Langdock
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Langdock GmbH (Amtsgericht Charlottenburg HRB 254499 B, Berlin, Germany), wholly owned since 11 August 2026 by Langdock Holding SE (HRB 283041 B, Berlin); previously by Langdock Inc. (Delaware)
Berlin-built enterprise AI workspace (chat, agents, workflows, API) for OpenAI, Anthropic, Google and Mistral models; EU regions by default on Azure Frankfurt, parent moved from Delaware to a Berlin SE in 2026.
Langdock offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Sovereign AI.
Assessment notes
Langdock is an enterprise AI workspace operated by Langdock GmbH (HRB 254499 B, Amtsgericht Charlottenburg, registered July 2023), and its paperwork is public and unusually complete: a bilingual DPA (version 2.1, September 2026) readable without a login and incorporated into the terms, a sub-processor register with 14-day change notices in a trust centre, a terms appendix that summarises the contract with each model provider (EU data residency and zero data retention agreed with Microsoft Azure, OpenAI, Google Cloud, AWS Bedrock and Mistral), and an ISO/IEC 27001 certificate in Langdock's own name, plus a SOC 2 Type II report on request. Ownership is European: after a 2026 reverse flip, the GmbH has been wholly owned since 11 August 2026 by Langdock Holding SE (HRB 283041 B, Berlin), in which the three founders' holding companies hold about 61% of the shares and, through ten-vote shares, about 94% of the votes, while funds of General Catalyst and Y Combinator hold roughly 17% combined and have no seat on the founder-only administrative board. Until then the GmbH belonged to Langdock Inc., a Delaware corporation. The score is held at 3 by the infrastructure: the application, database and file storage run on Microsoft Azure in Frankfurt, prompts are processed by Microsoft, Amazon, Google or OpenAI in EU regions, and six of the seven sub-processors are US-owned groups (Mistral AI is the only EU one), so CLOUD Act exposure is material even though no US parent remains. Models marked for "global deployment" can process prompts outside the EU, including the US, but only after an administrator enables them. Own-cloud and on-premises deployment, which would take Langdock's Azure tenancy out of the data path, starts at 5,000 seats.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Langdock
Langdock is a model-agnostic AI workspace for companies, built in Berlin by Langdock GmbH, which Lennard Schmidt, Tobias Kemkes and Jonas Beisswenger founded in 2023. Employees use one chat interface for models from OpenAI, Anthropic, Google, Mistral, Meta and DeepSeek, build agents on their own knowledge bases, connect integrations and MCP servers and automate processes in a workflow builder; developers get an API that accepts the OpenAI, Anthropic, Google and Mistral request formats. SSO, SAML and SCIM are included. A Standard seat costs €23.20 per user and month billed annually with model usage included, or €29 billed monthly (excluding VAT, first 50 seats). With the customer's own provider keys, the platform alone costs €17.60 (annual billing) or €22 (monthly). Dedicated hosting starts at 2,000 seats, own-cloud or on-premises deployment at 5,000.
The DPA (version 2.1, September 2026), the sub-processor register and an ISO/IEC 27001 certificate in Langdock's own name are public; a SOC 2 Type II report is available on request. Application, database and files run on Microsoft Azure in Frankfurt with the EU Data Boundary enabled, confirmed at audit by the storage endpoints and outbound IP, behind Cloudflare. Prompts go to the model the user picks: OpenAI models through Azure or OpenAI's Irish entity, Anthropic through AWS Bedrock or Google Cloud, Gemini through Google Cloud and Mistral through its EU endpoints, each pinned to EU regions with zero data retention agreed. Only EU-hosted models are available by default. Administrators can enable models marked with a globe icon, whose inference may run elsewhere including the US, while stored data stays in Germany. Mistral AI is the only EU-owned company among the seven sub-processors.
Until August 2026 the GmbH was wholly owned by Langdock Inc., a Delaware corporation set up for Y Combinator. In a reverse flip the shareholders contributed those shares to Langdock Holding SE in Berlin, which has held the GmbH since 11 August 2026. The founders hold about three fifths of the shares and, through ten-vote shares, more than nine tenths of the votes; funds of General Catalyst and Y Combinator hold about 17 percent, and the SE's board consists of the three founders. Ownership is therefore recorded as EU-owned. The company cited customers' CLOUD Act concerns; the move removed the US parent. The data path is unchanged: chats and files sit on Microsoft Azure and prompts are processed by US-owned providers in their EU regions, so CLOUD Act exposure is recorded as Material. Langdock has announced a data centre of its own in Germany. Until it runs production workloads, buyers who must keep US-owned providers out of the data path should consider on-premises deployment with self-hosted open models via OpenAI-compatible endpoints.
Sub-processor map · not disclosed
Frameworks & certifications
Held by the provider that operates the hosting, not by Langdock itself.
Capability matrix
Table 1Capabilities of Langdock
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €7.49/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
| Aleph Alpha Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
| Black Forest Labs Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
| DeepL Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€7.49/mo |