Aiven is the managed data platform of Aiven Oy (Aiven Ltd, Antinkatu 1, 00100 Helsinki; Business ID 2795743-5, registered in November 2016), founded by Oskari Saarenmaa, who is still CEO, with co-founder Heikki Nousiainen as CISO. It runs open-source engines as managed services: PostgreSQL, Apache Kafka, OpenSearch, ClickHouse, MySQL, Valkey, Grafana and others. The customer picks a cloud and region when creating a service, from AWS, Google Cloud, Microsoft Azure, DigitalOcean, UpCloud and OVHcloud (more than 100 regions in total); Aiven's sub-processor list also names Oracle and Exoscale as infrastructure providers, and Bring Your Own Cloud places services inside the customer's own AWS, Google Cloud, Azure or OCI account. Billing is hourly. A free plan with no time limit exists for PostgreSQL, MySQL, OpenSearch, Kafka and Valkey, and the paid Developer tier starts at $5 per month, but on both of those the cloud and region are chosen by Aiven, not by the customer; the cheapest PostgreSQL plan with a choice of cloud (Hobbyist) starts at 12 USD per month. A Terraform provider, a CLI and a public API cover the platform.
Ownership is European on control evidence rather than on funding headlines. Aiven has raised about 420 million USD: a Series A led by Earlybird (DE), a Series B led by the US firm IVP, a 100 million USD Series C led by Atomico (UK), a 60 million USD extension co-led by IVP and World Innovation Lab (US and Japan), and a 210 million USD Series D led by Eurazeo (FR) with BlackRock, Salesforce Ventures and the earlier investors. US investors hold a meaningful minority and an IVP partner sits on the board alongside Earlybird's co-founder, but no investor is known to control the company, there is no parent above Aiven Oy, and the co-founders still run it. Aiven Inc. in Delaware is a subsidiary, listed by Aiven as an affiliate whose support staff process service metadata. The certificates were read from the published PDFs: ISO/IEC 27001:2022 (KPMG IT Certification, certificate FI240523-151, first issued May 2018, valid to 23 May 2027) and ISO/IEC 27701:2019 (FI240523-152), both issued to Aiven Oy. Aiven's security page also presents ISO/IEC 27017 and 27018 as certificates, but the certificate it links states that those two standards are used only as a source of controls, as non-accredited standards, so they are not recorded here. The SOC 2-style assurance is an ISAE 3000 Type 2 report from KPMG.
The CLOUD Act rating is Material, and it follows from Aiven's own documents rather than from its investors. Four of the six self-service clouds are US-owned, so in the common case customer data at rest sits with a US hyperscaler. The fixed part of the stack is US-hosted too: the management plane (console, API, backup management, system-of-record database, central logging and monitoring) runs on Google Cloud in Belgium, DNS, disaster recovery and long-term audit logs on AWS in Sweden, and the key management system, which Aiven cites as the reason the clouds have no logical access to customer data, runs on Aiven-controlled VMs in Google Cloud data centres. The console and API are also served through Cloudflare, which does not appear on the sub-processor list. Choosing UpCloud (FI) or OVHcloud (FR) keeps the databases on a European provider, and the DPA commits to keeping personal data in the EEA when an EEA region is chosen, but for UpCloud the list states that backups go to the nearest region of another provider, which it does not name. In short: a European vendor with a public DPA and a detailed sub-processor list, but no configuration in which the whole chain stays off US-owned infrastructure.