Heidelberg-based sovereign-AI lab (Pharia platform); merger with Canadian Cohere announced April 2026: Aleph Alpha shareholders to receive ~10% of combined ~$20B entity.
- FROM
- —
- CLOUD ACT
- MATERIAL
A single roll-up of ownership and CLOUD Act exposure.
KugelAudio GmbH (Amtsgericht Charlottenburg HRB 277989 B, Berlin, Germany), wholly owned since April 2026 by KugelAudio Inc. (Delaware corporation, file no. 10592822, San Francisco, USA)
Berlin-built real-time text-to-speech API (39 languages, voice cloning, MIT open-weights model); EU-only GPU providers by default, but the GmbH is wholly owned by a Delaware parent.
KugelAudio, in the Sovereign AI category, offers EU hosting with Finland as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.
KugelAudio is a Berlin text-to-speech API operated by KugelAudio GmbH (HRB 277989 B, Amtsgericht Charlottenburg, registered August 2025), and its paperwork is unusually complete for a company this young: two public DPAs (EU and Global, both dated 19 August 2026), a sub-processor register per DPA variant, a zero-data-retention clause for text and audio, and a published controls list. Under the EU DPA, which applies by default to organisations created in the EU/EEA and which the vendor brands as "EU Sovereign Cloud" (its own contract variant, not a hyperscaler sovereign-cloud product), speech content runs only on Verda (FI), Hetzner (DE), Nebius (NL), Contabo (DE), OVHcloud (FR) and Scaleway (FR); AWS, Google Cloud, Microsoft Azure and Lambda appear only in the Global DPA for customers outside the EU/EEA. The score is held at 3 by ownership: the Berlin shareholder list filed on 27 April 2026 shows that all shares in the GmbH are held by KugelAudio Inc., a Delaware corporation, the usual Y Combinator structure, so the processor has a US parent and CLOUD Act exposure is material regardless of the EU-only GPU chain. Further US links: Contabo is majority-owned by KKR (US private equity), account and billing data sit with Supabase (Singapore entity of a US-parented group), and the privacy policy names Intercom, PostHog, Stripe, Google and Vercel for support, analytics, payments and web infrastructure. No ISO 27001 or SOC 2 yet; the DPA states both are on the roadmap. The MIT-licensed open-weights model and the Enterprise on-premise option keep content inside the buyer's own perimeter.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Where ultimate control over the operating company sits.
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
KugelAudio is a real-time text-to-speech platform built in Berlin by KugelAudio GmbH, founded in August 2025 by Kajo Kratzenstein and Viktor Presber and part of Y Combinator's Spring 2026 batch. The API streams speech over REST and WebSocket in 39 languages, with voice cloning, speed control, break tokens, IPA notation, pronunciation dictionaries and word-level timestamps, and the vendor ships SDKs for Python, JavaScript and Java plus integrations for Pipecat and LiveKit. Two hosted models are priced per generated minute and billed by the second: kugel-2-turbo at €0.035 and kugel-3 at €0.07 per minute excluding VAT, with a free tier that needs no card. Enterprise contracts add dedicated capacity and on-premise deployment. An earlier model, kugelaudio-0-open, is published on Hugging Face under the MIT licence; it builds on Microsoft's open VibeVoice model and was trained on compute from the HPI AI Service Centre, which the German research ministry funds.
The paperwork is more complete than most vendors several times this size publish. There are two public DPAs, an EU and a Global variant, both dated 19 August 2026 and readable without a login, each with its own sub-processor register in the trust centre. Organisations created in the EU/EEA get the EU DPA by default, which the vendor markets as "EU Sovereign Cloud". That name refers to KugelAudio's own contract variant, not to a hyperscaler's sovereign-cloud product: speech content is processed on Verda (Finland), Hetzner, Nebius, Contabo, OVHcloud and Scaleway, voice references are stored in Hetzner and Scaleway object storage, text and audio are held in memory only under a zero-data-retention clause, and AWS, Google Cloud, Microsoft Azure and Lambda are excluded. Those four appear only in the Global DPA used for customers outside the EU/EEA, pinned to EU regions. At audit the public API answered from Hetzner and Verda servers in Finland, with TLS terminated on the vendor's own ingress and no CDN in front, which matches what the DPA describes. Two entries in the EU register need a closer look: Contabo has been majority-owned by the US private-equity firm KKR since 2022, and Supabase, which holds account and billing data, is contracted through a Singapore entity. The privacy policy also names US-owned services that touch account and support data rather than speech content: Intercom for the in-product messenger, PostHog for product analytics and session replay, Stripe for payments, Google, and Vercel.
The determining fact is ownership. The shareholder list filed with the Berlin commercial register in April 2026 shows that all shares in KugelAudio GmbH are held by KugelAudio Inc., a Delaware corporation with a San Francisco address, which is the usual structure for a Y Combinator company. The German GmbH is the contracting party and the processor, but it sits under a US parent, so ownership is recorded as EU HQ, US-funded and CLOUD Act exposure as Material. The EU-only provider set answers the question of who runs the GPUs; the parent company is a separate question, and the directory applies the same reading to every EU operator with a US parent. No security certification is held yet; the DPA names ISO 27001 or SOC 2 Type II as a roadmap goal. Best fit: teams building voice agents in European languages who value an EU-only infrastructure chain for speech content and can work with a US parent. Buyers whose procurement rules exclude a US parent should self-host the MIT model on EU GPU infrastructure or discuss the on-premise option, which keeps content inside their own perimeter.
