DatoCMS
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Italian developer-friendly headless CMS (Milan); 25K+ businesses; bootstrapped feel, no US PE.
DatoCMS offers EU hosting in Ireland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Headless CMS.
Assessment notes
DatoCMS (Dato srl, Milan IT) is a smaller bootstrapped-feel Italian headless CMS serving 25,000+ businesses; no US-PE involvement identified, so ownership_signal: eu_owned. Two May gaps are now closed: /security states plainly that 'DatoCMS is ISO 27001 certified' (certificate on request), and /legal/gdpr publishes the full sub-processor list. Reading that list is what moves the CLOUD Act flag: the platform runs on AWS eu-west-1 (Ireland) with backups in eu-west-3 (France), and customer-uploaded assets are stored at rest in Cloudflare R2 (EU jurisdiction), so the core store and the asset store are both US-owned providers, which is material exposure rather than minor even though every named region is inside the EU. No DPA is published, which caps the score at 3.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About DatoCMS
DatoCMS (operated by Dato srl, Milan, Italy) is a developer-friendly headless CMS positioned as "the most complete, user-friendly and performant Headless CMS": 25,000+ businesses, scaling from small teams to enterprises with 250+ editors managing global content operations. Paid plans start at €149/month billed annually (Professional; €199 month to month), with a free tier for hobby projects and Enterprise on quote; the €39 Agency Partner tier recorded in May is gone from the public page. Mostly self-funded / bootstrapped feel, no identified US-PE majority involvement, placing DatoCMS in ownership_signal: eu_owned. The security page now states plainly that DatoCMS is ISO 27001 certified, with the certificate available on request, and the sub-processor list is published in full, so the procurement-grade caveat has moved to what that list says. The platform runs on AWS eu-west-1 (Ireland) with disaster-recovery backups in eu-west-3 (France), and customer-uploaded assets are stored at rest in Cloudflare R2 under its European Union jurisdiction, so the core store and the asset store are both US-owned providers even though every named region sits inside the EU, which is why CLOUD Act exposure is recorded as Material. No DPA is published; procurement teams have to request one.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of DatoCMS
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
OpenSub-processors listwww.datocms.com/legal…
Alternatives in this category
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $199/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
France · $10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
| Enonic Norway | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
— |
Hygraph
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
$199/mo |
Prismic
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$10/mo |