Make
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Oslo-based Norwegian email and SMS marketing platform storing customer data on Norwegian servers, with an official 'Made in Norway' label.
Make is a European service hosted in Norway, with at most minor, transient US exposure under the CLOUD Act. It is listed under Email marketing.
Assessment notes
Norwegian AS (Make AS, Oslo; org NO 993555002, founded 2009) that stores customer subscriber and email data on Norwegian servers and markets an official 'Made in Norway' label. Norway is in the EEA so GDPR applies directly and there is no EU↔NO transfer problem. But the privacy policy names US-owned operational sub-processors (Intercom for support/chat, Google Workspace for internal documents) alongside EU ones (Pipedrive EE, 24Seven Office NO, Posten Bring NO, StatusCake UK); these touch support and internal ops rather than subscriber data at rest, holding CLOUD Act exposure to the minor tier. No public Data Processing Agreement (provided only inside the contracting flow) and no public security certification (ISO 27001 etc.) cap the editorial score at 3/5 despite a clean Norwegian-hosting and Norwegian-ownership story.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: No
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Make
Make is a Norwegian email-marketing, SMS-marketing, and automation platform operated by Make AS (Sandakerveien 116, 0484 Oslo; org. NO 993555002), founded on 4 February 2009 and a newsletter partner to Norwegian businesses ever since. It serves around 1,700 private and public-sector customers (including names like NRK) and positions its Norwegian identity as its core differentiator: personal Norwegian-language support, local presence, and the official "Made in Norway" label. Note this is the Norwegian ESP Make AS, not the US automation tool make.com (Celonis).
For an EU/EEA-sovereignty audit Make presents a clean nominal hosting story: the company states that all customer personal data is stored and transmitted from Norwegian servers and IP addresses, fully within EEA jurisdiction where GDPR applies directly. The named sub-processors in the privacy statement are a mix: Pipedrive (EE) for CRM, 24Seven Office (NO) for accounting, Posten/Bring (NO) for digital signing, StatusCake (UK) for monitoring, and two US-owned tools, Intercom (support/chat) and Google Workspace (internal document management). These US tools are scoped to support and internal operations rather than to subscriber data at rest, which keeps CLOUD Act exposure in the minor tier. The weak points for procurement-grade buyers are transparency: there is no publicly downloadable DPA (databehandleravtale) and no publicly attested security certification such as ISO 27001; the "Made in Norway" mark is a country-of-origin trust label, not an information-security audit.
Pricing is in NOK and aimed at the Norwegian SMB/enterprise market: Standard at 850 NOK/month (~€73, 1,000 contacts, 4,000 emails, 3 users, one training hour), Pro at 1,150 NOK/month (~€98, 10,000 emails, 10 users, unlimited segmentation/automation), and a custom Enterprise tier; SMS is billed separately, plans are billed annually in advance, and there is a 30-day demo but no permanent free tier. Distribution is via a reseller partner programme rather than a public affiliate scheme with a tracking cookie. Best fit: Norwegian and EEA buyers who want a Norway-resident newsletter and SMS tool with Norwegian-language support and an unambiguous "data stays in Norway" answer, and who don't require a self-serve DPA, ISO 27001 evidence, or English product localization. Buyers needing a public DPA or ISO 27001 should look at rapidmail, CleverReach, or Maileon in this category.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Make
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
OpenSub-processors listmake.as/personvern…
Alternatives in this category
-
France · €8/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €15/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
United Kingdom · €0/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Brevo
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€8/mo |
CleverReach
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€15/mo |
EmailOctopus
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€0/mo |