Kantree
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Flexible French work management platform (Kantree by Digicoop), 100% employee-owned cooperative, EU hosting, ISO 27001.
Kantree offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Project management.
Assessment notes
Kantree is operated by Digicoop, a French workers' cooperative (SCOP) that is 100% employee-owned, a structurally rare governance model that permanently prevents external takeover, paired with ISO/IEC 27001 certification and EU-region hosting with daily backups; the product is a flexible Kanban/Gantt/timeline work-management platform covering project, engineering, IT, HR, and marketing use cases. The governance story is intact, but the processor chain published in the privacy policy is not what the May 2026 audit assumed: servers run on OVH in France, yet 'Files and backups are hosted in Amazon Web Services S3 in Ireland', and Sentry, Mailgun and Stripe are named alongside. Customer files and backups therefore sit at rest with a US-controlled processor, so CLOUD Act exposure is material and the score drops to 3 despite the cooperative ownership.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 4 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Kantree
Kantree is the work-management platform built by Digicoop, a French workers' cooperative (SCOP: Société Coopérative et Participative) that is 100% employee-owned. The legal structure is a fundamental procurement-grade signal: there are no external shareholders, no VC / PE on the cap table, and the cooperative model permanently prevents acquisition or hostile takeover, a governance posture matched in this directory only by Proton's non-profit foundation structure and Cryptee's solo bootstrap. The product covers Kanban boards, Gantt timelines, custom forms, dashboards, and workflow automations across project management, engineering, IT, HR, and marketing use cases.
Compliance posture: ISO/IEC 27001 certified, GDPR compliant, EU-region hosting with daily backups, French jurisdiction throughout. The processor chain is less clean than the governance story suggests. The privacy policy states that the servers are hosted by OVH in France, but also that files and backups are hosted in Amazon Web Services S3 in Ireland, with Sentry, Mailgun and Stripe named alongside. Customer files and backups therefore sit at rest with a US-controlled processor, which is why CLOUD Act exposure is recorded as Material despite the cooperative ownership. The product is also available as a self-hosted on-premise deployment for organisations that want to keep the entire stack on their own infrastructure.
Pricing in EUR: Team €8/user/month and Business €15/user/month on monthly billing, with a stated 20% discount for yearly subscriptions, and Enterprise by quote covering on-premise, private-cloud and SecNumCloud-hosted deployment options. A 15-day unrestricted trial is offered, there is no free tier, and reduced pricing applies to education and cooperatives. Best fit: EU SMBs and agencies that value the cooperative ownership story alongside the flexibility of an Airtable / Monday-class platform, and any organisation requiring an on-premise PM option without losing managed-cloud feature parity.
Sub-processor map · 7
-
Amazon Web Services (S3) USIreland
Storage of customer files and backups (S3, Ireland region)
-
Mailgun USUnited States
Transactional email sending
-
Sentry USUnited States
Error monitoring
-
Stripe USIreland
Payment processing; ancillary
-
Mailjet EUFrance
Email sending
-
OVH EUFrance
Server hosting for the Kantree application
-
Sendinblue (Brevo) EUFrance
Email sending
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (S3) | Ireland | Storage of customer files and backups (S3, Ireland region) | US |
| Mailgun | United States | Transactional email sending | US |
| Sentry | United States | Error monitoring | US |
| Stripe | Ireland | Payment processing; ancillary | US |
| Mailjet | France | Email sending | EU |
| OVH | France | Server hosting for the Kantree application | EU |
| Sendinblue (Brevo) | France | Email sending | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Kantree
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Netherlands · $10/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €19.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Germany · €99/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Baserow
Netherlands
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
$10/mo |
factro
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€19.99/mo |
HansaChat
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€99/mo |