PrestaShop
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
French open-source e-commerce with hosted SaaS option; owned since February 2026 by Poland's Warsaw-listed cyber_Folks.
PrestaShop offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under E-commerce.
Assessment notes
PrestaShop SA (Paris, 82 Avenue du Maine 75014, SIREN 497 916 635, founded 2007) left US-linked ownership on 18 February 2026, when Fortidia (ex-MBE Worldwide, an Oaktree Capital portfolio company) completed the sale of PrestaShop to Poland's cyber_Folks S.A. (Poznań, Warsaw Stock Exchange) for ~€53.7M. The whole chain is now EU: PrestaShop sits under cyber_Pixel, 79% cyber_Folks / 21% the Sylius founders, so the signal is eu_owned. Exposure stays material on the processor chain, not the cap table: the published Annex 2 puts PrestaShop Account and Metrics data on Google Cloud Platform, with Stripe Inc., Chargebee, HubSpot, Zendesk, Mixpanel, Segment and Cloudflare alongside. PrestaShop Hosted itself is hosted in France by Gandi SAS, and a full GDPR processor annex is publicly readable in the Hosted terms.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About PrestaShop
PrestaShop (Paris, est. 2007, 250,000+ live sites per their homepage) is the historical French Magento-equivalent: a free open-source e-commerce platform plus a paid PrestaShop Hosted offering for merchants who want managed hosting. Acquired by MBE Worldwide (Italy) in November 2021 and carried into Fortidia when MBE rebranded in 2024, PrestaShop left US-linked ownership on 18 February 2026, when Fortidia, an Oaktree Capital portfolio company, completed the sale of 100% of PrestaShop to Poland's cyber_Folks S.A. (Poznań, listed on the Warsaw Stock Exchange) for approximately €53.7M. PrestaShop now sits under cyber_Pixel alongside Sylius, 79% cyber_Folks and 21% the Sylius founders, so the ownership chain is EU-owned. What keeps CLOUD Act exposure at Material is the processor chain rather than the cap table: merchant shop data on PrestaShop Hosted sits with Gandi SAS in France, while the PrestaShop Account and Metrics layer runs on Google Cloud Platform, with Stripe Inc., Chargebee, HubSpot, Zendesk, Mixpanel, Segment and Cloudflare named alongside in the published processor annex. Best fit for merchants who want full platform control with French community + ecosystem; PrestaShop Hosted targets those who want the OSS power without the ops burden. Closer to mid-market than to SMB Shopify-Basic class.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of PrestaShop
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Germany · €600/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
PolandEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
Finland · €49/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Shopware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
€600/mo |
Sylius
Poland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
— |
MyCashflow
Finland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€49/mo |