sevdesk
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German DACH-focused SMB accounting / invoicing SaaS (Offenburg, est. 2013); now a Cegid Company under a Silver Lake-controlled French parent.
sevdesk offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Accounting.
Assessment notes
sevdesk (sevDesk GmbH, Offenburg DE, HRB 710506 Amtsgericht Freiburg, founded 2013) is DACH-focused SMB accounting with a free entry tier and paid plans from €11.90/mo, and it does publish a DPA, a TOM document and a named sub-processor list free of charge at sevdesk.de/datenschutz. Two things cap it at 3/5. First the ownership chain: sevdesk is a Cegid Company, and Cegid is majority-held by Silver Lake (US private equity, take-private 2016) alongside KKR (US PE, minority since 2021 at a €5.5B enterprise value) plus AltaOne and Oakley, so eu_hq_us_funded runs through a French parent that is itself US-PE-controlled. Second the processor chain: the platform is hosted on Amazon Web Services, a US-owned hyperscaler holding customer data at rest (contractually Germany-only, with third-country support access reserved), and outbound mail runs through Twilio Inc./SendGrid. Either limb alone puts CLOUD Act exposure at material.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About sevdesk
sevdesk (Offenburg, Germany, founded 2013) is one of the most-installed DACH accounting tools for freelancers, founders, and SMBs: paid plans start at €11.90 per month on monthly billing, below which sits a permanent free e-invoicing tier, with German DSGVO + GoBD compliance built in. As of 2022 it is a Cegid Company: Cegid is the French ERP / accounting group that Silver Lake (US private equity) took private in 2016 and still majority-holds, with KKR (US private equity) a minority holder since 2021 at a €5.5B enterprise value. So the operating brand is German, the immediate parent is French, and the controlling capital is US private equity. For DACH SMB procurement this nuance matters: nominally European, materially US-controlled at the group level.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of sevdesk
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Norway · €9/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Norway · €20/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €7.90/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Conta
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€9/mo |
Fiken
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€20/mo |
Lexware
Germany
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€7.90/mo |