Liberapay
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Association Liberapay (French non-profit association, RNA W144000981), 7 lieu dit La Croix Rouge, 29310 Querrien, France
French non-profit association running an open-source recurring-donation platform: 0% platform cut, but hosted on AWS Ireland with Stripe and PayPal as the only payment routes.
Liberapay offers EU hosting in Ireland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Membership platforms.
Assessment notes
Liberapay is a French non-profit association (RNA W144000981) running an open-source recurring-donation platform, and it is the only entry in this category that charges creators nothing at all, neither a cut nor a plan fee: the service is funded by donations to its own Liberapay account. Governance is as clean as it gets here, with no company, no investors and an AGPL codebase. The infrastructure is the opposite. Liberapay's own legal page states that the site is hosted on AWS (Ireland), naming Amazon Web Services, Inc. in Seattle and Amazon Data Services Ireland Ltd in Dublin, and the site is fronted by Cloudflare. Payments run exclusively through Stripe and PayPal, both US-incorporated, which the project documents openly on a dedicated payment-processors page, an unusually candid disclosure and exactly why the shortcoming is visible: Material. As a volunteer non-profit it offers no commercial DPA, which caps the score at 3/5 independently of the hosting.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 4 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Liberapay
Liberapay is a recurring-donation platform run as a French non-profit association, legally founded in 2015 and registered under RNA W144000981 with a postal address in Querrien, Brittany. It exists to let people fund the work of others continuously rather than in one-off bursts, and its centre of gravity is free software and open knowledge: maintainers, translators, documentation writers and similar. The platform itself is open source under AGPL, the association is run by volunteers, and the whole thing is deliberately small.
Its defining property is that Liberapay takes no cut of donations at all. The association is funded by donations to its own Liberapay account, the same mechanism it offers everyone else, so donors pay only the payment processor's fees. There are no membership tiers, no gated posts, no shop and no rewards: it is a pledge pipe, not a publishing platform, which is why several of the capability rows below are empty. The interface has been community-translated into around thirty languages, and the API and codebase are public.
For a sovereignty audit Liberapay is a study in the gap between governance and infrastructure. The governance is as European as this category gets: a French association, no investors, no company, no acquisition risk. The infrastructure is not. Liberapay's own legal page states that the site is hosted on AWS (Ireland) and names both Amazon Web Services, Inc. in Seattle and Amazon Data Services Ireland Ltd in Dublin, so records sit in Ireland under an American operator, and Cloudflare sits in front of the site. Payments go through Stripe and PayPal only, both US-incorporated, a fact the project sets out plainly on its own payment-processors page rather than hiding: Material. That page is an unusually candid piece of disclosure and also the clearest illustration of the category's central problem. As a volunteer association Liberapay signs no commercial DPA. Best fit: open-source and free-knowledge projects for whom a zero-commission, non-profit, auditable platform outweighs the American plumbing underneath.
Sub-processor map · 4
-
Amazon Data Services Ireland Ltd (AWS) USIreland
Website and application hosting in Dublin; the legal page names Amazon Web Services, Inc. (Seattle) alongside the Irish entity
-
Cloudflare, Inc. USUnited States
CDN and DDoS protection in front of liberapay.com (named in the privacy page as setting cookies on visitors)
-
PayPal (Europe) S.à r.l. et Cie, S.C.A. USLuxembourg
Donation processing for donors and creators outside Stripe's supported countries
-
Stripe, Inc. USUnited States
Donation processing, SEPA direct debits, automatic renewals and creator payouts
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Data Services Ireland Ltd (AWS) | Ireland | Website and application hosting in Dublin; the legal page names Amazon Web Services, Inc. (Seattle) alongside the Irish entity | US |
| Cloudflare, Inc. | United States | CDN and DDoS protection in front of liberapay.com (named in the privacy page as setting cookies on visitors) | US |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Luxembourg | Donation processing for donors and creators outside Stripe's supported countries | US |
| Stripe, Inc. | United States | Donation processing, SEPA direct debits, automatic renewals and creator payouts | US |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Liberapay
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
CzechiaUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
United Kingdom · $12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
PolandEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Herohero
Czechia
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Ko-fi
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
$12/mo |
Patronite
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |