Factorial
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Spanish HR + payroll + finance SaaS (Barcelona, est. 2016); 16K+ customers, ISO 27001 + SOC 2 + AWS EU, US-VC-funded.
Factorial offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under HR & people.
Assessment notes
Factorial (Barcelona ES, founded 2016) is ISO 27001 + SOC 2 Type II certified with AWS EU hosting and 16,000+ customers; cap table includes Tiger Global, CRV, General Catalyst, GGV (all US VCs) plus Atomico (UK) and Creandum (EU). Material US-VC funding flips signal to eu_hq_us_funded and creates CLOUD Act influence.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 10 · 9 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Factorial
Factorial (Barcelona, Spain, founded 2016 by Jordi Romero, Pau Ramon, and Bernat Farrero) is a fast-growing Iberian HR-and-business-management SaaS: 16,000+ customers across HR, payroll, time tracking, talent, finance, and IT modules. Compliance: ISO 27001 (ENAC), SOC 2 Type II (AICPA), AWS EU hosting. The product is genuinely Spanish-built, but the cap table is heavily US: Tiger Global, CRV, General Catalyst, GGV lead recent rounds, with Atomico (UK) and Creandum (EU) as European voices. For procurement evaluation Factorial is "Spanish-operating, US-VC-controlled", similar to Personio's posture.
Sub-processor map · 10
-
Amazon Web Services USGermany
Web hosting and server infrastructure
-
Confluent Cloud USGermany
Optimisation of processes within the Factorial platform
-
Google Cloud Platform US
Cloud provider for analytical services processing aggregated or statistical data (EU region)
-
Google Gemini US
OCR and digitalization of invoices and receipts (EU region)
-
HubSpot USGermany
Onboarding tracking and support ticket management
-
Intercom USIreland
Messaging service for customer care
-
Jira USIreland
Customer support and incident management
-
Microsoft Azure USGermany
Web hosting, and Azure OpenAI for suggesting functionalities and content generation
-
Typeform USUnited States
User survey forms (the only entry whose stated processing region is the USA)
-
ClickHouse EUGermany
Database management for information processing and querying
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services | Germany | Web hosting and server infrastructure | US |
| Confluent Cloud | Germany | Optimisation of processes within the Factorial platform | US |
| Google Cloud Platform | — | Cloud provider for analytical services processing aggregated or statistical data (EU region) | US |
| Google Gemini | — | OCR and digitalization of invoices and receipts (EU region) | US |
| HubSpot | Germany | Onboarding tracking and support ticket management | US |
| Intercom | Ireland | Messaging service for customer care | US |
| Jira | Ireland | Customer support and incident management | US |
| Microsoft Azure | Germany | Web hosting, and Azure OpenAI for suggesting functionalities and content generation | US |
| Typeform | United States | User survey forms (the only entry whose stated processing region is the USA) | US |
| ClickHouse | Germany | Database management for information processing and querying | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Factorial
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
-
FranceEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
HiBob
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |
Lucca
France
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |
| Personio Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
— |