Lemonway
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-based ACPR-licensed pan-European marketplace payment institution (since 2007), €10.5B of flows handled in 2024, 1,200 platform clients.
Lemonway is a European service hosted in France, with at most minor, transient US exposure under the CLOUD Act. It is listed under Payments.
Assessment notes
Lemonway (Paris, founded 2007) is an ACPR-licensed Payment Institution (approval number 16568, licensed since 2012) with European passporting in 29 countries, reporting €10.5B of flows handled in 2024 across 19.1M transactions for 1,200 marketplace and platform clients in 15+ countries (SNCF Connect, Decathlon, Eiffage, ArcelorMittal); the cap table is fully European (Breega FR + Speedinvest AT + Toscafund UK) and the partnership with Société Générale for B2B marketplaces adds further EU banking anchoring: ownership_signal: eu_owned, cloud_act_exposure: minor; however Lemonway does not publish a standalone DPA (data-processing obligations are embedded within the general T&Cs) meaning EU buyers cannot self-serve the DPA artefact, and the hosting provider is not publicly disclosed.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Lemonway
Lemonway is a Paris-headquartered marketplace-payments specialist founded in 2007 by Sébastien Burlet and Damien Guermonprez. Operating as a French ACPR-licensed Payment Institution (approval number 16568, since 2012) with European passporting across 29 countries, Lemonway directly competes with Mangopay and Stripe Connect for marketplace-payment infrastructure. The company reports €10.5B of flows handled in 2024 across 19.1M transactions, 1.5M payment accounts, and 1,200 marketplace and platform clients across 15+ countries including SNCF Connect & Tech, Decathlon, Eiffage, and ArcelorMittal: a customer list that skews heavily toward large French enterprises and B2B marketplaces. Offices in Paris (HQ) and Hamburg with approximately 150 staff.
For an EU-sovereignty audit Lemonway is the cleanest marketplace-payments listing alongside its competitor Mangopay. The cap table is entirely European: €50M total raised, which Lemonway's own about page splits as a €10M Series A led by Breega Capital (Paris VC) with Speedinvest (Vienna VC) and a €40M Series B from Toscafund (UK asset manager), with no US private-equity or venture-capital involvement on record. The ACPR licence anchors the legal jurisdiction firmly in France with all the supervisory teeth of European banking law. A 2024 partnership with Société Générale to support large-corporate B2B marketplaces in Europe adds an EU-bank co-distribution channel. PCI-DSS certified; 99.9%+ API availability. The June 2025 acquisition of PayGreen's operations extended Lemonway from pure marketplace payments into broader e-commerce, and the PayGreen book has since taken it into restaurant, tourism and leisure e-commerce.
Pricing is enterprise / volume-negotiated and marketplace-specific; no public per-transaction tier applies, and starts_from_eur is left null. Best fit: EU marketplaces and B2B platforms requiring ACPR-licensed multi-party payment infrastructure with full EU jurisdiction and no US PE/VC involvement in the ownership chain: particularly French and DACH marketplaces. Two transparency gaps remain: the underlying hosting provider is not publicly disclosed on accessible pages (vendor outreach can confirm whether it's OVHcloud, Scaleway, or similar French infrastructure, typical for ACPR-licensed PIs), and the DPA is embedded in the general T&Cs rather than published as a standalone document.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Lemonway
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.lemonway.com/en…
Alternatives in this category
-
NetherlandsEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
NorwayEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Adyen
Netherlands
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Alma
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Dintero
Norway
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |