Capsule CRM
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.
Capsule CRM offers EU hosting in the United States, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CRM.
Assessment notes
Manchester-based UK CRM (Zestia Limited, company 06418281) with a publicly-accessible DPA and sub-processors page and a permanent free tier (2 users, 250 contacts), but customer data is hosted on Amazon Web Services and a separate US entity (Capsulecrm Inc.) is Data Privacy Framework certified for transatlantic transfers: UK post-Brexit jurisdiction, AWS hosting, and a US legal entity contracting with non-EU customers together produce material CLOUD Act exposure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 10 · 10 US
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Capsule CRM
Capsule CRM is a Manchester-headquartered UK customer relationship management product operated by Zestia Limited (Companies House number 06418281, registered office 20 Dale St, Manchester, M1 1EZ). The platform is positioned for SMBs combining contact management, sales pipelines, project management, workflow automation, an AI-powered enrichment toolset, and 100+ integrations across Zapier, Slack, Google, Microsoft, QuickBooks, FreeAgent, Xero, Shopify, Typeform, and LinkedIn. The product reports a 4.7/5 G2 rating across 400+ reviews and is one of the longer-running independent UK CRMs.
Compliance disclosures are unusually transparent for a vendor of this size: the DPA is publicly accessible at /dpa with a sub-processors annex maintained at a dedicated URL, sub-processor changes are notified at least 30 days in advance, the privacy policy was refreshed on 21 August 2025, and a sister legal entity (Capsulecrm, Inc.) carries EU-U.S. Data Privacy Framework certification along with the UK Extension and the Swiss-U.S. DPF for cross-Atlantic transfers. Where the listing weakens for a strict-CLOUD-Act buyer is in two places: (1) all customer data is hosted on Amazon Web Services, a US-owned hyperscaler, with no published commitment to a specific EU region only; (2) the existence of a US legal entity for non-EU customers means part of the customer base contracts with Capsulecrm Inc. directly. Per our strict-ownership stance these together produce material CLOUD Act exposure: UK post-Brexit jurisdiction, AWS hosting with no EU-only region commitment, and a US contracting entity are the three sovereignty gaps.
Pricing is freemium and EU-buyer-friendly: a permanent Free plan covers 2 users, 250 contacts, 1 sales pipeline, and 5 custom fields; paid Starter / Growth / Advanced / Ultimate tiers scale by contact count, automation depth, and number of pipelines/project boards, with up to 15% discount on annual billing and a 14-day no-credit-card trial. Best fit: UK and EU SMBs that want a polished pipeline CRM with a free tier and a public DPA, and can accept a UK post-Brexit jurisdiction plus AWS hosting. Procurement-led EU-only buyers should prefer weclapp (DE, Frankfurt + Karlsruhe DC), Teamleader (BE/Visma), or Salesflare (BE) instead.
Sub-processor map · 10
-
Amazon Web Services, Inc. USUnited States
Hosting (customer data, application logs)
-
APIHub Inc. (Clearbit) USUnited States
Business and contact data enrichment
-
CapsuleCRM Inc. USUnited States
Customer support services
-
Datadog Inc. USUnited States
Log aggregation and performance monitoring
-
Google Inc. USUnited States
Email (support communications and customer emails)
-
Help Scout PBC USUnited States
Support help desk for customer queries (page now writes it "Helpscout PBC (Trello)")
-
OpenAI LLC USUnited States
AI processing (summarization, content generation, insights)
-
Pendo.io Inc. USUnited States
In-app guidance and product analytics
-
SolarWinds Worldwide LLC USUnited States
Log aggregation and performance monitoring
-
Twilio Inc. (SendGrid) USUnited States
Transactional / system emails
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services, Inc. | United States | Hosting (customer data, application logs) | US |
| APIHub Inc. (Clearbit) | United States | Business and contact data enrichment | US |
| CapsuleCRM Inc. | United States | Customer support services | US |
| Datadog Inc. | United States | Log aggregation and performance monitoring | US |
| Google Inc. | United States | Email (support communications and customer emails) | US |
| Help Scout PBC | United States | Support help desk for customer queries (page now writes it "Helpscout PBC (Trello)") | US |
| OpenAI LLC | United States | AI processing (summarization, content generation, insights) | US |
| Pendo.io Inc. | United States | In-app guidance and product analytics | US |
| SolarWinds Worldwide LLC | United States | Log aggregation and performance monitoring | US |
| Twilio Inc. (SendGrid) | United States | Transactional / system emails | US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Capsule CRM
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €24/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
-
SwedenEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
centralstationCRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€24/mo |
combit CRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |
Lime CRM
Sweden
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |