Freepik
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Spanish AI image generation platform (Pikaso, F Lite model), rebranded to Magnific in April 2026; majority-owned by Swedish PE firm EQT; 200M+ users.
Freepik offers EU hosting in Spain, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
Freepik (Málaga, Spain; founded 2010; majority-owned by Swedish PE EQT, Nasdaq Stockholm, which is EU-owned) operates Pikaso, a text-to-image generator powered by their own F Lite open model (April 2025) and Stable Diffusion, with 200M+ users. EU-owned with no US-PE majority, but no public DPA, no public sub-processors list, and no EU-specific certifications found at audit; hosting infrastructure undisclosed. Re-verified 2026-08-26: the company rebranded to Magnific on 28 April 2026 (same legal entity, Freepik Company S.L.U.), a DPA is now obtainable on request via rpd@magnific.com, and — decisively for this category — the platform is a multi-model aggregator that routes generation to third-party providers including US ones (GPT Image 2, Google Imagen 4 / Nano Banana, Veo, Runway Gen-4), with the privacy policy itself conceding that some models are hosted in EU-adequate countries and others are not. That moves cloud_act_exposure from minor to material: core prompt and image data flows through US-owned model providers.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Freepik
Freepik is a Málaga-based Spanish technology platform founded in 2010 by Alejandro Sánchez, Pablo Blanes, and Joaquín Cuenca. Originally a search engine for stock design resources, the company has evolved into a full-stack generative AI image platform. The AI offering centres on Pikaso, Freepik's own text-to-image generator, and F Lite (an open text-to-image model released in April 2025, trained on commercially licensed "safe-for-work" images) alongside Freepik Enterprise (launched May 2025) for organisation-level AI image generation with centralised management, brand safeguards, and legal indemnification for generated content.
The company has grown aggressively through acquisitions: Videvo (stock video/audio, June 2022), Iconfinder (icon platform, October 2022), EyeEm (photography marketplace, October 2023), and most notably Magnific (Spanish AI image upscaling startup, May 2024), whose technology now powers AI enhancement and upscaling inside the platform. On 28 April 2026 the whole company rebranded to Magnific, keeping the same legal entity, Freepik Company S.L.U. of Málaga, and moving the site and legal pages to magnific.com. The company is majority-owned by EQT AB, a Swedish private equity firm listed on Nasdaq Stockholm, which acquired a majority stake in 2020. EQT is EU-headquartered (Stockholm), making Freepik's beneficial ownership EU-controlled with no US PE or US parent exposure in the primary ownership chain.
From an EU-sovereignty stance, Freepik presents a straightforward eu_owned case on the ownership axis: Spanish incorporation, Swedish (EU) PE majority-shareholder, founders still involved. The compliance picture is weaker: no public DPA URL, no sub-processors list and no EU-specific certifications (C5, EUCS, SecNumCloud, ISO 27001) were found at audit, although a DPA is obtainable on request from rpd@magnific.com. The company's own hosting infrastructure is still not publicly detailed, but the model layer is no longer unclear: the platform is a multi-model aggregator that routes generation to third-party providers, among them GPT Image 2 (OpenAI), Imagen 4 and Nano Banana (Google), Veo 3.1 (Google) and Runway Gen-4, all US-owned, alongside in-house Mystic and Pikaso and several non-US models. The privacy policy states that users select from multiple AI models, some hosted in countries the EU deems adequate and others in countries with different protections, so prompt and image data reaches non-adequate destinations by design of the model picker; CLOUD Act exposure is recorded as Material on that basis. The F Lite model is Apache 2.0–licensed open weights, enabling EU buyers to run self-hosted image generation on EU GPU infrastructure if they need full data sovereignty. Best fit: creative professionals and marketing teams wanting EU-incorporated AI image generation with a broad asset library; procurement-grade buyers requiring DPA should negotiate directly with Freepik Enterprise.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Freepik
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.freepik.com/terms-of-use…
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aleph Alpha
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Black Forest Labs
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
DeepL
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |