MeisterTask
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German Kanban + tasks + docs (MeisterLabs, Munich-area, since 2006), hosted on Google Cloud in Frankfurt, ISO 27001, 10k+ companies including Allianz / LBBW.
MeisterTask offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Project management.
Assessment notes
MeisterTask is operated by MeisterLabs GmbH (Vaterstetten near Munich, HRB 161267 Munich; founded 2006 by Michael Hollauf and Till Vollmer; MindMeister launched 2009, MeisterTask 2015), EU-owned, with Nordic growth investor Verdane as its only outside funder since 2021. The company holds ISO/IEC 27001 in its own name and publishes its DPA without a login. Its own DPA (May 2025) names the hosting: Annex 3 lists Google Cloud EMEA Limited for product hosting in Frankfurt and MongoDB Limited for certain application databases (EU), alongside MeisterLabs Software GmbH in Vienna; Annex 2 adds Cloudflare for DDoS protection. All three are US-owned, so customer data is EU-hosted but sits with US-parented providers: material CLOUD Act exposure, score 3 under the rubric (EU-incorporated and EU-hosted, three US-owned providers in the data path).
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About MeisterTask
MeisterTask is the Kanban-and-task-management platform built by MeisterLabs GmbH, the long-running German productivity-software company founded in 2006 by Michael Hollauf and Till Vollmer. The MeisterLabs portfolio began with MindMeister (the visual mind-mapping product launched in 2009) and expanded to MeisterTask in 2015, followed by MeisterNote and MeisterAI; the company operates from the Munich area (Vaterstetten) with additional offices in Vienna and Seattle. MeisterTask serves more than 10,000 companies and ranks 4.6/5 on G2; notable reference customers include LBBW, Allianz, Ritter Sport, Fischer, and Sana Regio Kliniken, a customer mix that skews to regulated German enterprises (banking, manufacturing, healthcare).
For an EU-sovereignty audit MeisterTask splits into two answers. Ownership and paperwork are clean: MeisterLabs GmbH is EU-owned (the founders remain, and the one outside investor since 2021 is the Nordic growth fund Verdane), holds ISO/IEC 27001 in its own name, and publishes its DPA and sub-processor annex without a login. Infrastructure is where the exposure sits. The public site says "hosted in Germany" without naming a provider, but the DPA (May 2025) does: product hosting runs on Google Cloud in Frankfurt, certain application databases on MongoDB (EU), and Cloudflare handles DDoS protection. The data stays in the EU, yet all three providers have US parents, which is why the listing carries material CLOUD Act exposure rather than none. The Seattle office is a sales operation rather than a customer-data jurisdiction.
Pricing in EUR: Free tier covers up to 3 projects (unlimited tasks), up to 5 notes, 20 MeisterAI prompts/month, 5 Content Manager seats, and unlimited team members; Pro €12.50/user/month (annual billing) adds unlimited projects/notes, 75 AI prompts, external sharing, integrations, private projects, recurring tasks; Business €24/user/month adds timeline view, subtasks, custom reports, role-based permissions; Enterprise tier with SSO. Best fit: German and DACH SMBs and mid-market teams that want a Kanban / project-management product with German hosting, ISO 27001 evidence, and a long-running EU vendor without the data-residency negotiations required for Asana / Monday / Trello.
Sub-processor map · 4
-
Cloudflare USUnited States
DDoS protection and reverse proxy in front of all Meister domains (named in DPA Annex 2 and on the security page, which says EU servers are used). Processes request traffic in transit.
-
Google Cloud EMEA Limited USGermany
Product hosting in the cloud region Europe; processing location Frankfurt am Main. Holds MeisterTask customer data at rest. Always engaged.
-
MongoDB Limited USIreland
Hosting of certain application databases; DPA states the processing location only as 'EU' (contracting entity in Dublin). Always engaged.
-
MeisterLabs Software GmbH EUAustria
Affiliated company in Vienna: product maintenance and product development.
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Cloudflare | United States | DDoS protection and reverse proxy in front of all Meister domains (named in DPA Annex 2 and on the security page, which says EU servers are used). Processes request traffic in transit. | US |
| Google Cloud EMEA Limited | Germany | Product hosting in the cloud region Europe; processing location Frankfurt am Main. Holds MeisterTask customer data at rest. Always engaged. | US |
| MongoDB Limited | Ireland | Hosting of certain application databases; DPA states the processing location only as 'EU' (contracting entity in Dublin). Always engaged. | US |
| MeisterLabs Software GmbH | Austria | Affiliated company in Vienna: product maintenance and product development. | EU |
Source: the vendor’s published sub-processor list, read 2 Oct 2026.
Frameworks & certifications
Held by the provider that operates the hosting, not by MeisterTask itself.
Capability matrix
Table 2Capabilities of MeisterTask
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Netherlands · $10/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Germany · €19.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: No -
-
Germany · €99/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Baserow
Netherlands
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
$10/mo |
factro
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: No
|
€19.99/mo |
HansaChat
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€99/mo |