Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.
- FROM
- —
- CLOUD ACT
- MATERIAL
A single roll-up of ownership and CLOUD Act exposure.
Sublime Traders SAS (SASU, SIREN 917 821 340, 122 rue Amelot, 75011 Paris, France)
Paris-built CRM with custom objects and an AI chat (Pilot) as its main interface; EU-owned, but runs on Vercel and Supabase (AWS Dublin) with US AI models.
Ostrata, in the CRM category, offers EU hosting with Ireland as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.
Ostrata is built and sold by Sublime Traders SAS (single-shareholder SASU, SIREN 917 821 340, Paris), with no outside funding on record, so ownership is EU. Every layer that holds or processes CRM data is US-owned, though: the application runs on Vercel (serverless functions observed in Paris, cdg1), the Postgres database and authentication run on Supabase, hosted on AWS eu-west-1 in Dublin, and Pilot, the AI chat that is the product's primary interface, sends user messages and the workspace context they need through Vercel AI Gateway to OpenAI, Anthropic, Google Gemini or Alibaba Cloud Model Studio (Qwen), with Google Drive file text embedded directly by OpenAI. Data at rest stays in the EU, but on US-owned infrastructure and with US model providers in the core path, which is material CLOUD Act exposure. The DPA is available only on request, which caps the score at 3; it drops to 2 because no sub-processor list is published (the privacy policy names the AI route but not the hosting, database, authentication or payment providers, and leaves the model list open with 'comparable model providers available through the gateway'), the processing region of the Alibaba route is not stated, and there is no third-party certification.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Where ultimate control over the operating company sits.
Ostrata is a CRM from Paris built around a chat interface. Members spend most of their time in Operations, where they type requests in English or French to Pilot, the built-in AI assistant, which searches, creates and updates records, drafts emails and builds Live views (AI-generated mini-apps over CRM data). Admins define their own objects and fields in Setup, so the schema is not fixed to contacts and deals. Around that sit dashboards, web forms for lead capture, AI fields that write a summary or a 0 to 100 score per record, Gmail, Google Calendar, Google Drive and Telegram integrations, company enrichment from the French SIREN, INSEE and BODACC registries, a REST API, outbound and inbound webhooks, and an MCP server for Claude, Cursor and similar tools. There is no native mobile app, no SAML single sign-on, no quoting or invoicing and no campaign sender.
The contracting entity is Sublime Traders SAS, a single-shareholder SASU registered in Paris in July 2022 with its président Andrei-Septimiu Stanciulescu as sole officer and no outside funding on record, which is why ownership is recorded as EU-owned. The infrastructure is a different matter. The application and its server functions run on Vercel (observed in the Paris region), and the database and authentication run on Supabase, whose project for Ostrata sits on AWS eu-west-1 in Dublin, Ireland. All three companies are US-owned. Pilot requests, with the workspace context needed to answer them, go through Vercel AI Gateway to paid APIs from OpenAI, Anthropic and Google Gemini, and to Alibaba Cloud Model Studio for Qwen models; Drive file text is embedded by OpenAI directly when a workspace connects Google Drive. Because chat with Pilot is the main way to work in the product, CRM content reaches those model providers in normal use rather than as an optional add-on. US-owned hosting plus US model providers in the core data path is why CLOUD Act exposure is Material.
Disclosure is thin for a product in that position. The privacy policy names the AI providers but not the hosting, database, authentication or payment providers, and its model list ends with "comparable model providers available through the gateway". There is no sub-processor page, the processing region of the Alibaba route is not stated, and the DPA is sent on request from account@ostrata.io. Pricing is one plan in EUR at €17.10 per seat per month on yearly billing (19 EUR monthly), with a 30-day trial for one seat that needs a card. Best fit: French SMEs and freelancers who want a flexible, chat-driven CRM and are comfortable with US AI processing. Buyers who need CRM data kept away from US providers should look at centralstationCRM or combit CRM in this category.
Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated.
Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated.
Pilot inference via Vercel AI Gateway, plus direct embeddings of Google Drive file text when a workspace connects Drive. Named in the privacy policy; processing region not stated.
Seat subscriptions, checkout and VAT calculation (Stripe Tax). From terms section 9 and the help centre; not named in the privacy policy.
Postgres database holding all workspace and CRM data, plus authentication, on AWS eu-west-1 (Dublin). From the public JS bundle and DNS of the database host; not named by the vendor.
App hosting and serverless functions (region cdg1, Paris, from headers), plus Vercel AI Gateway, which receives every Pilot request with workspace context and forwards it to the model providers (named in privacy policy; gateway region not stated).
Pilot inference for Qwen models via Vercel AI Gateway. Named in the privacy policy. Region not stated by Ostrata or Vercel; SG recorded as the Model Studio international default, unconfirmed.
Optional: carries Pilot chats and record cards when an admin enables the Telegram bot and members link accounts. From the help centre; not named in the privacy policy.
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Anthropic | United States | Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated. | US |
| Google (Gemini API) | United States | Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated. | US |
| OpenAI | United States | Pilot inference via Vercel AI Gateway, plus direct embeddings of Google Drive file text when a workspace connects Drive. Named in the privacy policy; processing region not stated. | US |
| Stripe | United States | Seat subscriptions, checkout and VAT calculation (Stripe Tax). From terms section 9 and the help centre; not named in the privacy policy. | US |
| Supabase Inc. | Ireland | Postgres database holding all workspace and CRM data, plus authentication, on AWS eu-west-1 (Dublin). From the public JS bundle and DNS of the database host; not named by the vendor. | US |
| Vercel Inc. | France | App hosting and serverless functions (region cdg1, Paris, from headers), plus Vercel AI Gateway, which receives every Pilot request with workspace context and forwards it to the model providers (named in privacy policy; gateway region not stated). | US |
| Alibaba Cloud (Model Studio / Qwen) | Singapore | Pilot inference for Qwen models via Vercel AI Gateway. Named in the privacy policy. Region not stated by Ostrata or Vercel; SG recorded as the Model Studio international default, unconfirmed. | non-US |
| Telegram | United Arab Emirates | Optional: carries Pilot chats and record cards when an admin enables the Telegram bot and members link accounts. From the help centre; not named in the privacy policy. | non-US |
Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.
Cologne-based German SMB CRM (42he GmbH), all-German hosting on Hetzner + Core-Backbone + Telekom, free tier for 3 users.
Konstanz-based German CRM (combit Software, since 1989), founder-owned, on-prem + cloud, German Mittelstand vendor.