chatlyn
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Vienna-based Austrian hospitality AI communications hub (founded 2022); 1,000+ properties, omnichannel inbox + WhatsApp; €8M Series A from Smedvig (NO).
chatlyn offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Helpdesk.
Assessment notes
chatlyn is a Vienna-headquartered Austrian AI communication hub for hospitality, founded late 2022 by Nicolas Vorsteher (CEO), Michael Urbanek (CTO), and Matthias Haubner (CPO); €8M Series A in June 2025 led by Smedvig Ventures (Norwegian) with Austrian angels (Blaguss, AnyDesk''s Andreas Burike, Helsing-related Mathias Hiebeler). Clean Nordic/Austrian cap table with no US-VC presence. Already serving 1,000+ hotel properties across 30 countries including St. Regis Mauritius, Singer Palace Rome, and InterContinental. EU-owned with a clean Nordic/Austrian investor structure. The documentation gaps flagged in May have since been closed: chatlyn now publishes a security and compliance page naming its hosting and its sub-processors, and links a public Google Drive folder holding the Art. 28 DPA, the privacy policy and the T&Cs. What that disclosure reveals is a US-parented core: guest conversations sit at rest on AWS in Frankfurt and MongoDB in Frankfurt, and the AI layer routes to OpenAI, LLC in the United States under Standard Contractual Clauses, with Zapier (US) on the integration path. EU regions throughout, but three US-owned processors with data access, so CLOUD Act exposure is material and the score stays capped at 3. The WhatsApp channel runs through 360dialog GmbH (Germany) and outbound SMS through Vonage B.V. (Netherlands).
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 6 · 4 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About chatlyn
chatlyn is a Vienna-based Austrian AI communication hub built specifically for the hospitality vertical: hotels, hotel groups, and short-term-rental operators. Founded in late 2022 by Nicolas Vorsteher (CEO), Michael Urbanek (CTO), and Matthias Haubner (CPO), the platform unifies guest communications across email, WhatsApp, SMS, webchat, and social channels with intelligent automation, real-time translation in 35+ languages, and PMS (property-management-system) integration. The company has scaled rapidly to 1,000+ hotel properties across 30 countries (customer references include St. Regis Mauritius, Singer Palace Rome, and InterContinental properties), establishing chatlyn as the European-rooted hospitality-AI brand of choice in 2025-2026.
For an EU-sovereignty audit the ownership architecture is unusually clean for an AI-vertical SaaS. The €8M Series A in June 2025 was led by Smedvig Ventures, a Norwegian growth-equity firm. This means the lead investor is Nordic, not US-VC, which is structurally different from most AI-adjacent funding rounds in 2025-2026. Other Series A participants are Austrian and European: business angels include Andreas Burike (AnyDesk), Mathias Hiebeler (former owner of Grob Aircraft, recently acquired by German defence-tech Helsing), Austrian transport leader Blaguss, and strategic hospitality angels. No US-VC name appears on the cap table, keeping chatlyn firmly in the eu_owned ownership tier.
Pricing is enterprise and hospitality-vertical sales-engaged: one platform fee per property based on room count, PMS, implementation scope and contract term, plus a one-time setup fee and pass-through WhatsApp and SMS usage, with no published figures and no free plan. The documentation gaps flagged earlier have closed: chatlyn now publishes a security and compliance page naming its hosting and its sub-processors, plus a public no-login folder holding the Art. 28 DPA, the privacy policy and the T&Cs. What that disclosure reveals is a US-parented core: guest conversations sit at rest on AWS in Frankfurt and MongoDB in Frankfurt, and the AI layer routes to OpenAI, LLC in the United States under Standard Contractual Clauses, with Zapier (US) on the integration path; the WhatsApp channel runs through 360dialog GmbH (Germany) and outbound SMS through Vonage B.V. (Netherlands). Conversational AI is included in the platform fee rather than sold as a switchable add-on, so an EU buyer cannot decline it. Best fit: European hotel groups and hospitality businesses needing AI-driven guest communication with WhatsApp + email + SMS unification, multi-property operators with PMS integration needs, hospitality-tech procurement teams who specifically want an Austrian-rooted alternative to Intercom / Zendesk / Freshdesk.
Sub-processor map · 6
-
Amazon Web Services EMEA SARL USGermany
Platform hosting, Frankfurt, Germany (data at rest; US-parented provider)
-
MongoDB Deutsche GmbH USGermany
Database hosting, Frankfurt, Germany (data at rest; US-parented provider)
-
OpenAI, LLC USUnited States
AI-powered functionality; outside the EU under Standard Contractual Clauses. Included in the platform fee, not an opt-in add-on
-
Zapier, Inc. USUnited States
Third-party system integration; outside the EU under Standard Contractual Clauses
-
360dialog GmbH EUGermany
WhatsApp Business Solution Provider
-
Vonage B.V. EUNetherlands
Outbound SMS (fallback channel)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Germany | Platform hosting, Frankfurt, Germany (data at rest; US-parented provider) | US |
| MongoDB Deutsche GmbH | Germany | Database hosting, Frankfurt, Germany (data at rest; US-parented provider) | US |
| OpenAI, LLC | United States | AI-powered functionality; outside the EU under Standard Contractual Clauses. Included in the platform fee, not an opt-in add-on | US |
| Zapier, Inc. | United States | Third-party system integration; outside the EU under Standard Contractual Clauses | US |
| 360dialog GmbH | Germany | WhatsApp Business Solution Provider | EU |
| Vonage B.V. | Netherlands | Outbound SMS (fallback channel) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of chatlyn
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · $45/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · $19/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Crisp
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$45/mo |
Userlike (Lime Connect)
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€87/mo |
LiveChat (Text)
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$19/mo |