Skip to content
Independently verified · Quarterly re-audit
EU VETTED
Curated collection

Video conferencing without US sub-processors

European video-conferencing tools verified to run with no US sub-processors, compared on ownership, hosting region, CLOUD Act exposure and sub-processor chain.

In short

The video-conferencing tools listed here operate with no US sub-processors in the data path: an EU/EEA/Switzerland operator with no US parent and no US-incorporated processor, including the media relays that carry the calls. Tixeo (France, Montpellier, ANSSI CSPN-certified end-to-end encryption, French-hosted) is the strongest option for security-sensitive meetings; sipgate (Germany, Düsseldorf, self-financed telephony operator running its own German infrastructure) covers everyday business calls, and Threema (Switzerland, fully Swiss-hosted E2EE messenger) covers secure calls in a messaging context. The list is deliberately short: this is one of the categories where most European-branded tools still relay media or store recordings through US-incorporated infrastructure, so few clear the bar.

EU Vetted Editorial
Verified June 2026 How we verify

Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.

Video conferencing without US sub-processors, as listed on this page, means the operating company is incorporated in the EU, EEA or Switzerland, holds no US parent in its ownership chain, and routes no call data through a US-incorporated processor, including the media relays that actually carry the audio and video, not just the web application around them. That last clause is what makes this category hard: the call path is the product, and it is the part most often rented from someone else.

This page lists the tools in our directory that meet the full test, benchmarked on hosting region, ownership signal, CLOUD Act exposure and the sub-processor chain. It is deliberately a short list. Real-time media infrastructure is expensive, and most European-branded meeting products lease relay capacity or recording storage from US-incorporated providers, which their own sub-processor lists disclose. The tools here run the media path on European infrastructure they control. We check the vendor's own published documentation and repeat the check every quarter.

Why it matters

Two things move when a call happens, and they typically go through different processors. The audio and video itself routes through a TURN relay whenever a direct peer connection fails (which is often, behind corporate firewalls and mobile networks), and that relay either carries plaintext or holds the encryption keys unless the implementation is genuinely end-to-end. Separately, the metadata of the call, who met whom, when, for how long, from what IP, alongside calendar invites and participant directories, sits with the scheduling and notification layer regardless of what happens to the media itself. A European brand can run its own TURN infrastructure while still routing that metadata through a US-incorporated calendar or email sub-processor, or the reverse.

End-to-end encryption changes the calculus specifically for the media (with real E2EE, the relay moves ciphertext and the interesting questions shift to metadata and endpoints), which is why certified E2EE implementations carry weight here. But meeting metadata, participant directories, calendar integrations and server-side recordings remain on the service side under whatever jurisdiction the operator and its processors answer to, independent of how the media itself is protected. The directory therefore records the media relay, the metadata and recording layer, and any AI processing separately, and applies the same evidenced 'exposure: none' bar as everywhere else.

At a glance

Key facts per option, checked against each vendor's own documents.

  • kMeet (Infomaniak)

    hosted in Switzerland, encrypted at rest, no CLOUD Act exposure, free tier available.

    Best for: Free video meetings for Swiss and EU teams, freelancers, and educators who want a no-install, GDPR-clean Swiss alternative to Zoom and Google Meet.

  • sipgate

    hosted in Germany, encrypted at rest, no CLOUD Act exposure.

    Best for: Video meetings for German and Austrian SMBs that want VoIP, video, and SMS from a single founder-owned vendor with German data residency.

  • Threema

    hosted in Switzerland, zero-knowledge end-to-end encryption, no CLOUD Act exposure, from €3/mo.

    Best for: Video calls and messaging for privacy-conscious teams and regulated EU enterprises that want an auditable, Swiss-hosted E2EE platform with no phone number required.

  • Tixeo

    hosted in France, zero-knowledge end-to-end encryption, no CLOUD Act exposure.

    Best for: Secure video meetings for defence, aerospace, and EU public-sector buyers that require CSPN-certified, CLOUD-Act-clean end-to-end encrypted conferencing.

How to choose

Match the tool to the kind of meeting that actually drives the requirement. For security-sensitive meetings (board sessions, legal, public-sector, R&D), what decides the choice is certified end-to-end encryption and a fully controlled media relay, and that is the profile Tixeo is built for; expect more deployment rigidity in exchange. For everyday business calls integrated with telephony, an operator running its own European voice infrastructure (sipgate) keeps the chain clean without changing how the team works. For secure ad-hoc calls inside a messaging context rather than scheduled meetings, a Swiss-hosted E2EE messenger (Threema) covers the need with minimal footprint.

For regulated buyers, read each profile's media-relay and metadata notes, not just the headline hosting region, and treat any AI transcription feature as a separate processor to assess, since that is where a US model API most often re-enters an otherwise clean chain. If a tool you currently use almost clears the bar, its profile records exactly which link fails; that is frequently a feature you can disable. The filters above narrow the list by country, certification or pricing.

SWITCHING GUIDES

Switching from US video conferencing?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

FAQ

Frequently asked questions

Where do US sub-processors usually hide in a video-conferencing stack?
In the parts you don't see on screen: the TURN and media relays that carry audio and video when a direct connection fails, the storage layer for recordings, the transcription or AI-summary feature calling a US-operated model API, and the email or calendar service sending invites. A tool with an EU web front-end can still route the call itself through a US-incorporated relay, which is why we record the media path, not just the application hosting.
What counts as 'no US sub-processors' on this page?
The operating company is EU/EEA/Swiss, has no US parent, and uses no US-incorporated sub-processor in the data path, including media relays and recording storage. That is the directory's 'CLOUD Act exposure: none' bar, verified against each vendor's public sub-processor list and ownership records.
Why are there so few tools on this page?
Because real-time media is infrastructure-heavy. Global relay networks are expensive to build, so many European-branded meeting tools rent them (often from US-incorporated cloud or CDN providers) and AI features add a US model API on top. The result is a category where 'EU tool' and 'no US processors in the chain' overlap less than buyers assume. The short list reflects the data, and it grows as vendors clean their chains.
Is end-to-end encryption enough on its own?
It narrows the exposure substantially (E2EE means relays carry ciphertext) but it does not cover everything: meeting metadata, participant lists, scheduling data and any server-side recordings sit outside the encrypted media stream. Jurisdiction over the operator and its processors is recorded separately for that reason.
Does an EU data-residency option from a US platform clear this bar?
No. Data residency addresses where media and recordings are processed or stored, not which jurisdiction can compel the operator. A US-incorporated platform remains subject to the CLOUD Act regardless of the region selected. That distinction between location and jurisdiction is exactly what each listing's exposure flag captures.
Methodology

How we verified every listing here.

For each product we read the public DPA, sub-processors document, hosting region declaration, certifications, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.

Read methodology →