DeepL
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
DeepL SE (Amtsgericht Köln HRB 104617, Cologne, Germany), contracting party for DeepL Pro and the DeepL API; group entities include DeepL AI GmbH (Cologne), DeepL US Inc. (Delaware) and DeepL Japan GK
Cologne-built AI translation, writing and speech-translation platform (Translator, Write, Voice, API) with C5 and ISO 27001; paid content runs on AWS by default unless the EU residency add-on is bought.
DeepL offers EU hosting in Sweden, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
DeepL is the Cologne language-AI company behind DeepL Translator, Write, Voice, DeepL Agent and the DeepL API, operated by DeepL SE (Amtsgericht Köln HRB 104617), led by founder and CEO Jaroslaw Kutylowski, with no US parent or holding company in the register or the published group list, and with strong certifications of its own: ISO/IEC 27001:2022, a BSI C5 Type 2 attestation (August 2025) and a SOC 2 Type 2 report. Two findings hold the score at 3. First, AWS became a core sub-processor in 2026: DeepL's trust centre, support article and security whitepaper state that business and enterprise content is processed and stored on AWS, by default in any of DeepL's AWS regions (EU Stockholm, US Oregon, Japan Tokyo), and that keeping content in one region requires a Data Residency add-on sold only through sales (Team, Business and API for Business; included in Enterprise), so a self-serve Pro customer cannot contract for EU-only processing; CLOUD Act exposure is therefore material. Second, the DPA, its sub-processor list, the technical and organisational measures and the transfer clauses are not public: they sit behind an access request in the SafeBase trust centre, whose subprocessors section is hidden, while the privacy policy (updated September 2026) still says document translation runs on DeepL infrastructure in the EEA; a gated DPA caps the score at 3 under the rubric. Ownership is recorded as eu_hq_us_funded on the Mistral AI precedent, because the US funds Benchmark, IVP, Bessemer and ICONIQ Growth and the London and San Francisco firm Index Ventures hold material positions next to Atomico, btov, WiL and Teachers' Venture Growth. Further US processors touch account, support and marketing data rather than translation content (Stripe, Zendesk, HubSpot, Salesloft, Granola, Statsig, and Cloudflare in front of the website), and ElevenLabs supplies backup voices in DeepL Voice. Texts entered on the free tier stay on DeepL's own servers in Iceland and Sweden but may be used for model training.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About DeepL
DeepL is a language-AI platform built by DeepL SE in Cologne. It grew out of Linguee, the dictionary search engine launched in 2009, and released DeepL Translator in 2017 under founder and CEO Jaroslaw Kutylowski. The range covers text and document translation (Translator), a writing assistant (Write), real-time speech translation (Voice), a task agent (DeepL Agent) and a developer API. Paid plans start at €7.49 for Individual, billed annually; Team, Business and Enterprise add SSO, translation memories and higher quotas. Texts submitted on paid plans are deleted after processing and are not used for training. Texts entered on the free translator and free Write may be used to train DeepL's models, and personal data is not allowed there.
Infrastructure changed in 2026. DeepL used to process content only on servers it runs in data centres in Iceland and Sweden. It now uses a hybrid model with Amazon Web Services as a sub-processor, in new contracts since 1 January 2026 and, since 20 May 2026, for existing customers who did not object. DeepL's trust centre says its own data centres keep serving research, model training and free users, while AWS processes and stores content for business and enterprise customers. By default that content may be processed in any of DeepL's AWS regions: the EU (Stockholm, combined with DeepL's own site), the US (Oregon) and Japan (Tokyo). Region-locked processing needs the Data Residency add-on, sold only through sales on Team, Business and API for Business and included in Enterprise. In Europe, encryption keys stay in DeepL's own key service outside AWS. At audit the API answered from DeepL's own network with latency matching the Stockholm region (Sweden), while the marketing website sat behind Cloudflare.
DeepL SE is registered in Cologne, Germany, and has no US parent, but US venture capital is prominent on the cap table: Benchmark (2018), IVP and Bessemer (2023), and ICONIQ Growth in the May 2024 round led by Index Ventures, alongside Atomico, btov, WiL and Teachers' Venture Growth. As with Mistral AI, ownership is recorded as EU HQ, US-funded; with customer content on AWS by default, CLOUD Act exposure is Material. Certifications are strong (ISO/IEC 27001, BSI C5 Type 2, SOC 2 Type 2), the paperwork less so: the DPA and its sub-processor list sit behind an access request, and the privacy policy still describes processing on DeepL infrastructure in the EEA. Best fit: organisations that want DeepL's translation quality and accept AWS, or that buy EU residency through sales. Buyers who need EU-owned infrastructure only should get the residency terms and the sub-processor list in writing before signing.
Sub-processor map · not disclosed
Frameworks & certifications
Held by the provider that operates the hosting, not by DeepL itself.
Capability matrix
Table 1Capabilities of DeepL
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
on requestData Processing Addendum (DPA)— on request
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.deepl.com/en…
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Spain · €12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
| Aleph Alpha Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
| Black Forest Labs Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
| Freepik Spain | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€12/mo |