Keila
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Keila GmbH, Hauptstraße 10, 95517 Seybothenreuth, Germany; HRB 8676 (Amtsgericht Bayreuth); VAT DE815236863; Managing Director Philipp Schmieder
German open-source (AGPLv3) newsletter platform; public DPA + sub-processors, EU-only data (Hetzner DE + Scaleway FR), self-hostable. A privacy-first Mailchimp alternative.
Keila is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Email marketing.
Assessment notes
Keila GmbH (Seybothenreuth, Germany; HRB 8676 Amtsgericht Bayreuth; managing director Philipp Schmieder) is a 100% European-owned, bootstrapped open-source (AGPLv3) newsletter platform with a publicly downloadable DPA and sub-processor list; all customer data is stored exclusively on EU servers (Hetzner DE + Scaleway FR), and the only US-linked sub-processors are optional and transient: Intuition Machines (hCaptcha; Friendly Captcha is the EU alternative) and AWS EMEA SARL (EU-region SMTP relay, used only with the 'Send with Keila' option), so CLOUD Act exposure is minor, holding the cloud score at 4/5 (5/5 requires no US sub-processors; self-hosted with bring-your-own SMTP + Friendly Captcha is effectively 5/5 / none).
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 2 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Keila
Keila is the open-source email-newsletter platform built and operated by Keila GmbH, a small bootstrapped company based in Seybothenreuth, Germany (managing director Philipp Schmieder; HRB 8676, Amtsgericht Bayreuth). Licensed under AGPLv3 with source on GitHub (pentacent/keila) and an official Docker image, it can be self-hosted for free or used as a managed EU-hosted cloud service, positioned as a privacy-first alternative to Mailchimp, ConvertKit and other proprietary newsletter tools.
Functionally it covers the newsletter workflow end to end: a visual block editor plus Markdown and MJML/custom HTML layouts, signup forms with custom fields, double opt-in, bot protection (Friendly Captcha or hCaptcha), list segmentation with both a visual editor and a query language, Liquid-based personalization, marketing automations, A/B testing, and open/click analytics that are privacy-conscious and can be switched off entirely. A comprehensive API is available (Zapier integration in private beta). Sending is flexible: either "Send with Keila" (managed) or bring-your-own SMTP/ESP such as AWS SES, Mailgun, Postmark or SendGrid.
The sovereignty story is among the cleanest in the category. Keila GmbH is 100% European-owned with no foreign capital, all customer data is stored exclusively on EU servers (Hetzner in Germany, Scaleway in France), and both the DPA and the sub-processor list are public PDFs downloadable without a login. The approved sub-processor list (as of April 2026) names only Hetzner (DE), Scaleway (FR), AWS EMEA SARL (Luxembourg/Germany, used only for the optional managed SMTP relay) and Intuition Machines (US, only if hCaptcha is chosen over the EU Friendly Captcha). Both US-linked services are optional and transient with no customer data at rest in the US, so CLOUD Act exposure is minor. A self-hoster using bring-your-own SMTP and Friendly Captcha removes it entirely.
Cloud pricing is transparent and scales by monthly email volume, with unlimited contacts and projects on every plan: €8 (XS, 2,000 emails/mo), €16 (S, 5,000), €32 (M, 15,000), €64 (L, 50,000), €128 (XL, 100,000) and €256 (XXL, 250,000). There is deliberately no free cloud tier (the company is bootstrapped and declines to monetize user data), though self-hosting is free. Best fit: privacy-conscious creators, NGOs and SMBs who want a GDPR-clean, EU-hosted or self-hostable newsletter tool and don't need a free plan.
Sub-processor map · 4
-
Amazon Web Services EMEA SARL USLuxembourg
SMTP relay; used only if the optional "Send with Keila" managed-sending option is enabled (EU region, Luxembourg/Germany). US-owned (Amazon parent).
-
Intuition Machines, Inc. USUnited States
hCaptcha bot protection; optional; Friendly Captcha (EU) is the alternative. No customer data at rest.
-
Hetzner Online GmbH EUGermany
Server infrastructure (application data, databases, file storage)
-
Scaleway SAS EUFrance
Server infrastructure
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg | SMTP relay; used only if the optional "Send with Keila" managed-sending option is enabled (EU region, Luxembourg/Germany). US-owned (Amazon parent). | US |
| Intuition Machines, Inc. | United States | hCaptcha bot protection; optional; Friendly Captcha (EU) is the alternative. No customer data at rest. | US |
| Hetzner Online GmbH | Germany | Server infrastructure (application data, databases, file storage) | EU |
| Scaleway SAS | France | Server infrastructure | EU |
Source: the vendor’s published sub-processor list, read 16 Jun 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Keila
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |