Lucca
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
French HR platform (Nantes / Paris, est. 2002); EU-owned, hosted on OVH in France and Germany; ISO 27001; 1M+ users incl. AXA, Deezer.
Lucca is a European service hosted in France, with at most minor, transient US exposure under the CLOUD Act. It is listed under HR & people.
Assessment notes
Lucca (Nantes / Paris FR, founded 2002, 20+ years operational) is EU-owned and FR-hosted with no US-VC ownership identified and 1M+ users including Deezer / AXA / Pernod Ricard, which keeps it the strongest ownership story in the HR set. Two findings cap the score at 3: the SecNumCloud claim could not be substantiated (Lucca publishes ISO 27001, Qualiopi and EcoVadis only, and does not appear on the ANSSI qualified list; the SecNumCloud qualification belongs to its host OVHcloud, not to Lucca), and the DPA is available only by contacting the DPO, which the directory's rubric caps at 3/5. The published processor chain is OVH (FR + DE) and Scaleway (FR + NL) for EU customers, with Microsoft Azure and GCP used for Swiss-client hosting and backups, hence cloud_act_exposure: minor rather than none.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 2 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Lucca
Lucca (Nantes and Paris, France, founded 2002) is a 20-year-old French HR-tech vendor with the strongest ownership story in this catalogue's HR set: ownership signal EU-owned, ISO 27001 (obtained July 2022) and Qualiopi. Lucca itself holds no SecNumCloud qualification and does not appear on the ANSSI qualified list; that qualification belongs to its host OVHcloud, which holds it for specific offers, so it is a host-level credential rather than a vendor-level one. The modular product covers payroll (Pagga), time and absences (Timmi), talent and performance (Poplee), compensation, and expenses (Cleemy). 1M+ users including enterprise clients like AXA, Deezer, and Pernod Ricard. No US VC ownership identified; mostly profitable-and-bootstrapped trajectory. The published chain puts applications and personal data on OVH in France and Germany with encrypted backups on Scaleway in France and the Netherlands, while Microsoft Azure hosts Swiss clients and GCP holds their backups, so an EU customer's data stays on European infrastructure and a Swiss customer's does not; CLOUD Act exposure is recorded as Minor on that basis. The DPA is obtained by contacting the DPO rather than published. For French and European procurement audiences this remains a strong pick, with those two caveats worth putting to the vendor.
Sub-processor map · 4
-
Google Cloud Platform USSwitzerland
Encrypted backups for Swiss clients only; not in the chain for EU customers
-
Microsoft Azure USSwitzerland
Hosting for Swiss clients only; not in the chain for EU customers
-
OVH EUFrance
Hosting of the applications and personal data (data centres in France and Germany)
-
Scaleway EUFrance
Encrypted backups only (data centres in France and the Netherlands)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Google Cloud Platform | Switzerland | Encrypted backups for Swiss clients only; not in the chain for EU customers | US |
| Microsoft Azure | Switzerland | Hosting for Swiss clients only; not in the chain for EU customers | US |
| OVH | France | Hosting of the applications and personal data (data centres in France and Germany) | EU |
| Scaleway | France | Encrypted backups only (data centres in France and the Netherlands) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Lucca
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
on requestData Processing Addendum (DPA)— on request
-
OpenSub-processors listwww.lucca.fr/rgpd…
Alternatives in this category
-
Spain · €7/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
-
GermanyEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Factorial
Spain
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€7/mo |
HiBob
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |
| Personio Germany | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
— |