Sage Accounting
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
UK-public accounting incumbent (FTSE 100, Newcastle, est. 1981); Sage Accounting cloud product for SMB.
Sage Accounting offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Accounting.
Assessment notes
Sage Group plc (Newcastle UK, founded 1981, FTSE 100, LSE: SGE) is one of Europe's largest software companies: UK-public, no US parent, no US PE, ISO 27001 certified, and UK-post-Brexit places it in ownership_signal: other rather than eu_owned. The clean ownership position does not carry over to the processor chain, which is what CLOUD Act exposure actually measures. Sage's own published sub-processor list puts Sage Business Cloud Accounting on Amazon Web Services (a US-owned hyperscaler holding customer data at rest) alongside Twilio, Postmark and Yodlee, the US bank-data aggregator that powers its bank feeds. Core accounting and banking data therefore flows through US-owned services, which is material under the rubric and a 3/5. Sage also publishes no hosting region for the product, and both its pricing page and its DPA sit behind a site-wide bot block that defeats self-serve verification.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Sage Accounting
Sage Group plc (Newcastle upon Tyne, founded 1981) is one of the largest software companies in Europe: listed on the London Stock Exchange (LSE: SGE, FTSE 100), no US parent, no US-PE control. The SMB cloud product line Sage Accounting (also Sage Business Cloud Accounting, formerly Sage One) targets sole traders through small businesses with pricing from ~£12/mo (~€14). ISO 27001 certified. The wider Sage portfolio includes Sage HR (sage.hr, see separate listing), Sage Intacct (mid-market), Sage 50, and Sage 200. Post-Brexit UK jurisdiction places it in ownership_signal: other per the directory's rubric. The ownership chain is clean of US capital, but the processor chain is not: Sage's own published sub-processor list puts Sage Business Cloud Accounting on Amazon Web Services alongside Twilio, Postmark and Yodlee, the US bank-data aggregator behind its bank feeds, so core accounting and banking data flows through US-owned services and exposure is recorded as Material.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Sage Accounting
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Norway · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Norway · €20/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €7.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Conta
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€9/mo |
Fiken
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€20/mo |
Lexware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€7.90/mo |