Aleph Alpha
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Heidelberg-based sovereign-AI lab (Pharia platform); merger with Canadian Cohere announced April 2026: Aleph Alpha shareholders to receive ~10% of combined ~$20B entity.
Aleph Alpha offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
Aleph Alpha (Heidelberg, Germany; founded 2019; offices in Berlin, Bayreuth, Munich) was structured as Germany's flagship sovereign AI vendor with anchor investors Schwarz Group, Bosch Ventures, SAP, and the German Federal Ministry for Economic Affairs. On 24 April 2026 Toronto-based Cohere announced a merger that gives Cohere shareholders ~90% of the combined ~US$20B entity, with Aleph Alpha shareholders receiving ~10%; Schwarz Group is committing US$600M to Cohere's Series E to back the sovereign-AI delivery via STACKIT post-close. Pre-merger Aleph Alpha was structurally eu_owned; the announced merger to a Canada-headquartered AI company with heavy US-VC funding shifts the listing to eu_hq_us_funded with material CLOUD Act exposure, pending re-verification after the merger closes. At the 2026-08-26 re-verify the deal had been announced but had not closed: it remains subject to regulatory conditions, the site carries no Cohere branding, and the imprint names Aleph Alpha GmbH (HRB 732804, Amtsgericht Mannheim, managing directors Reto Spörri and Ilhan Scheer) with no Cohere parent or shareholder. No public DPA or sub-processors list found at audit; certifications unconfirmed.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Aleph Alpha
Aleph Alpha is a Heidelberg-based German sovereign-AI company founded in 2019 to build "specialised LLMs (SLLMs) for European organisations", large language models that operate inside the customer's security perimeter and meet EU regulatory, defence, and public-sector procurement requirements. Co-founders include Samuel Weinbach (Co-Chief Research Officer); offices in Heidelberg (HQ), Berlin, Bayreuth, and Munich. Anchor investors pre-merger include Schwarz Group (Lidl / Kaufland parent, also the operator of STACKIT sovereign cloud), Bosch Ventures, SAP, and the German Federal Ministry for Economic Affairs (BMWi), making Aleph Alpha until April 2026 the most-anchored German-sovereign-AI cap table.
The strategic landscape changed on 24 April 2026, when Toronto-based Cohere announced a merger with Aleph Alpha to form a transatlantic sovereign-AI group valued at approximately US$20B. The deal terms reported by Handelsblatt: Cohere shareholders receive ~90% of the combined entity, Aleph Alpha shareholders ~10% (Cohere's US$7B pre-deal valuation vs Aleph Alpha's US$3B book value); Schwarz Group commits US$600M to Cohere's Series E, the largest single cheque in Cohere's history, to backstop the sovereign-AI offering that will be delivered via STACKIT. The combined company will target regulated sectors (public sector, finance, defence, energy, manufacturing, telecommunications, healthcare) with Aleph Alpha's German anchor relationships intact through STACKIT delivery. The merger is subject to regulatory approval and had still not closed at the 2026-08-26 re-verify: the imprint names Aleph Alpha GmbH (Speyerer Straße 14, Heidelberg; HRB 732804, Amtsgericht Mannheim; managing directors Reto Spörri and Ilhan Scheer) with no Cohere parent or shareholder, and the site carries no Cohere branding.
For the directory's strict-ownership stance the implication is significant: pre-merger Aleph Alpha was eu_owned (German LLC with German + EU anchor investors); on close the entity becomes a subsidiary of Cohere, a Canadian-headquartered AI company with heavy US-VC funding history (Salesforce Ventures, NVIDIA, etc.), and Aleph Alpha shareholders will hold only ~10% of the combined group. The listing is therefore moved to eu_hq_us_funded with material CLOUD Act exposure pending the transaction close. The on-premise Pharia platform that runs inside the customer firewall continues to eliminate CLOUD Act exposure for self-hosting buyers regardless of the parent-entity change, and Schwarz Group's STACKIT partnership ensures continued sovereign-EU-cloud delivery for the on-premise-adjacent hybrid use case. Best fit: regulated DACH buyers, defence and public-sector procurement, and any organisation that wants to deploy LLM inference behind the customer firewall on sovereign infrastructure, but procurement-grade buyers signing multi-year commitments should monitor the merger close before committing to long-term contracts.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Aleph Alpha
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Spain · €12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Black Forest Labs
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
DeepL
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |
| Freepik Spain | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€12/mo |