Fiken
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian cloud accounting for sole traders and small companies; founder-owned, Norway-hosted, flat monthly pricing.
Fiken offers EU hosting in Norway, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Accounting.
Assessment notes
Fiken AS (Oslo, founder-owned, primary data hosted in Norway in an ISO 27001/9001 datacenter with a publicly accessible DPA) nonetheless lists 20+ US-owned sub-processors (including AWS, Microsoft and Google for backup of stored data plus OpenAI for AI features), so despite a clean Norwegian core the data-at-rest backup chain creates material CLOUD Act exposure, capping the score at 3/5.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Fiken
Fiken (Fiken AS, Oslo, founded 2014) is Norway's most popular do-it-yourself cloud accounting tool for sole proprietorships (enkeltpersonforetak) and small limited companies (aksjeselskap). It bundles bookkeeping, invoicing, bank reconciliation, VAT/MVA reporting, payroll with a-melding, annual accounts and the tax return into one flat monthly fee: from ~229 NOK/mo (~€20) for sole traders and ~349 NOK/mo for an AS, after a 30-day free trial. There is no permanent free tier. The product is praised for radical simplicity and a strong public REST API (api.fiken.no) widely used by Norwegian fintech integrations, banks and accountants. Crucially for a sovereignty audit, Fiken is one of the rare profitable, fully founder-owned European SaaS companies: the three founders, Bendik Gill Bakken (CEO), Joakim Blomskøld and Aleksander Blomskøld, still hold ~33.33% each, with no PE, VC or US capital on the cap table (Finansavisen reported in April 2025 that the trio had each become NOK-billionaires on the business; ~87 employees, ~375M NOK 2024 revenue). Primary data is hosted in Norway, partly to satisfy the Norwegian Bookkeeping Act, in a datacenter the company says is ISO 27001:2013 / ISO 9001:2015 certified. The caveat is the sub-processor stack: the published databehandler list names AWS, Microsoft and Google for backup, OpenAI for AI assistance, plus a long tail of US SaaS (Intercom, Freshdesk, Mailchimp, Twilio, Sentry, New Relic, Slack, Notion, Meta), all under SCCs. The UI is Norwegian-only, so practical reach is the Norwegian market rather than pan-EU.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Fiken
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Norway · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €7.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · CHF 59.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Conta
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€9/mo |
Lexware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€7.90/mo |
Navor
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
CHF 59.90/mo |