Scalapay
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Milan-based Italian BNPL (Scalapay S.r.l., 2019): 3 interest-free installments, 1,500+ merchants, 9 EU markets; US-VC-funded at $700M Series B.
Scalapay offers EU hosting in Italy, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Payments.
Assessment notes
Scalapay S.r.l. (Milan, Italy; VAT IT 06891080480) is Italian-incorporated BNPL but raised US$155M Series B in September 2021 at a US$700M valuation with significant US-VC participation (Tiger Global, Woodson Capital, Willoughby Capital, Baleen Capital, all US funds); ownership_signal: eu_hq_us_funded, cloud_act_exposure: material (US-VC-weighted cap table); no public DPA or sub-processors list found at audit.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Scalapay
Scalapay is a Milan-based Italian BNPL (buy-now-pay-later) solution operated by Scalapay S.r.l. (Via Nervesa 21, 20139 Milano; VAT IT 06891080480; REA MI-2606390), founded in 2019. The core product splits purchases into three equal interest-free monthly installments for online and in-store retail, with a merchant-funded model where consumers pay no fees. The company serves 1,500+ merchants across Italy, France, Germany, Spain, Portugal, Austria, Belgium, the Netherlands, and Finland, covering fashion, electronics, home goods, sports, and travel verticals. Developer API is available at developers.scalapay.com, with integrations for major e-commerce platforms.
For an EU-sovereignty audit Scalapay is Italian-incorporated (a genuine Italian S.r.l. with Milan registration) but the cap table is heavily US-weighted. The company raised $48M in January 2021 (Series A led by Fasanara Capital, UK) and then $155M in September 2021 at a $700M post-money valuation in a Series B round that included Tiger Global Management (New York), Woodson Capital (US), Willoughby Capital (US), and Baleen Capital (US) as US-VC participants alongside European backers. Tiger Global's participation at lead or co-lead in the Series B places Scalapay firmly in the eu_hq_us_funded tier under the directory's ownership taxonomy. No public DPA, sub-processors list, or explicit EU data-residency commitment was found on accessible public pages at audit.
Pricing for merchants is commission-based per transaction (no monthly fee); consumer installment split is interest-free. Best fit: Italian and Southern European online retailers wanting a local-brand BNPL option with Italian-language support and a familiar domestic brand to consumers in Italy and adjacent markets.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Scalapay
Integration & access
Compliance & governance
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.scalapay.com/terms-and-conditions…
Alternatives in this category
-
NetherlandsEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
NorwayEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Adyen
Netherlands
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Alma
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Dintero
Norway
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |