Hourtick
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
WeCode A/S (CVR 37496510, Thorsgade 59, 2. sal, 2200 København N, Denmark)
Danish tasks, team chat and time tracking for people and AI agents (MCP); flat workspace pricing, free tier, data on Akamai Cloud in Frankfurt.
Hourtick offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Project management.
Assessment notes
Hourtick is a product of WeCode A/S (CVR 37496510, Copenhagen, a software company registered in 2016 with 15 employees), Danish-owned with no outside funding on record. It publishes a GDPR Article 28 DPA and a sub-processor page that anyone can read without an account, both dated 27 September 2026, which is unusually complete for a product launched that same week. The application servers, PostgreSQL database and uploaded files sit on Akamai Cloud (Linode) in Frankfurt, so data stays in the EU, but Akamai is a US company, and every one of the seven listed sub-processors (Akamai, Cloudflare in front of all traffic, Stripe, Mailgun, Google, Apple, Google Analytics) is a US company or US-owned. A US-owned host holding the data at rest is material CLOUD Act exposure, and with three or more US sub-processors the rubric places it at 3. Hourtick does not run AI models itself: agents connect over MCP under the customer's own provider agreements. No third-party certification yet.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 7 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Hourtick
Hourtick combines a task board, team chat and time tracking in one workspace, with AI agents treated as members of the team. Tasks live on a board or a list with several assignees, checklists, subtasks, blocking dependencies, a chat and file previews. Channels, direct messages and threads sit next to them, and typing # pulls a live task card into the conversation. Time is tracked from a Mac menu-bar timer, the Mac app or the web app, works offline, and flows into weekly timesheets with submit and approve steps, billable task types, budget burn per project, CSV export and invoiced time that locks. An iPhone app is announced. The distinctive part is the agent model: Claude, ChatGPT and Codex, Grok, Muse and other assistants connect to Hourtick's MCP server, pick up tasks from the board, ask in the chat when stuck, hand parts of a job to each other, and log their own time and model cost so agent work can be billed like anyone's.
Hourtick is a product of WeCode A/S, a Copenhagen software company registered in 2016 (CVR 37496510) with 15 employees, run by Troels Johannesen and Danish-owned with no outside funding on record. The product itself is new: the domain was registered on 26 September 2026 and the public changelog starts that week. The legal pages are already in order. A GDPR Article 28 DPA and a sub-processor page are public, with 30 days' notice before a new sub-processor starts. Application servers, the PostgreSQL database and uploaded files run on Akamai Cloud (Linode) in Frankfurt, Germany, and a workspace admin can opt to store files in the United States instead before the first upload. Akamai is a US company, Cloudflare sits in front of all traffic, and Stripe, Mailgun, Google and Apple complete a sub-processor list in which every entry is a US company or US-owned, so CLOUD Act exposure is Material even though the data rests in the EU. Hourtick does not run AI models itself: agents act through the customer's own provider accounts, and the "Ask AI" buttons only send the prompt shown to the user, after a click. There is no end-to-end encryption, no SAML single sign-on (Google sign-in can be restricted to a Workspace domain) and no certification yet.
Pricing does not count people. The Free plan covers unlimited members and every feature with 500 MB of monthly usage (storage plus data transferred); Pro is $29 per workspace per month for 5 GB, with extra usage at 10 USD per GB. Billing is monthly only and in USD. The interface is in English. Best fit: agencies, consultancies and small teams that bill by the hour and are starting to delegate work to AI agents, and that accept a young product on US-owned infrastructure in Frankfurt.
Sub-processor map · 7
-
Akamai Technologies (Akamai Cloud / Linode) USGermany
Application servers, PostgreSQL database and object storage for uploaded files, Frankfurt. Workspaces whose admin opts for US file storage keep files in the United States.
-
Apple USUnited States
Sign in with Apple for users who choose it, and push notifications to the iPhone app (APNs). Global.
-
Cloudflare USUnited States
CDN and DDoS protection in front of all traffic; Turnstile bot checks on sign-up, password reset and the contact form. Global network.
-
Google USUnited States
Sign in with Google, only for users who choose it. Global.
-
Google Ireland Limited (Google Analytics) USIreland
Website analytics on hourtick.com outside the app, stated as consent-only; tested 2026-10-02, it fires before consent. EU and US.
-
Mailgun (Sinch) USUnited States
Transactional email (confirmations, password resets, invitations, notifications) and contact-form messages. EU region per the vendor.
-
Stripe USUnited States
Payment processing and subscription billing for the Pro plan. EU and US.
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Akamai Technologies (Akamai Cloud / Linode) | Germany | Application servers, PostgreSQL database and object storage for uploaded files, Frankfurt. Workspaces whose admin opts for US file storage keep files in the United States. | US |
| Apple | United States | Sign in with Apple for users who choose it, and push notifications to the iPhone app (APNs). Global. | US |
| Cloudflare | United States | CDN and DDoS protection in front of all traffic; Turnstile bot checks on sign-up, password reset and the contact form. Global network. | US |
| United States | Sign in with Google, only for users who choose it. Global. | US | |
| Google Ireland Limited (Google Analytics) | Ireland | Website analytics on hourtick.com outside the app, stated as consent-only; tested 2026-10-02, it fires before consent. EU and US. | US |
| Mailgun (Sinch) | United States | Transactional email (confirmations, password resets, invitations, notifications) and contact-form messages. EU region per the vendor. | US |
| Stripe | United States | Payment processing and subscription billing for the Pro plan. EU and US. | US |
Source: the vendor’s published sub-processor list, read 2 Oct 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Hourtick
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Netherlands · $10/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €19.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Germany · €99/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Baserow
Netherlands
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
$10/mo |
factro
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€19.99/mo |
HansaChat
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€99/mo |