addy.io
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
England-and-Wales-governed email-alias service (formerly AnonAddy), hosted in the Netherlands; unlimited aliases, PGP-encrypted forwarding and reply-from-alias on paid tiers, open-source and self-hostable. Its operating legal entity is not named in its own Terms or Privacy Policy.
addy.io is a European service hosted in the Netherlands, with at most minor, transient US exposure under the CLOUD Act. It is listed under Email aliasing.
Assessment notes
addy.io's own Terms of Use state governing law as "the law of England and Wales", but neither the Terms nor the Privacy Policy name an operating legal entity, company number, or registered address anywhere on the site. Public sources disagree on who actually operates the service (a comparison repository says "Netherlands", other web results say "Addy Pty Ltd" in Geelong, Australia), and neither claim is corroborated by any addy.io primary source, so country_iso is left null and ownership_signal is other. Mailbox/alias data at rest sits on servers in the Netherlands (UpCloud); Stripe and NOWPayments handle payments, Amazon SES sends the newsletter, and Cloudflare Turnstile is a login captcha, none of which are the primary data-at-rest path, so CLOUD Act exposure is assessed as minor rather than material. The determining factor for compliance_score is that no DPA is published anywhere on the site, which caps this listing at 3/5 regardless of the otherwise reasonable EU hosting posture.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 5 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Card-free payment available: YesAccepts cryptocurrency (Bitcoin, Monero, Ethereum and others) via NOWPayments on yearly plans, alongside cards.
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About addy.io
addy.io (renamed from AnonAddy in 2024) was created in 2019 by developer Will Browning and offers open-source email aliasing under AGPL-3.0, self-hostable via Docker (github.com/anonaddy/anonaddy) or usable as a hosted service. Neither the Terms of Use nor the Privacy Policy on addy.io names an operating legal entity, company number, or registered address; the Terms state only that they "shall be governed by and construed in accordance with the law of England and Wales". Public sources disagree on who operates the service: a public comparison repository lists the jurisdiction as "Netherlands", while other web results describe the operator as "Addy Pty Ltd" in Geelong, Australia; neither claim is corroborated by any addy.io primary source, so this listing records the legal entity and country_iso as not established. The Privacy Policy states servers are located in the Netherlands (UpCloud); named third parties are Stripe and NOWPayments for payments, Amazon SES for newsletter delivery, and Cloudflare Turnstile for captcha. Free, Lite ($1/month billed yearly) and Pro ($3/month billed annually, or $4/month billed monthly) tiers scale from 10 to unlimited aliases; Lite and Pro add custom domains, catch-all (enabled by default on custom domains), PGP-encrypted forwarding (bring-your-own GPG/OpenPGP key), and reply-from-alias, the last of which is deliberately withheld from the Free plan to curb spam and abuse. addy.io passed an independent security audit by Securitum in September 2023 with no significant vulnerabilities found, though this is a one-off audit rather than a recurring certification.
Sub-processor map · 5
-
Amazon Simple Email Service (SES) USUnited States
Newsletter delivery
-
Cloudflare Turnstile USUnited States
Captcha / bot protection on login and registration
-
Stripe USUnited States
Card payment processing
-
NOWPayments EUNetherlands
Cryptocurrency payment processing (yearly plans)
-
UpCloud EUFinland
Hosting of alias and forwarded-email data at rest (servers located in the Netherlands)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Simple Email Service (SES) | United States | Newsletter delivery | US |
| Cloudflare Turnstile | United States | Captcha / bot protection on login and registration | US |
| Stripe | United States | Card payment processing | US |
| NOWPayments | Netherlands | Cryptocurrency payment processing (yearly plans) | EU |
| UpCloud | Finland | Hosting of alias and forwarded-email data at rest (servers located in the Netherlands) | EU |
Source: the vendor’s published sub-processor list, read 10 Jul 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of addy.io
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €3.50/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Cyprus · €2.99/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
NetherlandsEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
SimpleLogin
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€3.50/mo |
AdGuard Mail
Cyprus
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.99/mo |
AliasVault
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |