Skip to content
Independently verified · Quarterly re-audit
EU VETTED
Curated collection

Software without US sub-processors

EU and privacy-first SaaS verified to run with no US sub-processors in the data path — compared on ownership, hosting region, CLOUD Act exposure and sub-processor chain.

In short

Software listed here is verified to operate with no US sub-processors in the data path: an EU/EEA/Switzerland operator, no US parent, and no US-incorporated processor in the chain. That combination — not server location alone — is what keeps data outside US CLOUD Act reach, because jurisdiction follows ownership and processor incorporation, not where the servers sit.

Last verified June 2026 DISCLOSURE Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.

Software without US sub-processors, as listed on this page, means the operating company is incorporated in the EU, EEA or Switzerland, holds no US parent in its ownership chain, and routes no data through a US-incorporated processor at any point in the stack. That is a chain of three facts — operator incorporation, ultimate ownership and the full sub-processor list — and all three must hold. A product that is EU-hosted but owned by a US parent, or EU-owned but relying on a US-incorporated CDN or managed-database layer, does not clear the bar.

This hub spans all categories in the directory and is benchmarked on the same criteria used across every listing: hosting region, ownership signal, CLOUD Act exposure and the sub-processor chain. Every entry is sourced to the vendor's public sub-processor documentation and re-verified quarterly, so the list reflects current chains rather than a one-time assessment.

Why it matters

The CLOUD Act extends US government reach to data held by any company subject to US jurisdiction, regardless of where the servers physically sit. This is the mechanism that makes a US hyperscaler's "EU region" an incomplete answer to the sovereignty question: the operator's jurisdiction does not change when the data moves to a Frankfurt data centre. The same logic applies one level down. A vendor that is itself EU-incorporated can still re-introduce exposure through its sub-processors — a US-incorporated transactional email service, an analytics layer hosted on a US cloud, or a managed database run by a US subsidiary. Each of those processors is separately reachable under the CLOUD Act.

This is why the directory records ownership and sub-processors as separate, evidenced signals rather than deriving one from the other. A clean ownership chain with a single overlooked US processor is still an exposure. Both must be clear for the "no US sub-processors" flag to apply, and that combination is what this hub surfaces across every product category.

How to choose

Start by narrowing to your category using the filters above — the "no US sub-processors" bar applies equally to password managers, cloud storage, email and analytics, but the sub-processor risk varies by product type. For each shortlisted product, open the profile and read the sub-processor chain against your own transfer-impact assessment: the layers where US processors most often re-enter an otherwise clean stack are transactional email, CDN and DNS, product analytics, and managed databases.

For regulated buyers — financial services, healthcare, public sector — any US-incorporated processor is typically a veto regardless of contractual safeguards, because the CLOUD Act operates independently of contractual terms. For solo founders and small teams, the binding constraint is more often price and developer experience; look for EU-owned products with a short, verifiable sub-processor list rather than spending disproportionate effort on formal transfer-impact assessments. For enterprise procurement, combine this hub with the certification filters (BSI C5, SecNumCloud, EUCS) to build a shortlist that satisfies both the jurisdictional and the security-audit requirements. Use the sort and filter controls on the listing above to match by category, hosting country or compliance score.

FAQ

Frequently asked questions

What does 'without US sub-processors' mean here?
It means the operating company is EU/EEA/Swiss, has no US parent, and uses no US-incorporated sub-processor in the data path — the directory's 'CLOUD Act exposure: none' bar. We record the ownership and sub-processor chain on every listing, so the flag is evidence-based rather than a self-applied label.
Why do US sub-processors matter even with EU hosting?
Under the US CLOUD Act, data held by a company subject to US jurisdiction can be compelled regardless of where the servers sit. A US-incorporated CDN, email relay or managed-database layer re-introduces that exposure even when the primary host is in the EU. Server location changes where data rests; ownership and processor incorporation determine legal reach.
How is this different from a category page?
A category page lists every product in that category. This hub spans all categories but keeps only the products that clear the 'no US sub-processors' bar, with the editorial and CLOUD Act framing a sovereignty-driven buyer needs. Use the filters to narrow by category, country or certification.
Does 'no US sub-processors' guarantee GDPR compliance?
No. It removes one major transfer risk, but GDPR compliance still depends on the DPA, the legal basis, security measures and your own processing. Treat the flag as a strong jurisdictional signal, then confirm the DPA and current sub-processor list directly with the vendor before contracting.
How often is this re-verified?
Quarterly. Sub-processor chains change as vendors add tooling, so a product can move in or out of this list between audits. Each listing carries its last-verified date.
Methodology

How we verified every listing here.

For each product we read the public DPA, sub-processors document, hosting region declaration, certifications, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.

Read methodology →