same package name, no code change at all) is on the roadmap as a shim package — it removes the young-company objection entirely. (3) Zero-SDK escape hatch on Team tier: a direct Postgres DATABASE_URL means Payload, Prisma, Drizzle, or any Postgres client works without any Eurobase-specific code — the reversibility guarantee then covers your app code too, not just your data.

Are automatic backups included?

Free and Pro projects share a pooled Postgres cluster (Scaleway Managed Database, France) with cluster-level snapshots (daily, 7-day retention). Restores go through support. Team tier gets dedicated Postgres per project with daily scheduled backups (7-day retention) plus customer-triggered on-demand snapshots and 1 self-service restore per calendar month — from either source, either counts against the same cap. On every tier, `eurobase db dump` produces a standard pg_dump you can export anywhere at any time — the first-line reversibility guarantee independent of us.

What happens if I exceed the Pro-tier storage or bandwidth caps?

No overnight blackout — that is a business-risk pattern paying customers can't manage, and one of the clearest pieces of feedback from beta users. The Pro-tier overage policy for public beta: (1) email alerts at 75% and 100% of the storage / bandwidth caps. (2) A 14-day soft-grace window where writes continue and the console shows the overage banner — enough time to upgrade to Team, buy an add-on capacity block, or optimise. (3) Only after the grace window does the affected module hard-block writes — and even then reads always continue. Team tier (dedicated Postgres per project + elastic storage tier) removes the caps entirely and is the recommended path for photo/video-heavy or streaming workloads. We do not meter per-GB overage on Pro — no surprise line items.

How is the 10,000 realtime connections cap counted?

Active concurrent WebSocket connections. No hard limit on messages/second or connection duration today, but soft fair-use at ~100 msg/s per connection and ~1M msg/s per project — raiseable on request. Practical connection duration is bounded by TCP keepalive + our load-balancer idle timeout (600 s).

Can I point Eurobase at my own S3 bucket (BYO storage)?

Not today. BYO S3 is on the Team-tier roadmap — it needs per-tenant credentials + audit-path rewiring. No firm date. In the meantime, our object storage runs on Scaleway (Paris, France) with the same sovereignty guarantees as the rest of the platform.

Who is the contracting legal entity, and does it have any non-EU parent or subsidiary?

Contracting entity: Eurobase OÜ, Estonian private limited company, registry code 17557586, Ahtri 12, Tallinn 15551. Not VAT-registered under Estonian VAT Act §19. No parent company, no subsidiaries, no non-EU entity. Sole shareholder is the founder. Every sub-processor in the RoPA is EU-headquartered.

Do you provide a signable DPA and an up-to-date sub-processor list?

Yes. DPA v2 is signable at eurobase.app/legal. The sub-processor list is auto-generated per project in the console Compliance tab as an Article 30 report (downloadable PDF, updated on every configuration change). No email tickets, no stale spreadsheets.

When can your team access customer data, and can I audit it?

Our team is three people, all physically in the EU. Every operator SQL call goes through an authenticated pool that writes to public.data_access_log — every query stamped with actor, source IP, and active Postgres role. You see that table from your own console (Audit tab). We do not process your data content for any purpose other than platform operation.

What SLA do you commit to per tier?

Free: no commitment. Pro: 99.5%/month, support response within 24h business hours. Team: 99.9%/month, response within 4h. No automatic downtime credits today — honest reflection of team size at launch. Credits land with the Team tier opening.

What happens to my data — and my app code — if Eurobase ceases operations?

Data reversibility, four lines of defence. (1) Standard formats: Postgres + S3-compatible = migration to any host (Scaleway direct, OVH, Aiven, self-hosted) is documented, not a rewrite. (2) Export CLI: eurobase export produces a full dump (schema + data + storage + functions). (3) Source is public today: platform code lives on github.com/STGime/euroback under BUSL-1.1, with an Additional Use Grant that permits self-hosting for your own apps and internal tools; each commit auto-converts to Apache 2.0 four years after it lands. SDK + MCP server are MIT. What is not shipped yet is a supported self-host distribution. (4) On shutdown: 90-day notice + 90 additional days of read-only service to finalise export. App-code reversibility, two mitigations: (a) @eurobase/sdk is shape-parity with supabase-js, so migrating away is search-replace on imports, not query-site rewrites. (b) On Team tier, the direct DATABASE_URL means your app can talk to Postgres with Payload / Prisma / Drizzle / psql — no Eurobase code in the client at all — so migration is a hostname change.

How big is the Eurobase team, and how are you funded?

Core team: founder + two long-term freelancers, all EU-based. Bootstrapped, with EU-Sovereign-Cloud grant applications in flight and preliminary angel conversations. The way to size that risk is not our reassurances — it is the reversibility guarantee (Postgres dump + standard S3 + source public on GitHub under BUSL, auto-Apache 2.0 after four years). If we sink, you migrate to Scaleway direct in a weekend using the export CLI.

← Back to the checker

Vendor ratings

Every vendor in the open sovereignty-vendors dataset. Click any name for the sources, the one-line reason, and the five-dimension breakdown.

AkamaiCDN
NASDAQ-listed US corporation (AKAM). Global edge CDN with EU-only pinning available; the contracting entity and control plane are US.
red
Amazon SESEmail
Amazon SES inherits AWS's exposure: the Luxembourg contracting entity's ultimate parent (Amazon.com, Inc.) is US-incorporated, so an SES EU region is still reachable under CLOUD Act.
red
AmplitudeAnalytics
US-listed corporation (NASDAQ: AMPL) running on Google Cloud. EU residency exists on enterprise plans; the contracting entity remains US-based and CLOUD-Act-exposed.
red
Anthropic (Claude)AI / LLM
Delaware public benefit corporation; inference runs on AWS Trainium and GCP TPUs, primarily in US regions. No EU region for the direct API today.
red
AppwriteBackend-as-a-service
Appwrite Cloud is a Delaware corporation with headquarters in Tel Aviv, running on Google Cloud. Frankfurt region available; the US contracting entity and GCP dependency both apply.
red
Auth0 (Okta)Auth
Auth0 is an Okta subsidiary; both entities are US-incorporated. EU tenant region on AWS Frankfurt is available but does not remove Okta's US jurisdiction over the contract.
red
Amazon Web ServicesHosting / cloud
The EU-Luxembourg contracting entity is a subsidiary of Amazon.com, Inc. (US). CLOUD Act reach follows the ultimate parent — an EU subsidiary is not a jurisdictional firewall.
red
AxiomMonitoring
Delaware corporation on AWS. Structured event ingestion for logs + traces; EU region on AWS Frankfurt available, US contracting entity applies CLOUD Act.
red
Microsoft AzureHosting / cloud
Microsoft Ireland Operations Limited is the EU contracting entity, but ultimate parent Microsoft Corporation is US-listed. Azure EU regions do not shield from the CLOUD Act — the parent's jurisdiction reaches through the Irish sub.
red
Azure Blob StorageObject storage
Azure Blob Storage inherits Azure's exposure: EU-region buckets are available but the contracting entity's ultimate parent (Microsoft Corp.) is US-listed.
red
Backblaze B2Object storage
NASDAQ-listed US corporation (BLZE). EU-Central region on their own hardware in Amsterdam, but the corporate entity's US anchor puts contracts under the CLOUD Act.
red
BugsnagError tracking
Bugsnag was acquired by SmartBear (US) in 2021. EU region available on Enterprise plans; the US contracting entity is what the CLOUD Act reaches.
red
ChecklyMonitoring
Checkly Inc. is US-incorporated (Boston HQ); Checkly GmbH is the German affiliate for engineering ops but not the contracting entity. Synthetic monitoring on AWS with EU region; the US corporate anchor stands.
red
CircleCICI / CD
Delaware corporation on AWS and GCP US regions. No EU cloud tenancy option; the 2023 incident disclosure confirmed all customer secrets sit in US-controlled stores.
red
ClerkAuth
Delaware corporation on AWS. EU region added in 2024 for Business+ plans; the entity is US and support staff sit in the US.
red
ClickHouse CloudDatabase
Delaware corporation running on all three hyperscalers. EU regions available; the US contracting entity plus hyperscaler dependencies both apply CLOUD Act exposure.
red
CloudflareCDN
US-incorporated (Cloudflare, Inc.); the Data Localization Suite is a meaningful mitigation on the data-location + processing dimensions, but the parent-jurisdiction fact is unchanged and the CLOUD Act still reaches the entity. Overall red by the "worst dimension wins" rule.
red
Amazon CloudFrontCDN
CloudFront inherits AWS's exposure: EU-region pinning is possible for cached content, but the corporate anchor is Amazon.com, Inc. (US).
red
CockroachDB CloudDatabase
Delaware corporation. Serverless and Dedicated tiers run on AWS / GCP / Azure. EU regions available; the corporate entity's US anchor remains.
red
Couchbase CapellaDatabase
NASDAQ-listed US corporation (BASE). Capella cloud runs on all three hyperscalers with EU region options; the US corporate anchor remains.
red
DatadogMonitoring
NASDAQ-listed US corporation. EU1 site is on AWS Frankfurt but ingest, alerting, and support operations are US-anchored. Logs, traces, metrics all subject to CLOUD Act at the entity.
red
DigitalOceanHosting / cloud
NYSE-listed US corporation (DOCN). Amsterdam, Frankfurt, and London regions available; the Delaware entity anchors CLOUD Act exposure regardless of droplet location.
red
DiscordCommunication
Delaware corporation running on Google Cloud US regions. No EU tenancy option; every message and voice payload transits US infrastructure by design.
red
FastlyCDN
NYSE-listed US corporation (FSLY). Global edge network but the corporate entity and control plane are US-based, so CLOUD Act applies to logs and any origin-shielding.
red
FirebaseBackend-as-a-service
Google LLC contracting entity, Alphabet parent, runs on GCP — a US hyperscaler that is itself a US-owned control plane. CLOUD Act reach is direct and unmitigated by region choice.
red
Fly.ioHosting / cloud
Delaware corporation, operates its own global edge-container network. EU regions (Frankfurt, Amsterdam, Madrid) available; the contracting entity's US anchor stands.
red
Google Cloud PlatformHosting / cloud
Google Ireland Limited signs the DPA but is a subsidiary of Alphabet Inc. (US). CLOUD Act applies to the parent, not the signing entity.
red
Google Cloud StorageObject storage
Google Cloud Storage inherits GCP's exposure: the Irish contracting entity's ultimate parent (Alphabet Inc.) is US. Multi-region EU buckets do not shield from the CLOUD Act.
red
GitHub ActionsCI / CD
GitHub, Inc. is a Microsoft subsidiary; both are US corporations. Actions runners live on Azure — jurisdiction, control plane, and secrets storage all sit under US law.
red
GitLab CI (SaaS)CI / CD
GitLab.com is a Delaware corporation on GCP US regions. Self-managed GitLab on EU-hosted infrastructure avoids all of this exposure entirely — many teams pick that path for sovereignty.
red
Google AnalyticsAnalytics
Google Ireland Limited is the EU contracting entity for EU customers, but Alphabet's US jurisdiction reaches through it. Multiple EU DPAs have ruled GA4 fails Schrems II under DPF.
red
Grafana CloudMonitoring
Grafana Labs is Delaware-incorporated even though a large share of engineering is in Sweden. EU region on AWS Frankfurt available; the contracting entity anchors CLOUD Act exposure.
red
GroqAI / LLM
Delaware corporation running its own LPU hardware in US datacenters. Fast inference, but the jurisdiction is unchanged from any US LLM provider.
red
HoneycombMonitoring
Delaware corporation (dba Honeycomb.io). EU region on AWS Ireland is available; the US entity and the AWS EMEA hyperscaler dependency both apply.
red
Hugging FaceAI / LLM
Delaware corporation with French engineering roots and Paris office; Inference Endpoints and Spaces run on AWS regions. EU region available; the US contracting entity remains.
red
Lemon SqueezyPayments
Acquired by Stripe in July 2024; ultimate parent is now Stripe, Inc. (Delaware). US LLC on AWS US regions. Same CLOUD Act exposure as Stripe itself.
red
Linode (Akamai)Hosting / cloud
Acquired by Akamai in 2022; Linode LLC's ultimate parent is Akamai Technologies (NASDAQ: AKAM). EU regions (Frankfurt, London, Amsterdam, Stockholm) available; the US anchor stands.
red
LiveKitCommunication
Delaware corporation, WebRTC SFU cloud on AWS. Global edge but US contracting entity; self-hosted LiveKit OSS is the sovereign path.
red
LogRocketError tracking
Delaware corporation on AWS. Session-replay tool captures full user sessions; EU region available but the US contracting entity has direct CLOUD Act exposure.
red
MailgunEmail
Ultimate parent Sinch AB is Swedish, but Mailgun's contracting entity remains a Delaware corporation that must comply with the CLOUD Act regardless. EU region available but shared US infrastructure remains.
red
MixpanelAnalytics
Delaware corporation on Google Cloud, EU residency available on higher plans. US and Indian operational access is standard for the Cloud tier.
red
MongoDB AtlasDatabase
NASDAQ-listed US corporation (MDB). Atlas runs on all three hyperscalers with EU region options; the US contracting entity and US-listed parent anchor CLOUD Act exposure.
