Conta
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian free-invoicing-first accounting SaaS (founded 2009); 165K+ users, Norwegian-owned (founders + Must Invest), but runs entirely on AWS.
Conta offers EU hosting in Ireland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Accounting.
Assessment notes
Conta (Conta AS, org 998 807 867; parent Conta Group AS, org 816 909 252; Stavanger/Ålesund/Oslo, Norway, founded 2009) is a genuinely Norwegian-owned free-invoicing-led accounting SaaS: founders plus Must Invest AS (Erik Must, Norwegian family investor since 2020); no US PE/VC, ownership signal other (Norway = EEA, not EU). Its public DPA and sub-processor list are a transparency plus. BUT the entire data substrate runs on Amazon AWS (EC2, S3, RDS, DynamoDB, Lambda), US-owned, alongside SendGrid, Cloudmailin, New Relic, Sentry, Google (Analytics/Ads/Firebase), Performission, Autopilot, Facebook, LinkedIn. Conta states all infrastructure/data sits within EU/EEA, but AWS as host plus 10+ US sub-processors means CLOUD Act exposure is material and the score caps at 3; only the Norwegian Jottacloud holds the backup copy.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Conta
Conta started in 2009 as a free invoicing program built by three founders (a journalist, a developer and an accountant) frustrated with how hard it was to run a small business in Norway. It is operated by Conta AS (org 998 807 867) under parent Conta Group AS (org 816 909 252, a ~13-company group), headquartered in Stavanger with offices in Ålesund, Oslo and a development office in Brazil, plus remote developers worldwide (~67 employees). The hook is genuinely free, unlimited invoicing (Premium ~$10.49/mo billed annually unlocks reminders, recurring invoices, branding removal); optional paid add-ons cover bookkeeping, VAT/MVA filing via Altinn, bank sync (ZTL), payroll and EHF e-invoicing. 165,000–260,000 business users across ~10 countries (NO, ES, IE, AU, NZ, IN, ID, PH, ZA, US). Ownership is clean and local, founders plus Must Invest AS (Erik Must) since 2020, with no US venture or private-equity capital, and Conta Group also co-owns Norwegian email-marketing tool Mailmojo. The catch for sovereignty buyers is the substrate: customer invoices, files and databases live on Amazon AWS (EC2/S3/RDS/DynamoDB/Lambda), with SendGrid, Google, Sentry, New Relic and Meta/LinkedIn trackers in the stack. Conta keeps everything inside EU/EEA regions and mirrors a backup to Norwegian Jottacloud, but the host and a long tail of sub-processors are US-owned, so CLOUD Act exposure is material despite the Norwegian cap table.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Conta
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Norway · €20/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €7.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · CHF 59.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Fiken
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€20/mo |
Lexware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€7.90/mo |
Navor
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
CHF 59.90/mo |