Skip to content
CLOUD Act flagged on every listing
EU VETTED

Ostrata

VERIFIED

Sublime Traders SAS (SASU, SIREN 917 821 340, 122 rue Amelot, 75011 Paris, France)

CRM · France
Founded 2022 · ostrata.io ↗

Paris-built CRM with custom objects and an AI chat (Pilot) as its main interface; EU-owned, but runs on Vercel and Supabase (AWS Dublin) with US AI models.

In short

Ostrata, in the CRM category, offers EU hosting with Ireland as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Ostrata is built and sold by Sublime Traders SAS (single-shareholder SASU, SIREN 917 821 340, Paris), with no outside funding on record, so ownership is EU. Every layer that holds or processes CRM data is US-owned, though: the application runs on Vercel (serverless functions observed in Paris, cdg1), the Postgres database and authentication run on Supabase, hosted on AWS eu-west-1 in Dublin, and Pilot, the AI chat that is the product's primary interface, sends user messages and the workspace context they need through Vercel AI Gateway to OpenAI, Anthropic, Google Gemini or Alibaba Cloud Model Studio (Qwen), with Google Drive file text embedded directly by OpenAI. Data at rest stays in the EU, but on US-owned infrastructure and with US model providers in the core path, which is material CLOUD Act exposure. The DPA is available only on request, which caps the score at 3; it drops to 2 because no sub-processor list is published (the privacy policy names the AI route but not the hosting, database, authentication or payment providers, and leaves the model list open with 'comparable model providers available through the gateway'), the processing region of the Alibaba route is not stated, and there is no third-party certification.

CLOUD ACT
Ownership
Sub-procs
8 · 6 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
Jump to

About Ostrata

Ostrata is a CRM from Paris built around a chat interface. Members spend most of their time in Operations, where they type requests in English or French to Pilot, the built-in AI assistant, which searches, creates and updates records, drafts emails and builds Live views (AI-generated mini-apps over CRM data). Admins define their own objects and fields in Setup, so the schema is not fixed to contacts and deals. Around that sit dashboards, web forms for lead capture, AI fields that write a summary or a 0 to 100 score per record, Gmail, Google Calendar, Google Drive and Telegram integrations, company enrichment from the French SIREN, INSEE and BODACC registries, a REST API, outbound and inbound webhooks, and an MCP server for Claude, Cursor and similar tools. There is no native mobile app, no SAML single sign-on, no quoting or invoicing and no campaign sender.

The contracting entity is Sublime Traders SAS, a single-shareholder SASU registered in Paris in July 2022 with its président Andrei-Septimiu Stanciulescu as sole officer and no outside funding on record, which is why ownership is recorded as EU-owned. The infrastructure is a different matter. The application and its server functions run on Vercel (observed in the Paris region), and the database and authentication run on Supabase, whose project for Ostrata sits on AWS eu-west-1 in Dublin, Ireland. All three companies are US-owned. Pilot requests, with the workspace context needed to answer them, go through Vercel AI Gateway to paid APIs from OpenAI, Anthropic and Google Gemini, and to Alibaba Cloud Model Studio for Qwen models; Drive file text is embedded by OpenAI directly when a workspace connects Google Drive. Because chat with Pilot is the main way to work in the product, CRM content reaches those model providers in normal use rather than as an optional add-on. US-owned hosting plus US model providers in the core data path is why CLOUD Act exposure is Material.

Disclosure is thin for a product in that position. The privacy policy names the AI providers but not the hosting, database, authentication or payment providers, and its model list ends with "comparable model providers available through the gateway". There is no sub-processor page, the processing region of the Alibaba route is not stated, and the DPA is sent on request from account@ostrata.io. Pricing is one plan in EUR at €17.10 per seat per month on yearly billing (19 EUR monthly), with a 30-day trial for one seat that needs a card. Best fit: French SMEs and freelancers who want a flexible, chat-driven CRM and are comfortable with US AI processing. Buyers who need CRM data kept away from US providers should look at centralstationCRM or combit CRM in this category.

Sub-processor map · 8

  • Anthropic US
    United States

    Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated.

  • Google (Gemini API) US
    United States

    Pilot inference via Vercel AI Gateway. Named in the privacy policy; processing region not stated.

  • OpenAI US
    United States

    Pilot inference via Vercel AI Gateway, plus direct embeddings of Google Drive file text when a workspace connects Drive. Named in the privacy policy; processing region not stated.

  • Stripe US
    United States

    Seat subscriptions, checkout and VAT calculation (Stripe Tax). From terms section 9 and the help centre; not named in the privacy policy.

  • Supabase Inc. US
    Ireland

    Postgres database holding all workspace and CRM data, plus authentication, on AWS eu-west-1 (Dublin). From the public JS bundle and DNS of the database host; not named by the vendor.

  • Vercel Inc. US
    France

    App hosting and serverless functions (region cdg1, Paris, from headers), plus Vercel AI Gateway, which receives every Pilot request with workspace context and forwards it to the model providers (named in privacy policy; gateway region not stated).

  • Alibaba Cloud (Model Studio / Qwen) non-US
    Singapore

    Pilot inference for Qwen models via Vercel AI Gateway. Named in the privacy policy. Region not stated by Ostrata or Vercel; SG recorded as the Model Studio international default, unconfirmed.

  • Telegram non-US
    United Arab Emirates

    Optional: carries Pilot chats and record cards when an admin enables the Telegram bot and members link accounts. From the help centre; not named in the privacy policy.

6 of 8 sub-processors are US-incorporated. CLOUD Act exposure applies.

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-10-02).

Capability matrix

Sales pipeline Yes
Email sync Yes
Workflow automation No
Lead capture Yes
Email campaigns No
Quotes / invoicing No
Telephony No
Mobile app No
Free tier No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No

Pricing & tiers

PAID
from €17.10/mo
billed annually
View pricing page ↗

Public documents

DPA provided on request. The vendor provides its Data Processing Addendum to customers on request (by email or inside the account portal) rather than publishing it at a public URL, so it is not counted as a public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — on request
    on request
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    ostrata.io/terms…
    Open ↗

Alternatives in this category

Capsule CRM
United Kingdom · Founded 2009
EU-HOSTED

Manchester-based UK CRM (Zestia Ltd) with a free tier, public DPA, and AWS hosting; post-Brexit jurisdiction.

Public DPA Sub-processors Open source
FROM
—
CLOUD ACT
MATERIAL
centralstationCRM
Germany · Founded 2010
EU-SOVEREIGN

Cologne-based German SMB CRM (42he GmbH), all-German hosting on Hetzner + Core-Backbone + Telekom, free tier for 3 users.

Public DPA Sub-processors Open source
FROM
€24/mo
CLOUD ACT
NONE
combit CRM
Germany · Founded 1989
EU-SOVEREIGN

Konstanz-based German CRM (combit Software, since 1989), founder-owned, on-prem + cloud, German Mittelstand vendor.

Public DPA Sub-processors Open source
FROM
—
CLOUD ACT
NONE