Crisp
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Nantes-based French customer-messaging platform (Crisp IM SAS, founded 2015); fully bootstrapped, no VC, 200k+ customers, flat-rate pricing.
Crisp offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Helpdesk.
Assessment notes
Crisp IM SAS (Nantes, France; founded 2015 by Baptiste Jamin (CEO) and Valerian Saliou (CTO)) is a fully bootstrapped French customer-messaging platform with no venture capital, no PE, no parent company. 200,000+ customers on a flat-rate pricing model that explicitly rejects per-agent metering, with a 'Made in Europe' positioning, a French SAS legal entity and founder control. The CLOUD Act exposure is nonetheless material: core chat and conversation data is hosted at rest on DigitalOcean (a US-owned cloud provider) in Amsterdam, Netherlands (plugin infrastructure runs in Frankfurt, Germany). Because the underlying hosting provider has a US parent, customer messaging data carries material CLOUD Act exposure despite the EU regions and the EU subsidiary; the DPA is also not publicly accessible (reachable only via workspace settings inside a customer account, login required), a gap relative to procurement-grade buyers who expect a self-service DPA link.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Crisp
Crisp is a Nantes-headquartered French customer-messaging platform operated by Crisp IM SAS and founded in 2015 by Baptiste Jamin (CEO) and Valerian Saliou (CTO). One of the structurally cleanest ownership stories in the directory: the company is fully bootstrapped (no venture capital, no private equity, no acquiring conglomerate, no US legal entity) and remains founder-controlled a decade after launch. The product reports 200,000+ customers and serves SMBs, e-commerce, and SaaS through a flat-rate pricing model that explicitly rejects the per-agent metering that dominates the Intercom / Drift / Freshdesk pricing pattern.
The product surface is broader than the original Crisp live-chat origin suggests: Hugo (the recently-launched AI support agent), the embeddable chat widget, multi-channel inbox (email, WhatsApp, Messenger, Telegram, SMS, Twitter), AI chatbots and agents, support CRM, ticketing, knowledge base, status pages, video and voice calls, and analytics. Crisp markets the suite as "Built from France 🇫🇷 / Made in Europe", the same positioning that procurement-grade buyers value when assessing alternatives to US-controlled competitors. The G2 awards stack (High Performer, Momentum Leader, Loved Winter 2025) and 14-day no-credit-card free trial reflect a polished SMB go-to-market.
For an EU-sovereignty audit Crisp has the cleanest ownership structure in the helpdesk category. French SAS legal entity, founder-controlled, bootstrapped: these are the structural fundamentals that even more-established competitors (Userlike acquired by Lime; LiveChat publicly listed but with US sales presence; Tidio US-VC-funded) can't quite match. One gap is disclosure: a unified DPA artefact is only accessible via workspace settings (login required), not via a public link. Procurement teams should request a signed DPA before onboarding. The decisive nuance, however, is on the infrastructure side: core chat and conversation data is hosted at rest on DigitalOcean (a US-owned cloud provider) in Amsterdam (plugin infrastructure in Frankfurt). Because the host has a US parent that is compellable regardless of the EU region, the CLOUD Act flag is material despite the clean French ownership. The AI feature stack adds an LLM dependency the published sub-processor page does not describe: Hugo's own documentation says the model is customer-selected among Anthropic Claude, OpenAI, Google Gemini and Mistral, three of the four US-owned, while the public GDPR page names only Crisp-owned Mirage for AI. Hugo has to be configured per workspace and the Free plan carries no AI credits, so that path is opt-in rather than on by default, but the disclosure gap is worth raising before signing. Best fit: French and EU SMBs / e-commerce / SaaS that want bootstrapped-founder ownership; companies that value flat-rate pricing over per-agent metering; buyers replacing Intercom or Drift with a structurally EU-independent vendor.
Sub-processor map · 4
-
Cloudflare USUnited States
CDN / edge infrastructure / DDoS protection
-
DigitalOcean USUnited States
Server hosting (messaging in NL, plugins in DE; per Crisp via EU subsidiary subject to EU law)
-
Stripe USUnited States
Payment processing (credit card storage)
-
Mirage EUFrance
AI features (LiveTranslate, MagicReply); owned, developed and operated by Crisp
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Cloudflare | United States | CDN / edge infrastructure / DDoS protection | US |
| DigitalOcean | United States | Server hosting (messaging in NL, plugins in DE; per Crisp via EU subsidiary subject to EU law) | US |
| Stripe | United States | Payment processing (credit card storage) | US |
| Mirage | France | AI features (LiveTranslate, MagicReply); owned, developed and operated by Crisp | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Crisp
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · $19/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Ireland · $19/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Userlike (Lime Connect)
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€87/mo |
LiveChat (Text)
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$19/mo |
Customerly
Ireland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$19/mo |