red
MuxCommunication
Delaware corporation, video streaming API on AWS + GCP. Global CDN delivery but the origin encoding + control plane are US-jurisdictional.
red
NeonDatabase
Acquired by Databricks in May 2025; ultimate parent is now a Delaware corporation. EU-Central region on AWS Frankfurt available; the US entity anchor stands.
red
New RelicMonitoring
Delaware corporation, private since Francisco Partners' 2023 take-private. EU region on AWS Dublin available; the contracting entity remains US.
red
OpenAIAI / LLM
US LLC running on Microsoft Azure US regions. Zero-data-retention API mode reduces retention risk but does not change jurisdiction — inference still runs on US-controlled infrastructure.
red
Ory NetworkAuth
Ory Corp is a Delaware C-corp with engineering presence in Munich; Ory Germany GmbH is the EEA GDPR representative, not the contracting entity. Ory Network Cloud has an EU region but the corporate anchor is US.
red
PagerDutyMonitoring
NYSE-listed US corporation (PD). Incident response platform on AWS with EU-region option; the contracting entity's US anchor stands.
red
PayPalPayments
PayPal Europe is Luxembourg-licensed as a bank, but ultimate parent PayPal Holdings, Inc. is US-listed. CLOUD Act exposure follows the parent, not the EU banking licence.
red
PerplexityAI / LLM
Delaware corporation running on AWS US regions. Search + LLM API; no EU tenancy option, and every query transits US infrastructure by design.
red
PlanetScaleDatabase
Delaware corporation on AWS, EU-West-1 region available. Contracting entity's US anchor keeps CLOUD Act exposure regardless of chosen region.
red
PostHogAnalytics
Delaware-incorporated with London ops; EU region on AWS Frankfurt available. Self-hostable OSS avoids the exposure entirely; the Cloud offering does not.
red
PostmarkEmail
Postmark (Wildbit) was acquired by ActiveCampaign in 2022. Contracting entity and infrastructure are US-only; no EU region option. Every message body transits US datacenters.
red
Cloudflare R2Object storage
R2 is a Cloudflare-operated object store. Location hints can pin data to EU jurisdictions, but Cloudflare, Inc. is Delaware-incorporated and subject to the CLOUD Act.
red
Redis CloudDatabase
US-incorporated (Delaware), operates via Redis Labs Ltd (US corp) with Israeli engineering office. Cloud service runs on the three hyperscalers with EU regions available.
red
RenderHosting / cloud
Delaware corporation running on GCP. Frankfurt region for EU customers; the US contracting entity plus GCP subprocessor apply CLOUD Act exposure regardless.
red
ReplicateAI / LLM
Delaware corporation running on Google Cloud US regions. Model-inference API for open-source models; every request transits US infrastructure.
red
ResendEmail
Resend, Inc. is Delaware-incorporated and subject to the CLOUD Act. EU region is available on paid plans but runs on AWS, and support staff are US-based.
red
RollbarError tracking
US corporation running on AWS US-East. No EU regional option — every event payload transits the US, which the CLOUD Act reaches directly.
red
Amazon S3Object storage
Amazon S3 inherits AWS's exposure: the Luxembourg contracting entity's ultimate parent (Amazon.com, Inc.) is US-incorporated, so an S3 EU-region bucket is still reachable under the CLOUD Act.
red
SendGrid (Twilio)Email
SendGrid is a Twilio product; contracting entity is Twilio Inc. (Delaware) and subject to the CLOUD Act. An EU regional address is available but does not shield the parent's jurisdiction.
red
SentryError tracking
Delaware corp; EU region on Google Cloud Frankfurt is available on Business plans. Contracting entity remains US-based and stack traces / event payloads reach it.
red
SlackCommunication
Slack is a Salesforce subsidiary — both entities are US-incorporated. EU Data Residency add-on pins message storage to Frankfurt but does not remove parent jurisdiction.
red
Statuspage (Atlassian)Monitoring
Statuspage is an Atlassian product; ultimate parent Atlassian Corporation is Delaware-listed (moved from UK in 2022) despite the Australian operational entity. Hosted on AWS US.
red
StripePayments
Stripe Payments Europe (Dublin) signs European customer contracts but is a subsidiary of Stripe, Inc. (Delaware). CLOUD Act reach applies to the parent.
red
StytchAuth
Delaware corporation on AWS US regions. Passwordless auth API without an EU tenancy option; every session token and user record transits US infrastructure.
red
SupabaseBackend-as-a-service
Contracting entity Supabase, Inc. is US-incorporated and subject to the CLOUD Act regardless of the EU region configured; runs on AWS as sole hyperscaler subprocessor.
red
Timescale CloudDatabase
Delaware corporation running on AWS. Managed TimescaleDB / PostgreSQL with EU-Central and EU-West regions; the US contracting entity puts it under the CLOUD Act regardless.
red
Together AIAI / LLM
US corporation offering open-model inference. Runs on Together's own GPU clusters (subprocessor chain is clean) but the corporate entity and datacenters are US-based.
red
TwilioCommunication
NYSE-listed US corporation (TWLO). EU regional endpoint on AWS Ireland exists; message bodies and CDRs still transit a US-controlled contracting entity.
red
VercelHosting / cloud
Vercel Inc. (US) contracting entity, runs on AWS (US-owned control plane). EU region is available for edge caching but the platform's control plane is US-jurisdictional.
red
WasabiObject storage
Delaware corporation with EU regions in Amsterdam, London, and Paris. Pinning a bucket to EU-Central still leaves the contracting entity subject to the CLOUD Act.
red
WorkOSAuth
Delaware corporation running on AWS US regions. No EU tenancy option today; SSO / SCIM traffic transits US infrastructure.
red
YugabyteDB ManagedDatabase
Delaware corporation running on all three hyperscalers. Distributed SQL with EU region options; US contracting entity anchors the exposure.
red
AblyCommunication
UK limited company (London HQ), realtime pub-sub over WebSockets. Global edge on AWS regions; UK adequacy covers transfers.
amber
AivenDatabase
Finnish OY, EU-hosted contracting entity and EU-only support ops. Runs on AWS / GCP / Azure — so the underlying hyperscaler's exposure cascades in, but the Finnish anchor sets it apart from pure-US managed-DB vendors.
amber
AlgoliaOther
French SAS (Paris HQ), search-as-a-service on AWS + GCP regions. EU option available; hyperscaler subprocessor drags chain to amber.
amber
Bird (MessageBird)Communication
Dutch B.V. (rebranded from MessageBird 2023). Amsterdam HQ, EU-only support ops. SMS, voice, and CRM cloud runs on AWS regions; EU pinning brings data location to amber.
amber
BuildkiteCI / CD
Australian Pty Ltd; control plane on AWS. Because Buildkite's model runs agents on your own infrastructure, build artifacts and code can stay in your EU environment even though the control plane does not.
amber
Checkout.comPayments
UK limited company (London HQ), FCA-regulated payment institution. Global card acquiring with EU-region hosting on AWS. UK adequacy covers transfers.
amber
CohereAI / LLM
Canadian corporation (Toronto HQ), covered by the EU-Canada adequacy decision. Runs on AWS and GCP; not subject to the CLOUD Act, but hyperscaler subprocessors do carry exposure.
amber
Fathom AnalyticsAnalytics
Canadian entity (BC), covered by the EU-Canada adequacy decision. Not subject to the CLOUD Act, but Canadian production access still counts as a cross-border transfer.
amber
GoCardlessPayments
UK limited company, EU-Ireland AWS hosting. UK adequacy decision covers transfers so no SCCs needed. AWS EMEA dependency drags subprocessor chain to amber.
amber
KindeAuth
Australian Pty Ltd — not subject to the CLOUD Act, but Australia has no EU adequacy decision. EU region on AWS reduces data-location risk; entity risk sits with Australian law.
amber
Matomo CloudAnalytics
New Zealand Ltd (InnoCraft); Matomo Cloud EU customers land on Frankfurt hosting. NZ has an EU adequacy decision. Not subject to the CLOUD Act; the NZ parent-jurisdiction adds mild exposure.
amber
Meilisearch CloudOther
French SAS (Paris HQ), open-source search engine with a managed cloud offering on AWS. EU region available; the Meili SAS anchor is French.
amber
NhostBackend-as-a-service
Swedish AB, EU-only operational access. Runs on AWS regions worldwide; pinning EU keeps data location safe, but AWS EMEA subprocessor drags the chain to amber.
amber
PaddlePayments
UK limited company, EU-Ireland hosting on AWS. UK adequacy decision covers transfers, so no SCCs needed. AWS EMEA dependency drags subprocessor chain to amber.
amber
RaygunError tracking
New Zealand Ltd, covered by the EU-NZ adequacy decision. Not subject to the CLOUD Act; runs on AWS with EU-Frankfurt region option. NZ operational access adds mild exposure.
amber
SinchCommunication
Swedish AB publicly listed on Nasdaq Stockholm. Ultimate parent is EU; some infrastructure rides on AWS, some on Sinch's own network. Route-dependent — check per product line.
amber
TeamCity Cloud (JetBrains)CI / CD
Czech s.r.o. (Prague HQ), EU-only support ops. TeamCity Cloud runs on AWS regions; pinning EU brings location to amber but the entity anchor is EU-adequate throughout.
amber
AdyenPayments
Dutch N.V. publicly listed on Euronext Amsterdam. Regulated as a bank by DNB; operates its own core payments infrastructure. No US corporate control.
green
Aleph AlphaAI / LLM
German GmbH headquartered in Heidelberg. Trains and serves Luminous / Pharia models on its own EU infrastructure. Explicitly positioned as the sovereign-AI provider for regulated EU buyers (public sector, banking, defence).
green
Brevo (Sendinblue)Email
French SAS (rebranded from Sendinblue in 2023), datacentres in France and Germany. No US corporate control; EU-only operations.
green
Bunny.netCDN
Slovenian d.o.o., no US parent or subsidiary in the chain. Edge network is global but the contracting entity and control plane sit inside the EU.
green
CodemagicCI / CD
Estonian Ltd (Nevercode), operates its own EU build fleet for mobile CI/CD. No US corporate entity in the chain.
green
EurobaseBackend-as-a-service
Estonian OÜ, EU-hosted on Scaleway (France), EU payments via Mollie (Netherlands). No US entity, no US processor, no data transfer requiring SCCs or TIA.
green
ExoscaleHosting / cloud
Swiss SA (Akenes / Exoscale), ultimate parent A1 Digital is Austrian (part of the Austrian Telekom Group). Datacentres in Geneva, Zurich, Vienna, Frankfurt, Sofia.
green
GatewayAPICommunication
Danish ApS, servers and operations in Denmark. SMS and voice with Danish contracting entity — no US corporate control anywhere in the chain.
green
HetznerHosting / cloud
German GmbH, privately owned, datacentres in Germany and Finland. No US corporate control. Cloud, dedicated servers, and storage all covered.
green
InfobipCommunication
Croatian Ltd (Vodnjan HQ), private, operates its own global SMS + omnichannel network. EU contracting entity for EU customers; no US corporate control.
green
IONOSHosting / cloud
German SE, publicly listed on Frankfurt Stock Exchange (United Internet AG majority shareholder). Datacentres in Germany, UK, Spain, US. Explicitly positioned as sovereign cloud provider for German public sector.
green
KeyCDNCDN
Swiss LLC (proinity), no US corporate ownership. Switzerland holds an EU adequacy decision so transfers are lawful without SCCs; edge PoPs are worldwide but the anchor is Zurich.
green
KlarnaPayments
Swedish AB, licensed as a bank by the Swedish Financial Supervisory Authority (Finansinspektionen). BNPL and payment processing under Swedish jurisdiction; no US corporate anchor.
green
MailjetEmail
French SAS with a Swedish parent (Sinch AB); infrastructure in France and Belgium, operations EU-only. No US corporate entity in the chain.
green
Mistral AIAI / LLM
French SAS; La Plateforme (Mistral's own inference platform) runs in EU regions. No US corporate control over the contracting entity.
green
MolliePayments
Dutch B.V., privately owned, EU-hosted, EU-operated. Card + iDEAL + SEPA processing without a US payment schemes intermediary in the contract path.
green
OVHcloudHosting / cloud
French SAS, ultimate parent OVH Groupe SA (publicly listed on Euronext Paris). Datacentres in Roubaix, Gravelines, Strasbourg, Frankfurt, Warsaw. No US corporate control.
green
Plausible AnalyticsAnalytics
Estonian OÜ, servers in Germany (Hetzner), remote team but no US corporate entity anywhere. Explicitly built as a GDPR-first alternative to Google Analytics.
green
ScalewayHosting / cloud
French SAS, ultimate parent Iliad (publicly listed on Euronext Paris), datacentres and operations in France, Netherlands, and Poland. No US corporate control anywhere in the chain.
green
Simple AnalyticsAnalytics
Dutch BV, servers in the Netherlands. Cookie-free, GDPR-first alternative to Google Analytics with no US corporate entity in the chain.
green
UpCloudHosting / cloud
Finnish Ltd, private, EU-headquartered with datacentres across Helsinki, Frankfurt, Amsterdam, Madrid, Warsaw. No US corporate ownership.
green