Lexware
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Lexware Office: cloud accounting from Haufe Group (German family-owned), DSGVO + GoBD + TÜV, 400K+ DACH customers.
Lexware offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Accounting.
Assessment notes
Lexware (a brand of Haufe Group, family-owned German publishing + B2B-software group, Freiburg) is the cleanest ownership story in this category: Haufe is one of the few large German B2B-software groups still family-held, with no US PE or VC anywhere in the chain, so ownership_signal stays eu_owned. The processor chain is a different question, and the vendor's own AVV settles it: Lexware Office customer data is processed and stored in AWS Frankfurt (Amazon Web Services EMEA Sarl), a US-owned hyperscaler holding data at rest, and Anlage 1 additionally names Amazon Web Services Inc. (Seattle), UserVoice Inc. (San Francisco), The Rocket Science Group LLC / Mandrill (Atlanta) for all outbound application mail and Intercom Inc. (San Francisco) for web analytics and in-app communication. That is four US-incorporated sub-processors plus US-owned hosting at rest, which is material CLOUD Act exposure and a 3/5 under the rubric's "≥3 US sub-processors OR meaningful CLOUD Act exposure" line, notwithstanding the German ownership. The AVV itself is public and downloadable without login, so DPA accessibility is not what caps the score. DSGVO + GoBD-konform and TÜV-tested per marketing; no ISO 27001 or C5 attestation surfaced.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Lexware
Lexware is a brand of Haufe Group, one of the few large German B2B-software groups still family-owned (the Haufe family, Freiburg) and not subject to US-PE rollup pressure. The cloud product Lexware Office covers accounting, invoicing, payroll, and tax preparation for German freelancers and SMBs (Gründer, Unternehmer, Freiberufler), with 400,000+ customers across DACH. Data is hosted in Germany ("Made in Germany"), the product is DSGVO-konform, GoBD-konform, TÜV-tested, and pricing is promotional-led (50% Rabatt für 3 Monate at time of research). UI is German-only. For procurement buyers prioritising "no US ownership chain at all" the cap table is one of the cleanest in the catalogue, but the processor chain is not: the vendor's own AVV puts Lexware Office customer data in AWS Frankfurt and its Anlage 1 additionally names Amazon Web Services Inc., UserVoice, The Rocket Science Group / Mandrill for outbound application mail and Intercom for in-app communication, which is what puts CLOUD Act exposure at Material.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Lexware
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Norway · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Norway · €20/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · CHF 59.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Conta
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€9/mo |
Fiken
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€20/mo |
Navor
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
CHF 59.90/mo |