Baserow
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch open-source no-code database (Baserow B.V., Amsterdam, KvK 81129254, 2020), MIT-licensed, self-hostable, SOC 2 + HIPAA, Airtable replacement.
Baserow is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Project management.
Assessment notes
Baserow B.V. (Keurenplein 4, Amsterdam, Netherlands; KvK 81129254; incorporated 2020) is an MIT-licensed open-source no-code database under Dutch law with SOC 2 Type II and HIPAA attestations, self-hosted deployment as the primary sovereignty path, and a managed cloud tier with GDPR compliance. EU-owned, open-source, with the self-hosted path giving the customer full data control; main gap: the DPA is referenced in the ToS but not linked publicly and no self-serve document exists at any /trust, /security or /legal/dpa path, so a small EU buyer cannot obtain one without contacting the vendor. Managed-cloud data residency is at least now published: Baserow states all customer data is stored exclusively in Germany, though the underlying hosting provider is still not named.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Baserow
Baserow is the open-source no-code database and application builder operated by Baserow B.V. (Keurenplein 4, Amsterdam, Netherlands; Chamber of Commerce 81129254), incorporated in 2020 and entirely governed by Dutch law with Amsterdam jurisdiction. The product is released under the MIT Expat licence with the full source code on GitHub (4.8k+ stars), positioning it as the open-source, EU-rooted alternative to Airtable for teams that want data portability and full control. Feature set: multi-type relational tables, grid/Kanban/calendar/gallery/survey views, workflow automations, a visual application builder, role-based permissions, audit logs, and API-first architecture with integrations across Jira, GitLab, GitHub, Zapier, Make, and n8n. The team of approximately 17 people is fully remote across the Netherlands, Germany, France, Belgium, Ireland, Austria, and other EU countries.
Baserow is available in two deployment modes. Self-hosted on any EU infrastructure (Docker, Helm, Cloudron, or bare Hetzner/OVH server) makes the customer the sole data controller with no US-owned cloud in the picture. The managed cloud at baserow.io is the alternative for teams that prefer a hosted service; the cloud tier carries SOC 2 Type II and HIPAA attestations, commits to GDPR compliance, and the vendor's April 2026 data-residency post states that all customer data is stored exclusively in Germany. The underlying hosting provider is still not publicly named and the security docs refer to S3 buckets without saying whose, which holds the CLOUD Act flag at Minor pending vendor disclosure.
Pricing is published in USD only, with no EUR list price: the Free cloud tier covers 3,000 rows and 2 GB storage, permanent and without a credit card; Premium $10/user/month on annual billing ($12 billed monthly) covers 50,000 rows, Kanban and calendar views, and XML/JSON/Excel export; Advanced $18/user/month on annual billing ($22 billed monthly) adds 250,000 rows, role-based permissions, and audit logs. Self-hosted community edition is free; enterprise self-hosted licences available. Best fit: EU engineering teams, non-profits, and data-driven SMBs that want an open Airtable alternative with self-host optionality and Dutch/EU legal grounding.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Baserow
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicebaserow.io/terms-and-conditions…
Alternatives in this category
-
Germany · €19.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Germany · €99/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Denmark · $29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
factro
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€19.99/mo |
HansaChat
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€99/mo |
Hourtick
Denmark
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$29/mo |