AliasVault
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch sole proprietorship (XIVISOFT / Leendert de Borst), open-source password manager with built-in receive-only email aliases; email aliases cannot send or reply, only receive. Free cloud tier hosted in Germany, AGPL-3.0 and fully self-hostable.
AliasVault is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Email aliasing.
Assessment notes
AliasVault is a product of XIVISOFT, a Dutch sole proprietorship (eenmanszaak) operated by founder Leendert de Borst, KVK 51592193 (vendor-stated, not independently cross-checked against the Dutch register); the registered address is stated only as "available upon request". The official cloud offering runs on the operator's own servers in Germany, within the EU, and the AGPL-3.0 source is fully self-hostable via Docker. No third-party trackers or US sub-processors are named in the Privacy Policy (a self-hosted Plausible.io instance is the only named service, run on AliasVault's own servers), so CLOUD Act exposure is assessed as none. The determining factor holding compliance_score at 3/5 despite the clean eu_owned and hosting profile is that no DPA and no sub-processors list are published, which this directory's rubric caps at 3/5 regardless of an otherwise clean sovereignty profile; AliasVault is also a young (2024-founded), single-founder operation without a formal customer-facing data-processing contract yet.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About AliasVault
AliasVault is a product of XIVISOFT, a Dutch sole proprietorship (eenmanszaak) operated by founder Leendert de Borst, KVK (Dutch Chamber of Commerce) number 51592193; the registered address is stated as "available upon request" rather than published, and no VAT number is stated. It combines a zero-knowledge password manager with built-in email-alias generation: every saved identity gets its own alias inbox inside the app. The official cloud offering (app.aliasvault.com) runs on the operator's own servers in Germany, within the EU; the Privacy Policy states this is "fully compliant with GDPR". The single most important buying fact is a structural limitation stated on AliasVault's own homepage: "Email aliases are receive-only, meaning you cannot send or reply to emails from your aliases", with a 10MB size limit on incoming mail. The core product is free and the vendor states it "will always remain that way"; Premium and Family tiers (higher limits, VIP alias domains, custom domains, automatic backups) are announced but not yet live as of this review. The client and server are open source under AGPL-3.0 (github.com/aliasvault/aliasvault, most recent release 0.30.0 on 2026-07-02) and fully self-hostable via Docker, which is also the only way to get a custom domain today, since none is available on the free cloud tier. No DPA or sub-processors list is published; the only named third party in the Privacy Policy is a self-hosted instance of Plausible.io analytics, run on AliasVault's own servers rather than Plausible's own hosted service.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of AliasVault
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €3.50/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0.87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
Cyprus · €2.99/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
SimpleLogin
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€3.50/mo |
addy.io
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
€0.87/mo |
AdGuard Mail
Cyprus
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.99/mo |