Element (Matrix)
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
UK-headquartered open-source Matrix protocol commercialisation; powers Bundeswehr BwMessenger + French Tchap + NATO + UN.
Element (Matrix) offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Video conferencing.
Assessment notes
Element Creations Limited (UK, formerly New Vector Ltd, founded 2017; renamed 2025) is the commercial entity behind the open-source Matrix decentralised messaging protocol created by Matthew Hodgson and Amandine Le Pape. Independent custody of the protocol sits with the Matrix.org Foundation (2018). The company holds ISO/IEC 27001:2022, Cyber Essentials Plus, and OpenChain ISO/IEC 5230, runs regional subsidiaries in Germany (Element Software GmbH) and France (Element Software SARL) for EU-customer contracting, and powers the German Bundeswehr's BwMessenger (Bundeswehr-wide secure messaging) and the French government's Tchap + Visio inside La Suite numérique. Other customers: NATO, UN, HM Government, US Space Force, US Marines, Swedish agencies. Open-source Matrix protocol + self-host as the default deployment pattern + multi-entity EU contracting: ISO 27001 certified, public DPA with disclosed sub-processors, open-source clients. The managed Element Cloud carries material CLOUD Act exposure: it runs on AWS (US hyperscaler) with US-incorporated sub-processors for CRM (HubSpot), analytics (PostHog) and comms (Twilio). Message content is E2EE, but account/operational data sits with US-jurisdiction processors, the same managed-vs-self-host duality as other sovereign messengers. Self-hosting on EU infrastructure removes the exposure entirely (effective_cloud_act_if_self_hosted: none), which is the procurement-default path for the Bundeswehr BwMessenger and French Tchap deployments.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 6 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Element (Matrix)
Element is the commercial entity behind the open-source Matrix decentralised messaging-and-collaboration protocol, a Slack / Microsoft Teams / WhatsApp / Signal alternative engineered specifically for digital sovereignty and federation. The protocol was created in 2014 by Matthew Hodgson (CEO/CTO) and Amandine Le Pape (COO) while they were working at Amdocs; the commercial entity New Vector Ltd was spun out in 2017, rebranded to Element in 2020, and renamed Element Creations Limited in 2025. The Matrix protocol itself is custodied by the independent Matrix.org Foundation (established 2018), separate from Element the company, which gives the protocol the same kind of structural independence that the Linux Foundation provides for Linux.
Element's procurement-grade positioning is unmatched in the EU-sovereignty conversation. The German Bundeswehr's BwMessenger (the official secure messenger used daily by the entirety of Germany's Armed Forces) is a fork of Element built by BWI GmbH (Bundeswehr's IT supplier) and Element together; BwMessenger is described in Bundeswehr / BWI communications as "the cornerstone of the Bundeswehr's communication infrastructure". The French government's Tchap and Visio (the chat and video-conferencing components of La Suite numérique, the French government workspace suite) are both built on Matrix. Other reference customers include NATO, UN, HM Government, US Space Force, US Marines, and Swedish agencies. Certifications: ISO/IEC 27001:2022, Cyber Essentials Plus, OpenChain ISO/IEC 5230 (open-source supply-chain compliance).
Deployment is sovereign-friendly by design. Element Server Suite is sold as software that customers run on their own infrastructure, including air-gapped deployments for defence and government use, and the Matrix protocol itself is fully open source (Apache 2.0). Element's regional structure includes Element Software GmbH (Germany) and Element Software SARL (France) for EU-customer contracting, alongside the UK parent (Element Creations Ltd) and a US subsidiary (Element Software Inc). Element Cloud is the managed SaaS option. Investors include Automattic, Notion, First Minute Capital, Status, Protocol Labs, and Metaplanet. Best fit: governments, defence ministries, regulated industries, and any organisation that wants federated cross-organisation communication on a sovereign-deployable open-source protocol. The UK post-Brexit jurisdiction (other ownership tier) is the only nuance for the strictest procurement criteria. The German + French subsidiaries are available for buyers who need an EU-incorporated counterparty.
Sub-processor map · 6
-
Amazon Web Services (AWS) USUnited States
Cloud infrastructure / hosting
-
HubSpot USUnited States
CRM / customer management
-
PostHog USUnited States
Product analytics
-
Stripe USUnited Kingdom
Payment processing (UK entity, US parent)
-
Twilio USUnited States
Communications / SMS services
-
Zammad EUGermany
Customer support / ticketing
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS) | United States | Cloud infrastructure / hosting | US |
| HubSpot | United States | CRM / customer management | US |
| PostHog | United States | Product analytics | US |
| Stripe | United Kingdom | Payment processing (UK entity, US parent) | US |
| Twilio | United States | Communications / SMS services | US |
| Zammad | Germany | Customer support / ticketing | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Element (Matrix)
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
France · €10/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
kMeet (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Olvid
France
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€10/mo |
| Pexip Norway | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |