Skip to content
EU VETTED

Aiven

Aiven Oy (Aiven Ltd), Business ID 2795743-5, Antinkatu 1, 00100 Helsinki, Finland

Cloud & hosting · Finland
Founded 2016 · aiven.io

Finnish managed open-source data platform (PostgreSQL, Kafka, OpenSearch, ClickHouse, Valkey) on the cloud you choose; EU-owned, but the management plane runs on Google Cloud and most cloud options are US hyperscalers.

Aiven offers EU hosting in Belgium, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Cloud & hosting.

Assessment notes

Aiven Oy (Helsinki; Business ID 2795743-5) runs managed open-source data services (PostgreSQL, Apache Kafka, OpenSearch, ClickHouse, MySQL, Valkey and others) on the cloud the customer picks. Ownership is recorded as EU-owned on control evidence: a Finnish company with no parent, run by its co-founder CEO, whose two largest rounds were led by European funds (Atomico, Eurazeo), although US investors (IVP, which holds a board seat, plus Salesforce Ventures, BlackRock and World Innovation Lab) hold a meaningful minority. The CLOUD Act rating is Material on Aiven's own published sub-processor list: four of the six self-service clouds (AWS, Google Cloud, Azure, DigitalOcean) are US-owned and hold customer data at rest when chosen, the management plane (console, API, system-of-record database, central logging, monitoring) runs on Google Cloud in Belgium with DNS, disaster recovery and audit-log storage on AWS in Sweden, and the key management system runs on Aiven-controlled VMs in Google Cloud. Choosing UpCloud, OVHcloud or Exoscale keeps the databases on a European provider but not the management plane or the keys. DPA and sub-processor list are public and ISO/IEC 27001:2022 is verified from the certificate; with that many US-owned providers in the chain the score is 3/5.

Findings

CLOUD Act
Ownership
Sub-processors
15 · 10 US

Verified signals

Jurisdiction
  • EU / adequacy hosting: Yes
  • EU / adequacy operator: Yes
  • No US CLOUD Act exposure: No
Transparency
  • Public DPA: Yes
  • Sub-processors disclosed: Yes
  • Open-source clients: No
  • Third-party certification: Yes
Jump to

About Aiven

Aiven is the managed data platform of Aiven Oy (Aiven Ltd, Antinkatu 1, 00100 Helsinki; Business ID 2795743-5, registered in November 2016), founded by Oskari Saarenmaa, who is still CEO, with co-founder Heikki Nousiainen as CISO. It runs open-source engines as managed services: PostgreSQL, Apache Kafka, OpenSearch, ClickHouse, MySQL, Valkey, Grafana and others. The customer picks a cloud and region when creating a service, from AWS, Google Cloud, Microsoft Azure, DigitalOcean, UpCloud and OVHcloud (more than 100 regions in total); Aiven's sub-processor list also names Oracle and Exoscale as infrastructure providers, and Bring Your Own Cloud places services inside the customer's own AWS, Google Cloud, Azure or OCI account. Billing is hourly. A free plan with no time limit exists for PostgreSQL, MySQL, OpenSearch, Kafka and Valkey, and the paid Developer tier starts at $5 per month, but on both of those the cloud and region are chosen by Aiven, not by the customer; the cheapest PostgreSQL plan with a choice of cloud (Hobbyist) starts at 12 USD per month. A Terraform provider, a CLI and a public API cover the platform.

Ownership is European on control evidence rather than on funding headlines. Aiven has raised about 420 million USD: a Series A led by Earlybird (DE), a Series B led by the US firm IVP, a 100 million USD Series C led by Atomico (UK), a 60 million USD extension co-led by IVP and World Innovation Lab (US and Japan), and a 210 million USD Series D led by Eurazeo (FR) with BlackRock, Salesforce Ventures and the earlier investors. US investors hold a meaningful minority and an IVP partner sits on the board alongside Earlybird's co-founder, but no investor is known to control the company, there is no parent above Aiven Oy, and the co-founders still run it. Aiven Inc. in Delaware is a subsidiary, listed by Aiven as an affiliate whose support staff process service metadata. The certificates were read from the published PDFs: ISO/IEC 27001:2022 (KPMG IT Certification, certificate FI240523-151, first issued May 2018, valid to 23 May 2027) and ISO/IEC 27701:2019 (FI240523-152), both issued to Aiven Oy. Aiven's security page also presents ISO/IEC 27017 and 27018 as certificates, but the certificate it links states that those two standards are used only as a source of controls, as non-accredited standards, so they are not recorded here. The SOC 2-style assurance is an ISAE 3000 Type 2 report from KPMG.

