Petje Af
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Petje.af B.V., Agro Business Park 22, 6708 PW Wageningen, Netherlands (KvK 76023745)
Dutch membership platform (Petje.af B.V.): 6% per transaction and the creator connects their own Mollie or Stripe account, the only route in this category to an all-EU payment rail.
Petje Af offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Membership platforms.
Assessment notes
Petje Af is a Dutch membership platform run by Petje.af B.V. in Wageningen, and it is the only entry in this category that lets a creator connect their own payment account with an EU-incorporated processor and keep the money out of the platform entirely. The creator links a Mollie (Netherlands) or Stripe account; Petje Af never holds funds and takes 6% per transaction on top of the processor's own fee. Choosing Mollie makes this the one configuration in the category where a creator can run memberships end to end on an EU-incorporated payment rail, and it also means the subscriber list and payment relationship stay with the creator rather than the platform. The platform layer is where the exposure sits: the front end is served by Vercel and the API resolves to AWS eu-central-1 in Frankfurt, both US-owned providers, with Cloudflare Turnstile for bot protection and Google Workspace on the corporate mail: Material. Data is in the EU, control of the infrastructure is not. There is no public DPA and no sub-processors list, which caps the score at 3/5 on its own.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Petje Af
Petje Af is a Dutch membership platform for independent content makers, operated by Petje.af B.V. from the Agro Business Park in Wageningen and registered with the Dutch chamber of commerce under KvK 76023745. Creators publish a page, offer recurring memberships and one-off donations, gate posts and media behind a membership, and get a helpdesk for their own supporters. The interface is Dutch only, and the creator base is almost entirely Dutch and Flemish.
Its structural decision is the interesting one. Petje Af describes it as no lock-in: the creator connects their own Mollie or Stripe account, and the platform never sits in the money flow. Petje Af charges 6% per transaction and the connected processor charges its own fee, but the payments, the customers and the payment data belong to the creator, who can leave at any point and take the billing relationship with them. Because Mollie is a Dutch, EU-incorporated processor and is already listed in our payments category, a creator who picks that option ends up with the only end-to-end EU money path available in this category. Pick Stripe instead and the same platform hands you a US rail, so here the sovereignty outcome is a configuration choice rather than a property of the vendor.
The platform layer does not match the payment layer. The site is served by Vercel and the API resolves into AWS eu-central-1 in Frankfurt, so the data sits in the EU while the infrastructure is operated by two US-owned companies; Cloudflare Turnstile handles bot protection, content is delivered from the Sanity CDN, and Google Workspace runs the corporate mail: Material. Petje Af publishes no data processing agreement and no sub-processors list, and its privacy policy refers to processors only as companies engaged for the performance of the contract, without naming any. The privacy policy also still shows an older Alphen aan den Rijn address while the company-details page shows Wageningen. Best fit: Dutch-speaking creators who want to own the payment relationship, and EU creators who specifically want their members' money settled by Mollie.
Sub-processor map · 7
-
Amazon Web Services (AWS eu-central-1) USUnited States
API and application hosting in Frankfurt, Germany
-
Cloudflare, Inc. (Turnstile) USUnited States
Bot protection on forms
-
Google Ireland Limited (Google Workspace) USIreland
Corporate and support email (from public MX and SPF records)
-
Stripe, Inc. USUnited States
Supporter payments and payouts, when the creator connects a Stripe account
-
Vercel Inc. USUnited States
Front-end hosting and edge delivery (observed regions arn1 Stockholm and fra1 Frankfurt)
-
Mollie B.V. EUNetherlands
Supporter payments and payouts, when the creator connects a Mollie account
-
Sanity AS EUNorway
Content delivery for editorial pages (cdn.sanity.io)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services (AWS eu-central-1) | United States | API and application hosting in Frankfurt, Germany | US |
| Cloudflare, Inc. (Turnstile) | United States | Bot protection on forms | US |
| Google Ireland Limited (Google Workspace) | Ireland | Corporate and support email (from public MX and SPF records) | US |
| Stripe, Inc. | United States | Supporter payments and payouts, when the creator connects a Stripe account | US |
| Vercel Inc. | United States | Front-end hosting and edge delivery (observed regions arn1 Stockholm and fra1 Frankfurt) | US |
| Mollie B.V. | Netherlands | Supporter payments and payouts, when the creator connects a Mollie account | EU |
| Sanity AS | Norway | Content delivery for editorial pages (cdn.sanity.io) | EU |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Petje Af
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicepetjeaf.com/content…
Alternatives in this category
-
CzechiaUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
United Kingdom · $12/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Herohero
Czechia
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Ko-fi
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
$12/mo |
Liberapay
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |