Prismic
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris headless CMS / page-builder (founded 2013); Slice Machine + Next.js / Nuxt / SvelteKit focus; from USD 10 per repository/mo, billed annually.
Prismic offers EU hosting in the United States, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Headless CMS.
Assessment notes
Prismic (Paris FR, founded 2013) is a developer-and-marketer-focused headless CMS with Slice Machine + visual page-builder differentiator; cap table is European-leaning (Notion Capital UK with US participation in earlier rounds) without identified US-PE majority, so ownership_signal: eu_owned; no explicit ISO 27001 / SOC 2 attestation on the marketing site. The DPA and the sub-processor list are both public PDFs linked from /legal/privacy, and reading them is what caps this listing: the DPA states that the Prismic Solution is hosted by Amazon Web Services and that 'the current location of the AWS data center infrastructure used in providing the Prismic Solution is the United States', with most of the remaining chain (Datadog, Sentry, Google, Intercom, SendGrid, Okta, Segment) US-incorporated too. EU company, US data at rest: material CLOUD Act exposure, not minor.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Prismic
Prismic (Paris, France, founded 2013) is a developer-and-marketer-focused headless CMS with a distinctive Slice Machine + Page Builder approach: slices are reusable content components that bridge dev / marketer workflows in a way most pure-API CMSs don't. Strong fit for Next.js, Nuxt, SvelteKit projects. Free tier available; paid tiers start at USD 10 per repository per month, paid annually (Starter), then Small at USD 25, Medium at USD 150 and Platinum at USD 675, with Enterprise on quote. Cap table is mostly European with US participation in earlier rounds (Notion Capital UK et al), no identified US-PE majority, placing Prismic in ownership_signal: eu_owned. No public ISO 27001 or SOC 2 attestation appears on the marketing site. The DPA and the sub-processor list, by contrast, are both public PDFs linked from /legal/privacy, and reading them is what a European buyer has to weigh: the DPA states that the Prismic Solution is hosted by Amazon Web Services and that "the current location of the AWS data center infrastructure used in providing the Prismic Solution is the United States", with most of the remaining chain (Datadog, Sentry, Google, Intercom, SendGrid, Okta, Segment) US-incorporated as well. A French operating company with its data at rest in the United States is why CLOUD Act exposure is recorded as Material.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Prismic
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Italy · €149/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: Yes -
-
Germany · $199/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
DatoCMS
Italy
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€149/mo |
| Enonic Norway | EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: Yes
|
— |
Hygraph
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
$199/mo |