The CLOUD Act rating is Material, and it follows from Aiven's own documents rather than from its investors. Four of the six self-service clouds are US-owned, so in the common case customer data at rest sits with a US hyperscaler. The fixed part of the stack is US-hosted too: the management plane (console, API, backup management, system-of-record database, central logging and monitoring) runs on Google Cloud in Belgium, DNS, disaster recovery and long-term audit logs on AWS in Sweden, and the key management system, which Aiven cites as the reason the clouds have no logical access to customer data, runs on Aiven-controlled VMs in Google Cloud data centres. The console and API are also served through Cloudflare, which does not appear on the sub-processor list. Choosing UpCloud (FI) or OVHcloud (FR) keeps the databases on a European provider, and the DPA commits to keeping personal data in the EEA when an EEA region is chosen, but for UpCloud the list states that backups go to the nearest region of another provider, which it does not name. In short: a European vendor with a public DPA and a detailed sub-processor list, but no configuration in which the whole chain stays off US-owned infrastructure.

Sub-processor map · 15

Source
  • Amazon Web Services (back-end) US
    Sweden

    Back-end: DNS, disaster recovery, backup and long-term storage of audit logs in eu-north-1. Engaged for every customer.

  • Amazon Web Services EMEA SARL (infrastructure) US
    Luxembourg

    Customer-selected infrastructure: hosts the managed services and their backups in the region the customer chooses.

  • Cloudflare, Inc. US
    United States

    Observed, not on Aiven's list: reverse proxy and TLS termination in front of aiven.io, console.aiven.io and api.aiven.io. Source: DNS and HTTP headers, 2026-10-02.

  • DigitalOcean LLC US
    United States

    Customer-selected infrastructure for the managed services. No object storage, so backups go to the nearest region of another provider, which Aiven does not name.

  • Google Cloud EMEA Limited (AI features) US
    Belgium

    Service-specific: processes prompts, data and content for the PostgreSQL AI editor and Aiven Managed Agents, only when those features are used.

  • Google Cloud EMEA Limited (infrastructure) US
    Ireland

    Customer-selected infrastructure: hosts the managed services and their backups in the region the customer chooses.

  • Google Cloud EMEA Limited (management plane) US
    Belgium

    Back-end: Aiven console, API, backup management, system-of-record database, central logging and monitoring in europe-west1, plus the VMs running Aiven's own key management system. Engaged for every customer.

  • Microsoft Ireland Operations Limited (Azure) US
    Ireland

    Customer-selected infrastructure: hosts the managed services and their backups in the region the customer chooses.

  • Oracle Finland Oy US
    Finland

    Customer-selected infrastructure (Oracle Cloud) for the managed services and their backups. Not on the public cloud list; BYOC on request.

  • Aiven EEA affiliates EU
    Finland

    Affiliates in France, Germany, Ireland, Italy, Portugal, Sweden, the Netherlands and Spain: support staff process service metadata only.

  • Aiven Inc. US
    United States

    Affiliate (Delaware subsidiary of Aiven Oy): support staff process service metadata; customer data only if separately agreed with the customer.

  • Aiven UK, Canada, Australia and New Zealand affiliates non-US
    United Kingdom

    Affiliates outside the EEA (Aiven UK Ltd, Aiven Canada Ltd, Aiven Australia Pty Ltd, Aiven New Zealand Ltd): support staff process service metadata only.

  • Akenes SA (Exoscale) EU
    Switzerland

    Infrastructure for the managed services and their backups; not on Aiven's public cloud list, used for the managed databases Exoscale sells.

  • OVH SAS EU
    France

    Customer-selected infrastructure for the managed services and their backups.

  • UpCloud Oy EU
    Finland

    Customer-selected infrastructure for the managed services. No object storage used, so backups go to the nearest region of another provider, which Aiven does not name.

Source: the vendor’s published sub-processor list, read 2 Oct 2026.

10 of 15 sub-processors are US-owned or US-based. CLOUD Act exposure applies.

Frameworks & certifications

ISO/IEC 27001
Active
ISO/IEC 27701
Active

Capability matrix

Table 2Capabilities of Aiven

Dedicated / bare-metal No
Object storage (S3) No
Managed Kubernetes No
Managed databases Yes
GPU instances No
Hourly billing Yes
API / Terraform Yes
Countries 100 countries

Integration & access

REST API Yes
SSO (SAML / OIDC) Yes

Compliance & governance

Audit log Yes
Self-host / on-prem option No

Pricing & tiers

from $5/mo
Freemium
View pricing page

Public documents

  • Data Processing Addendum (DPA)
    aiven.io/dpa…
    Open
  • Sub-processors list
    aiven.io/subprocessors…
    Open
  • Terms of Service
    aiven.io/terms…
    Open

Alternatives in this category

  • Aruba Cloud
    Italy · €1.99/mo
    EU-Sovereign
    Public DPA: Yes Sub-processors: No Open source: No
  • Cleura
    Sweden
    EU-Sovereign
    Public DPA: Yes Sub-processors: Yes Open source: No
  • Clever Cloud
    France · €4.80/mo
    EU-Sovereign
    Public DPA: Yes Sub-processors: Yes Open source: No
See all cloud & hosting alternatives

Featured in these guides