Brevo
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-headquartered multi-channel customer-engagement platform with email, SMS, CRM, automation, ISO 27001 and a public DPA.
Brevo offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
French SAS with ISO 27001:2022 and a publicly-attached DPA plus sub-processors annex inside the Terms of Use, but cloud workloads run on Google Cloud Platform in Belgium for primary at-rest storage plus Cloudflare and OpenAI sub-processors: EU-headquartered with a public DPA, but material CLOUD Act exposure via US-owned cloud infrastructure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 22 · 12 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Brevo
Brevo (formerly Sendinblue) is a Paris-headquartered customer-engagement platform covering email marketing, transactional email, SMS, marketing automation, a built-in CRM, and chat. Founded in 2012 by Armand Thiberge as Sendinblue and rebranded as Brevo in May 2023, the company operates as a French SAS at 9–17 rue Salneuve, Paris, and reached unicorn status in December 2025 after a €500M round that brought General Atlantic (US) and Oakley Capital (UK) to a combined ~50% stake alongside Bpifrance, Bridgepoint, and management/employees.
Infrastructure is split between EU on-premise data centers in France (primary) and Germany (additional capacity) and Google Cloud Platform with data stored exclusively in Belgium for cloud workloads, meaning customer data at rest sits with a US-owned cloud provider in an EU region. Brevo holds ISO 27001:2022 and publishes its DPA together with the sub-processors annex inside the General Terms of Use; this is a strong transparency signal but does not remove the GCP-borne CLOUD Act exposure or the use of Cloudflare and OpenAI as sub-processors.
Pricing starts at roughly €8/month (Starter, 5,000 emails) with a free tier of 300 emails/day and unlimited contacts; the Brevo footer is shown on free and Starter plans. The affiliate program runs on PartnerStack with US$5 per free account and US$100 per paid account on a 90-day cookie. Best fit: SMBs and mid-market marketers in DACH and France who need a multi-channel platform with credible EU posture and a public DPA, and can accept GCP-EU as the cloud-hosting reality. Procurement teams with strict no-US-cloud requirements should look at rapidmail, Maileon, or Inxmail in this category.
Sub-processor map · 22
-
Anthropic USIreland
AI provider (optional)
-
Cloudflare USUnited States
Content delivery network and WAF
-
Convrrt USUnited States
Customised landing pages (optional)
-
Google Cloud Platform (GCP) USUnited States
Hosting
-
Google Gemini USIreland
AI provider (optional)
-
Integry USUnited States
Integration with third-party software (optional)
-
Omni USUnited States
Dashboards
-
OpenAI USIreland
AI provider (optional)
-
Twilio SMS USUnited States
SMS routing to the NorAm zone (optional)
-
Zendesk USUnited States
Ticketing / support tool
-
Brevo CRM Solution non-USIndia
Customer experience and maintenance (Brevo Group)
-
Brevo GmbH EUGermany
Customer experience and maintenance (Brevo Group)
-
Eldar IT non-USSerbia
Maintenance of the Salesforce plugin (optional)
-
iBasis EULiechtenstein
SMS routing except NorAm zone and France (optional)
-
Langfuse EUGermany
AI provider (optional)
-
OVH EUFrance
Hosting
-
Sendinblue Inc. USUnited States
Customer experience and maintenance (Brevo Group, EU-parented)
-
Sendinblue SAS (Brevo France) EUFrance
Parent company; customer experience and maintenance when contracting with another Brevo entity
-
Sinch non-USUnited Kingdom
SMS routing to Portugal, India, Indonesia, Bahamas (optional)
-
Telnyx EUIreland
SMS routing (optional)
-
Vonage USUnited States
SMS routing (optional)
-
Yodel GmbH EUAustria
Brevo Phone customer experience and maintenance (Brevo Group)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Anthropic | Ireland | AI provider (optional) | US |
| Cloudflare | United States | Content delivery network and WAF | US |
| Convrrt | United States | Customised landing pages (optional) | US |
| Google Cloud Platform (GCP) | United States | Hosting | US |
| Google Gemini | Ireland | AI provider (optional) | US |
| Integry | United States | Integration with third-party software (optional) | US |
| Omni | United States | Dashboards | US |
| OpenAI | Ireland | AI provider (optional) | US |
| Twilio SMS | United States | SMS routing to the NorAm zone (optional) | US |
| Zendesk | United States | Ticketing / support tool | US |
| Brevo CRM Solution | India | Customer experience and maintenance (Brevo Group) | non-US |
| Brevo GmbH | Germany | Customer experience and maintenance (Brevo Group) | EU |
| Eldar IT | Serbia | Maintenance of the Salesforce plugin (optional) | non-US |
| iBasis | Liechtenstein | SMS routing except NorAm zone and France (optional) | EU |
| Langfuse | Germany | AI provider (optional) | EU |
| OVH | France | Hosting | EU |
| Sendinblue Inc. | United States | Customer experience and maintenance (Brevo Group, EU-parented) | US |
| Sendinblue SAS (Brevo France) | France | Parent company; customer experience and maintenance when contracting with another Brevo entity | EU |
| Sinch | United Kingdom | SMS routing to Portugal, India, Indonesia, Bahamas (optional) | non-US |
| Telnyx | Ireland | SMS routing (optional) | EU |
| Vonage | United States | SMS routing (optional) | US |
| Yodel GmbH | Austria | Brevo Phone customer experience and maintenance (Brevo Group) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Brevo
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · €16/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |
GetResponse
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€16/mo |