GPU and server infrastructure in the core speech path (DPA Annex 2 A, direct contact with text and audio). Majority-owned by KKR, a US private-equity firm, since 2022.
Company email (Google Workspace MX, so mail to hello@kugelaudio.com), plus consent-gated Google Analytics 4, Google Ads conversion measurement and Google Fonts on the website.
In-product messenger and support for signed-in users (user ID, email, name, support messages). Named in the privacy policy only, absent from both registers. Irish entity of Intercom, Inc. (US).
Product analytics, session replay, feature flags and surveys (answers can include an email address). Privacy policy gives the United States as place of processing; absent from both registers.
Payment processing for credit top-ups (email, name, payment details). The DPA treats the payment provider as an independent controller; the privacy policy names Stripe Inc, United States.
Postgres database and authentication for account and billing data only (email, name, organisation, usage counters). Singapore contracting entity, unspecified EU region; group parent reported as Supabase, Inc. (Delaware).
Named in the privacy policy for hosting and backend infrastructure, United States. At audit the website and API resolved to Hetzner and Verda; only docs.kugelaudio.com (Mintlify) was on Vercel.
GPU servers for the AI models and S3-compatible object storage for voice references. Register says Germany (Gunzenhausen, the corporate seat); the API's Hetzner nodes answer from Helsinki.
GPU cloud capacity for TTS and STT inference and model operations, in EU regions including Finland and France. Dutch company, parent Nebius Group N.V. (Amsterdam).
GPU and server infrastructure in the core speech path. Processing in France and Germany.
GPU and server infrastructure in the core speech path, plus S3-compatible object storage for voice references. Processing in France, the Netherlands and Poland.
GPU inference for the TTS and STT models and hosting; the public API also answers from a Verda address in Helsinki. Finnish company (formerly DataCrunch).
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Contabo GmbH | Germany | GPU and server infrastructure in the core speech path (DPA Annex 2 A, direct contact with text and audio). Majority-owned by KKR, a US private-equity firm, since 2022. | US |
| Google LLC | United States | Company email (Google Workspace MX, so mail to hello@kugelaudio.com), plus consent-gated Google Analytics 4, Google Ads conversion measurement and Google Fonts on the website. | US |
| Intercom R&D Unlimited Company | Ireland | In-product messenger and support for signed-in users (user ID, email, name, support messages). Named in the privacy policy only, absent from both registers. Irish entity of Intercom, Inc. (US). | US |
| PostHog, Inc. | United States | Product analytics, session replay, feature flags and surveys (answers can include an email address). Privacy policy gives the United States as place of processing; absent from both registers. | US |
| Stripe, Inc. | United States | Payment processing for credit top-ups (email, name, payment details). The DPA treats the payment provider as an independent controller; the privacy policy names Stripe Inc, United States. | US |
| Supabase Pte. Ltd. | Singapore | Postgres database and authentication for account and billing data only (email, name, organisation, usage counters). Singapore contracting entity, unspecified EU region; group parent reported as Supabase, Inc. (Delaware). | US |
| Vercel Inc. | United States | Named in the privacy policy for hosting and backend infrastructure, United States. At audit the website and API resolved to Hetzner and Verda; only docs.kugelaudio.com (Mintlify) was on Vercel. | US |
| Hetzner Online GmbH | Germany | GPU servers for the AI models and S3-compatible object storage for voice references. Register says Germany (Gunzenhausen, the corporate seat); the API's Hetzner nodes answer from Helsinki. | EU |
| Nebius B.V. | Finland | GPU cloud capacity for TTS and STT inference and model operations, in EU regions including Finland and France. Dutch company, parent Nebius Group N.V. (Amsterdam). | EU |
| OVH SAS (OVHcloud) | France | GPU and server infrastructure in the core speech path. Processing in France and Germany. | EU |
| Scaleway SAS | France | GPU and server infrastructure in the core speech path, plus S3-compatible object storage for voice references. Processing in France, the Netherlands and Poland. | EU |
| Verda Cloud Oy (Verda AI) | Finland | GPU inference for the TTS and STT models and hosting; the public API also answers from a Verda address in Helsinki. Finnish company (formerly DataCrunch). | EU |
Held by the provider that operates the hosting, not by KugelAudio itself.
Heidelberg-based sovereign-AI lab (Pharia platform); merger with Canadian Cohere announced April 2026: Aleph Alpha shareholders to receive ~10% of combined ~$20B entity.
Freiburg-based German image-generation lab (FLUX models, Stable Diffusion creators), but heavily US-VC-funded; open-weight FLUX [schnell] under Apache 2.0.
Spanish AI image generation platform (Pikaso, F Lite model), rebranded to Magnific in April 2026; majority-owned by Swedish PE firm EQT; 200M+ users.