Alma
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-area French BNPL for merchants: 2/3/4/10/12 installments + Pay Later; 21,800+ merchants across 8 EU countries; Alma SAS, EU-owned.
Alma offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Payments.
Assessment notes
Alma SAS (Neuilly-sur-Seine, France; RCS Nanterre 839 100 575) is an EU-incorporated French BNPL specialist serving 21,800+ merchants across 8 European countries (ownership_signal: eu_owned), but the legal notice confirms hosting on Google Cloud Platform (US-owned, Paris region): cloud_act_exposure: material; no public DPA or sub-processors list accessible at audit.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Alma
Alma is a French BNPL (buy-now-pay-later) payment solution operated by Alma SAS (176 Avenue Charles de Gaulle, 92200 Neuilly-sur-Seine, France; RCS Nanterre 839 100 575), founded in 2019 by Louis Chatriot. The product enables merchants to offer customers payment in 2, 3, or 4 interest-free installments, medium-term financing in 10 or 12 installments, and deferred "Pay Later" options at 15 or 30 days, covering online, in-store (via payment terminal integrations including Adyen and Ingenico), and call-centre sales channels. As of 2026 Alma serves 21,800+ merchants across France, Germany, Belgium, Spain, Italy, Luxembourg, the Netherlands, and Portugal, with a notable customer list including Maisons du Monde, Nature & Découvertes, Maje, Promod, Etam, Lancel, and Alain Afflelou.
For an EU-sovereignty audit Alma is the cleanest French corporate in the BNPL category, incorporated as a French SAS with a French registered address and no disclosed US parent or US-PE majority stake. The ownership-risk element is the investor base: the company raised €210M in 2022 (round led by Eurazeo Growth and Cathay Innovation, both French/Franco-Asian with EU-anchored management, alongside earlier backers including Idinvest Partners). The cap table is predominantly French/European VC, which keeps ownership_signal: eu_owned under the directory's taxonomy. The material CLOUD Act risk comes from infrastructure: the legal notice explicitly names Google Cloud Platform as the hosting provider (8 rue de Londres, 75009 Paris, the Paris GCP region address), and GCP is a US-owned service regardless of the EU region. No public DPA or sub-processors list was found on accessible pages at audit.
Pricing is commission-based per transaction with no application, setup or monthly fee, and the rates are published: 3.60% excluding VAT on payment in 2x, 3x or 4x and 4.20% excluding VAT on Pay Later at 15 or 30 days, each with an optional split of the fee between merchant and customer; the 10x and 12x financing tiers are waiting-list only with no published rate, and rates may be raised for identified risk, American Express or business cards. PCI DSS Level 1 certification is confirmed for the payment-processing partner. Best fit: French and broader EU merchants wanting a BNPL-first checkout experience with a European legal entity: particularly retail, furniture, fashion, and opticians already represented in the customer base.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Alma
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicealmapay.com/legal…
Alternatives in this category
-
NetherlandsEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
NorwayEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Adyen
Netherlands
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Dintero
Norway
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
GoCardless
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
— |