CleverReach
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German email marketing platform with EU-only customer data storage in Germany and Ireland and a permanently free Lite tier.
CleverReach offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
German GmbH & Co. KG with 'Email Marketing Made in Germany' positioning and a CSA Trust Seal, but core recipient/subscriber data is processed and stored on Amazon Web Services (a US-owned hyperscaler) in EU regions (Ireland/Germany). So although the primary server location is German, customer mailing-list data at rest sits with a US-owned provider whose US parent is compellable regardless of EU region, giving material CLOUD Act exposure (SCC + Data Privacy Framework apply to the transfer).
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About CleverReach
CleverReach is a Rastede-based German email marketing platform operating as CleverReach GmbH & Co. KG, founded in 2007. The company positions itself explicitly as "Email Marketing Made in Germany" and stores all customer subscriber data and email content exclusively on infrastructure within Germany and broader EU jurisdictions. With more than 400,000 customers worldwide, CleverReach is one of the largest German-owned ESPs and a strong DACH-focused alternative to Mailchimp and Constant Contact for buyers who want a German counter-party with no US legal entity in the contracting chain.
The trust posture is solid on paperwork: the DPA is an open PDF with no login, the privacy policy lists the EU-US Data Privacy Framework and Standard Contractual Clauses for any cross-Atlantic transfers, and the company is a member of the Certified Senders Alliance with the CSA Trust Seal. Note that the ISO 27001 and PCI-DSS Level 1 certificates cited on the data-security page belong to CleverReach's data-centre providers rather than to CleverReach itself. The privacy policy also discloses US-owned tools scoped to the marketing site, advertising and support, Google (Analytics/Ads/Meet/YouTube), Meta (Facebook/Instagram), Zendesk, Microsoft Ads, SurveyMonkey, Taboola, Reddit and LogMeIn, plus Snowflake Inc. (US, running on AWS European servers) for account-holder data evaluation. What sets the exposure tier sits deeper than any of those: Annex 2 of the DPA names Amazon Web Services, Inc. for data storage, processing and email dispatch in Ireland and Germany, alongside PlusServer GmbH and Hetzner Online GmbH, so subscriber data at rest is held by a US-owned hyperscaler even though the regions are European: Material.
Pricing is a clear strength for SMBs: a permanently free Lite tier covers 250 recipients and 1,000 emails/month; the Basic plan starts at €15/month for up to 5,000 recipients with paid plans climbing to a €499/month Enterprise tier. The product UI is available in six languages (DE, EN, ES, FR, IT, NL), making CleverReach unusually well-localized for a German vendor. Best fit: DACH-region SMBs and mid-market teams who need a German counter-party and German-law contracting, simple pricing, and broad language support, and don't require advanced SSO or audit-log features.
Sub-processor map · 3
-
Amazon Web Services, Inc. USUnited States
Data storage and processing, e-mail dispatch (processing in Ireland and Germany)
-
Hetzner Online GmbH EUGermany
E-mail dispatch
-
PlusServer GmbH EUGermany
E-mail dispatch
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services, Inc. | United States | Data storage and processing, e-mail dispatch (processing in Ireland and Germany) | US |
| Hetzner Online GmbH | Germany | E-mail dispatch | EU |
| PlusServer GmbH | Germany | E-mail dispatch | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of CleverReach
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · €16/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |
GetResponse
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€16/mo |