Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Ko-fi

VERIFIED

Ko-fi Labs Limited (company no. 11087704), Suite 501, The Nexus Building, Broadway, Letchworth Garden City, SG6 9BL, United Kingdom

Membership platforms · United Kingdom

UK creator platform (Ko-fi Labs Limited) for tips, memberships and digital shops: 0-5% service fee, but payouts run only through PayPal, Inc. or Stripe, Inc., with no EU payment option.

In short

Ko-fi, in the Membership platforms category, offers EU hosting with United Kingdom as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Ko-fi is a UK platform for tips, memberships, commissions and digital shops, operated by Ko-fi Labs Limited in Letchworth Garden City under English law. It is popular with European creators and was named by the reader who asked for this category, so it is listed, but it is not a European option in the sense this directory uses: the operator is outside the EU, and the money rails are exclusively American. Ko-fi does not process payments itself; the creator connects their own account and the terms name PayPal, Inc. and Stripe, Inc., US entities, as the parties that do. There is no EU-incorporated payment option and no way to configure one, which is the difference between Ko-fi and Petje Af, whose otherwise identical bring-your-own-processor model also offers Mollie. Ko-fi publishes no DPA, no sub-processors list and no hosting location; the site is served through Cloudflare, and Google, X, Facebook and Twitch are named as login providers, CookieYes for consent, with Google Workspace, Microsoft and SendGrid visible in the mail configuration: Material.

CLOUD ACT
OWNERSHIP
SUB-PROCS
12 · 11 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Ko-fi

Ko-fi is a creator funding platform operated by Ko-fi Labs Limited from Letchworth Garden City in the United Kingdom, governed by English law and by the exclusive jurisdiction of the English courts. It is the broadest product in this category by feature count: one-off tips, recurring memberships, commissions for custom work, a shop for digital and physical items, Discord and Twitch integrations, stream alerts, goals, polls and embeddable widgets, all on a page that costs nothing to open. The service fee is 0% on tips for the legacy free tier and 5% on memberships, shop sales and commissions, with new creators defaulting to a 5% Standard plan and Ko-fi Gold at 12 USD per month removing service fees entirely.

Structurally Ko-fi works the same way as Petje Af: it never holds the money. The creator connects their own payment account and supporters pay them directly. The difference, and it is the whole difference for a European reader, is which accounts can be connected. Ko-fi's terms are explicit that payments are handled by third-party providers and name PayPal, Inc. and Stripe, Inc., both US-incorporated. There is no Mollie, no Adyen, no SEPA-native option, and no setting that changes this. A European creator using Ko-fi is therefore routing every euro their audience sends through an American payment company, by design rather than by oversight.

The rest of the disclosure is thin. Ko-fi publishes no data processing agreement, no sub-processors list and no statement of where the platform is hosted; the site is served through Cloudflare. The privacy policy does name the third parties it uses: PayPal and Stripe for payments, Google, X, Facebook and Twitch as login providers, YouTube and Twitch for stream integrations, and CookieYes for consent, with Google Workspace, Microsoft and SendGrid visible in the mail configuration, and it commits to appropriate safeguards including standard contractual clauses for transfers outside the UK and EEA: Material. Ko-fi is included here because European creators use it heavily and because a reader specifically asked, not because it is a European alternative. Best fit: creators who want the widest feature set on one free page and for whom payment jurisdiction is not a decision criterion.

SUB-PROCESSORS

Sub-processor map · 12

  • Cloudflare, Inc. US
    United States

    CDN and DDoS protection in front of ko-fi.com

  • Google Ireland Limited (Google Workspace) US
    Ireland

    Corporate and support email (from public MX and SPF records)

  • Google LLC US
    United States

    Account sign-in provider

  • Google LLC (YouTube) US
    United States

    Stream chat and alert integration

  • Meta Platforms, Inc. US
    United States

    Account sign-in provider (Facebook)

  • Microsoft Corporation (Exchange Online) US
    United States

    Additional authorised mail sender (from public SPF record)

  • PayPal, Inc. US
    United States

    Supporter payments and payouts, named in the terms as a third-party payment provider

  • Stripe, Inc. US
    United States

    Supporter payments and payouts, named in the terms as a third-party payment provider

  • Twilio SendGrid US
    United States

    Transactional email delivery (from public SPF record)

  • Twitch Interactive, Inc. US
    United States

    Account sign-in provider and stream chat and alert integration

  • X Corp. US
    United States

    Account sign-in provider

  • CookieYes Limited non-US
    United Kingdom

    Cookie consent management

11 of 12 sub-processors are US-incorporated. CLOUD Act exposure applies.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-10).
FEATURES

Capability matrix

Recurring memberships Yes
One-off tips Yes
Pay-per-post No
Members-only content hosting Yes
Digital shop Yes
Connect your own payment account Yes
VAT collected and remitted for you No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

FREEMIUM
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    more.ko-fi.com/terms…
    Open ↗
ALTERNATIVES

Alternatives in this category

Herohero
Czechia · Founded 2021
US-LINKED

Czech creator membership platform (Herohero a.s., Prague): flat 10% all-in fee and strong local reach, but the terms also contract through a Delaware corporation and content sits on Google Storage.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
DIRECT
Liberapay
France · Founded 2015
EU-HOSTED

French non-profit association running an open-source recurring-donation platform: 0% platform cut, but hosted on AWS Ireland with Stripe and PayPal as the only payment routes.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Patronite
Poland · Founded 2015
EU-HOSTED

Poland's creator membership platform (Crowd8 sp. z o.o.): 6.5% commission with Polish payment rails, Tpay and ING's Imoje, on AWS Frankfurt infrastructure.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL