Strictly necessary cookies (session, security) are always on. Analytics uses Pirsch (cookieless). With your consent, any advertising on the site can be personalised via cookies. Without consent, ads stay generic and untracked, but may still appear.
Read the privacy notice
EU and privacy-first SaaS verified to run with no US sub-processors in the data path, compared on ownership, hosting region, CLOUD Act exposure and sub-processor chain.
Software listed here is verified to operate with no US sub-processors in the data path: an EU/EEA/Switzerland operator, no US parent, and no US-incorporated processor in the chain. That combination (not server location alone) is what keeps data outside US CLOUD Act reach, because jurisdiction follows ownership and processor incorporation, not where the servers sit.Read the full summary
Disclosure:Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.
Filters
Quick filters
Hosting country
8
CLOUD Act exposure
Ownership
Pricing
Certifications
Showing all 79 alternatives in this category
Showing all 79 alternatives in this category
updating
Dutch sole proprietorship (XIVISOFT / Leendert de Borst), open-source password manager with built-in receive-only email aliases; email aliases cannot send or reply, only receive. Free cloud tier hosted in Germany, AGPL-3.0 and fully self-hostable.
Public DPA: No
Sub-processors: Yes
Open source: Yes
DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Swiss open-source Kolab groupware SaaS (Apheleia IT AG, Bern; Kolab Systems since 2010, Kolab Now since 2013), board incl. FSF Europe founder Georg Greve.
E2E: No
Public DPA: No
Sub-processors: No
Open source: Yes
CH
Switzerland
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Business email, calendar, contacts, tasks, notes and video meetings from LC by vBoxx GmbH, on the group's own hardware near Frankfurt with a Dutch backup site; an integrated Microsoft 365 / Outlook alternative (TLS, not E2E).
E2E: No
Public DPA: Not assessed
Sub-processors: No
Open source: No
Offenbach am Main · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
German-operated (LC by vBoxx GmbH) Leitz-branded business cloud on the group's own hardware: primary site near Frankfurt, backup site in the Netherlands since May 2026, AVV through the customer portal.
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
Offenbach am Main · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Business email, calendars, contacts, tasks, video conferencing and chat from vBoxx B.V., on the vendor's own hardware in Amsterdam with ISO 27001 certified to the company itself; an integrated Microsoft 365 / Outlook alternative for Benelux teams (TLS, not E2E).
E2E: No
Public DPA: Not assessed
Sub-processors: No
Open source: No
Amsterdam · NL
Netherlands
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Hetzner Online GmbH's managed Nextcloud, single data centre in Falkenstein, Germany; ISO 27001 + BSI C5 Type 2 certified, from €4.29/month for 1 TB, no annual contract.
Public DPA: Yes
Sub-processors: Yes
Open source: No
Falkenstein · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch client-document exchange tool (Aer Software Solutions B.V.) for requesting, receiving and sending confidential files, with browser-side encryption and 7-day default retention, hosted on Hetzner in Nuremberg. Not general cloud storage.
Public DPA: Yes
Sub-processors: Yes
Open source: No
Nuremberg · DE
Germany
Sovereignty
A single roll-up of ownership and CLOUD Act exposure.
EU-SovereignThis listingEU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
EU-BasedEU-operated, with at most minor or transient US exposure.
EU-HostedEU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
US-LinkedOperated by a US-incorporated entity, directly subject to US jurisdiction.
Source: EU Vetted dataset, 79 products, methodology v2026.05, as of Oct 2026.
About Software without US sub-processors
About Software without US sub-processors
Software without US sub-processors, as listed on this page, means the operating company is incorporated in the EU, EEA or Switzerland, holds no US parent in its ownership chain, and routes no data through a US-incorporated processor at any point in the stack. That is a chain of three facts (operator incorporation, ultimate ownership and the full sub-processor list), and all three must hold. A product that is EU-hosted but owned by a US parent, or EU-owned but relying on a US-incorporated CDN or managed-database layer, does not clear the bar.
This hub spans all categories in the directory and is benchmarked on the same criteria used across every listing: hosting region, ownership signal, CLOUD Act exposure and the sub-processor chain. Every entry is sourced to the vendor's public sub-processor documentation and re-verified quarterly, so the list reflects current chains rather than a one-time assessment.
Why it matters
Why it matters
The CLOUD Act extends US government reach to data held by any company subject to US jurisdiction, regardless of where the servers physically sit. This is the mechanism that makes a US hyperscaler's "EU region" an incomplete answer to the sovereignty question: the operator's jurisdiction does not change when the data moves to a Frankfurt data centre. The same logic applies one level down. A vendor that is itself EU-incorporated can still re-introduce exposure through its sub-processors: a US-incorporated transactional email service, an analytics layer hosted on a US cloud, or a managed database run by a US subsidiary. Each of those processors is separately reachable under the CLOUD Act.
This is why the directory records ownership and sub-processors as separate, evidenced signals rather than deriving one from the other. A clean ownership chain with a single overlooked US processor is still an exposure. Both must be clear for the "no US sub-processors" flag to apply, and that combination is what this hub surfaces across every product category.
How to choose
Start by narrowing to your category using the filters above. The "no US sub-processors" bar applies equally to password managers, cloud storage, email and analytics, but the sub-processor risk varies by product type. For each shortlisted product, open the profile and read the sub-processor chain against your own transfer-impact assessment: the layers where US processors most often re-enter an otherwise clean stack are transactional email, CDN and DNS, product analytics, and managed databases.
For regulated buyers (financial services, healthcare, public sector), any US-incorporated processor is typically a veto regardless of contractual safeguards, because the CLOUD Act operates independently of contractual terms. For solo founders and small teams, price and developer experience more often settle the decision than the sub-processor question; look for EU-owned products with a short, verifiable sub-processor list rather than spending disproportionate effort on formal transfer-impact assessments. For enterprise procurement, combine this hub with the certification filters (BSI C5, SecNumCloud, EUCS) to build a shortlist that satisfies both the jurisdictional and the security-audit requirements. The filters above match by category, hosting country or compliance score.
Frequently asked questions
What does 'without US sub-processors' mean here?
It means the operating company is EU/EEA/Swiss, has no US parent, and uses no US-incorporated sub-processor in the data path, meeting the directory's 'CLOUD Act exposure: none' bar. We record the ownership and sub-processor chain on every listing, so the flag is evidence-based rather than a self-applied label.
Why do US sub-processors matter even with EU hosting?
Under the US CLOUD Act, data held by a company subject to US jurisdiction can be compelled regardless of where the servers sit. A US-incorporated CDN, email relay or managed-database layer re-introduces that exposure even when the primary host is in the EU. Server location changes where data rests; ownership and processor incorporation determine legal reach.
How is this different from a category page?
A category page lists every product in that category. This hub spans all categories but keeps only the products that clear the 'no US sub-processors' bar, with the editorial and CLOUD Act framing a sovereignty-driven buyer needs. Category, country and certification filters sit above the listing when you want a narrower slice.
Does 'no US sub-processors' guarantee GDPR compliance?
No. It removes one major transfer risk, but GDPR compliance still depends on the DPA, the legal basis, security measures and your own processing. Treat the flag as a strong jurisdictional signal, then confirm the DPA and current sub-processor list directly with the vendor before contracting.
How often is this re-verified?
Quarterly. Sub-processor chains change as vendors add tooling, so a product can move in or out of this list between audits. Each listing carries its last-verified date.
How we verified every listing here
For each product we read the public DPA, sub-processors document, hosting region declaration, certifications, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.
