Hygraph
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Berlin GraphQL-native headless CMS (formerly GraphCMS, founded 2017); enterprise clients incl. Samsung, LEGO; mostly EU-funded.
Hygraph is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Headless CMS.
Assessment notes
Hygraph (formerly GraphCMS, Berlin DE, founded 2017) is ISO 27001 + SOC 2 referenced, GraphQL-native federated content platform, enterprise customer base (Samsung, Dr. Oetker, LEGO, Paramount, TED); $30M Series B 2023 led by One Peak (UK PE) with OpenOcean (FI) and SquareOne (DE); mostly European cap table, no US-PE majority, so ownership_signal: eu_owned. Gap: Hygraph does not publish a publicly accessible DPA; data-processing terms and sub-processors are not surfaced in public documentation and access appears to require enterprise contact; verification of DPA and sub-processor disclosure is pending despite the largely EU-aligned ownership and certification posture.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Hygraph
Hygraph (Berlin, Germany, founded 2017; previously GraphCMS until 2021 rebrand) is a GraphQL-native, API-first headless CMS positioned for enterprise teams managing complex multi-brand, multi-region, multi-platform content. Enterprise customers include Samsung, Dr. Oetker, LEGO, Paramount, TED. Compliance: the FAQ states Hygraph is SOC 2 Type 2 compliant and ISO 27001 certified, though the privacy policy attributes both to the data centres rather than to Hygraph itself, and no attestation URL or certificate is published either way. $30M Series B 2023 led by One Peak (UK private equity) with participation from OpenOcean (Finland) and SquareOne (Germany). Its mostly-European cap table makes Hygraph one of the cleanest non-US-funded headless CMS picks in the catalogue, but the disclosure side is thin: Hygraph publishes no DPA and no sub-processor list, its privacy policy names processor categories rather than companies, and it names no hosting provider at all, offering only shared regions (EU, US, APAC) on the self-serve plans. Pricing is quoted in USD: Hobby is free, Growth is USD 199 per month billed monthly, and Enterprise is on quote; the EUR 39 tier recorded in May no longer exists.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Hygraph
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
Alternatives in this category
-
Italy · €149/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
France · $10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
DatoCMS
Italy
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€149/mo |
| Enonic Norway | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
— |
Prismic
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$10/mo |