PostHog
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
London-based open-source product analytics (PostHog, 2020, Y Combinator W20), US + EU Frankfurt cloud regions, MIT-licensed self-host.
PostHog offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Web analytics.
Assessment notes
PostHog (founded 2020 by James Hawkins and Tim Glaser in London, Y Combinator Winter 2020 batch) is the open-source product-analytics platform with managed-cloud regions in US (Virginia) and EU (Frankfurt) plus a self-host edition for full control, but the cap table is anchored by Y Combinator + Google Ventures (GV) across roughly $194M raised over seven rounds at a ~$1.4B valuation, with Peak XV Partners leading the most recent round and Stripe among the investors (plus angels Jason Warner / Solomon Hykes / David Cramer); UK post-Brexit jurisdiction + heavy US-VC funding → eu_hq_us_funded ownership with material CLOUD Act exposure for the managed-cloud product; the self-host path on EU infrastructure removes US-vendor exposure entirely.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 5 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About PostHog
PostHog is the open-source product-analytics platform founded in 2020 by James Hawkins and Tim Glaser in London, a Y Combinator Winter 2020 batch alumnus that built one of the most successful B2B-software launches on Hacker News since 2012. The product combines product analytics, session replay, feature flags, A/B testing, surveys, heatmaps, data warehouse, and customer data infrastructure into a single integrated platform; PostHog reports that 98% of customers use the free tier and operates entirely on usage-based pricing ($0.00005 per event for analytics, $0.005 per session-replay recording).
For an EU-sovereignty audit PostHog falls into the eu_hq_us_funded ownership tier. The HQ is London (UK post-Brexit jurisdiction with EU adequacy decision), but the cap table is heavily US-VC: Y Combinator (the canonical Silicon Valley accelerator) led the initial investment and GV (Google Ventures) led the $12M Series A; notable angels include Jason Warner (former GitHub CTO), Solomon Hykes (Docker founder), and David Cramer (Sentry founder). For the managed cloud, customers pick between US (Virginia) and EU (Frankfurt) hosting regions at signup; EU-region customers get GDPR-aligned residency, but the vendor's UK jurisdiction + US-VC ownership + AWS Frankfurt hosting (under PostHog's parent entity) keep the CLOUD Act flag at material under the strict-ownership stance.
The self-host edition is the procurement-grade path for EU buyers. PostHog publishes the full server-side stack as open source on GitHub under a source-available licence; running it on Hetzner / OVHcloud / Scaleway / STACKIT / private DC delivers full sovereignty by construction. Pricing: free tier (extremely generous, most customers stay on free); usage-based above for both cloud and self-host commercial deployments. Best fit: product teams that want an Amplitude / Mixpanel / Heap replacement with permissive self-host option and don't require an EU-incorporated vendor entity.
Sub-processor map · 5
-
Amazon Web Services, Inc. USGermany
Cloud storage of PostHog Cloud data
-
Cloudflare, Inc. USUnited States
Reverse proxy, CDN, security and traffic routing at global edge locations (added to the vendor list by the 2026-06-12 update; not region-pinned)
-
Modal Labs, Inc. USGermany
Serverless compute infrastructure for isolated code execution
-
PlanetScale, Inc. USGermany
Operations and performance monitoring of databases
-
Wiz, Inc. USGermany
Security vulnerability management and detection (listed as Germany, France)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services, Inc. | Germany | Cloud storage of PostHog Cloud data | US |
| Cloudflare, Inc. | United States | Reverse proxy, CDN, security and traffic routing at global edge locations (added to the vendor list by the 2026-06-12 update; not region-pinned) | US |
| Modal Labs, Inc. | Germany | Serverless compute infrastructure for isolated code execution | US |
| PlanetScale, Inc. | Germany | Operations and performance monitoring of databases | US |
| Wiz, Inc. | Germany | Security vulnerability management and detection (listed as Germany, France) | US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of PostHog
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
IrelandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: Yes -
-
New Zealand · €29/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $6/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
GoatCounter
Ireland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: Yes
|
— |
Matomo
New Zealand
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€29/mo |
Pirsch Analytics
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$6/mo |