Maileon
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German enterprise email marketing (XQueue GmbH, Offenbach, 2002), ISO 27001, EU data centres, 3k+ customers, 10 offices worldwide.
Maileon is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Email marketing.
Assessment notes
Maileon is operated by XQueue GmbH (Offenbach am Main, Germany; founded 2002, additional office in Freiburg), an enterprise-focused email-marketing and marketing-automation platform with ISO/IEC 27001 certification, GDPR / SSL / ECO / ISPA / CSA membership badges, EU (German) data centres, 3,000+ customers, 10 offices worldwide and over 20 years of operating history: EU-owned, EU-hosted (Germany), ISO 27001-certified, no CLOUD Act exposure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Maileon
Maileon is the enterprise email-marketing and marketing-automation platform operated by XQueue GmbH, a German company headquartered in Offenbach am Main with additional offices in Freiburg im Breisgau. Founded in 2002, XQueue has more than 20 years of operating history and serves 3,000+ corporate customers across 10 international offices, with multi-channel capability covering email, SMS, and triggered transactional flows. The platform targets enterprise B2B customers with high-deliverability requirements and explicit DACH / EU public-administration adjacency.
For an EU-sovereignty audit Maileon presents a strong signal profile. The operating entity is a German GmbH; customer email-data is stored in EU (German) data centres only; there is no CLOUD Act exposure. The company holds ISO/IEC 27001 certification plus GDPR alignment, ECO Award membership, ISPA (Internet Service Providers Austria) membership, and CSA (Certified Senders Alliance) trust-seal certification, the standard mid-tier German Mittelstand compliance stack for ESP procurement. Founder-led / privately-controlled with no external VC/PE involvement on record.
Pricing is enterprise / volume-negotiated; specific EUR tiers were not directly captured at audit. Best fit: enterprise B2B marketers in DACH and broader EU markets that want a German-rooted Mailchimp / SendGrid alternative with ISO 27001 + CSA evidence and a 20-year vendor track record. Procurement-grade buyers preferring SMB pricing tiers should look at MailerLite, CleverReach, or rapidmail in the same category.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Maileon
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |