Signicat
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Trondheim-based pan-European eIDAS QTSP for digital identity, e-ID and qualified e-signatures; Nordic Capital-owned, EEA-hosted on US hyperscalers.
Signicat offers EU hosting in Norway, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under E-signature.
Assessment notes
Signicat AS (Trondheim, Norway; eIDAS Qualified Trust Service Provider; ISO/IEC 27001:2022 + 27018:2019 (DNV) + SOC 2 Type II) is a genuine European identity/trust group with an all-EU/EEA group entity chain and a public DPA + public sub-processors list, but its core platform runs multi-cloud on three US-owned hyperscalers (Google Cloud EMEA/IE, AWS/LU, Microsoft Azure/IE), all with EEA data residency, and Mailchimp (US, USA-stored) is used for some notifications, so despite EEA hosting it carries meaningful CLOUD Act exposure and three US-owned sub-processors, which caps the score at 3/5.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Signicat
Signicat is a Trondheim (Norway) headquartered pan-European digital-identity and electronic-trust platform, describing itself as "the leading provider of digital identity solutions in Europe" with 21,000+ companies served and 500+ staff across Norway, Sweden, Finland, Denmark, the Netherlands, Germany, UK, Spain, Portugal, Romania, Lithuania, Estonia and Latvia. It is a registered eIDAS Qualified Trust Service Provider (QTSP) and one of the first certified under eIDAS 2.0, with qualified services spread across jurisdictions: qualified time-stamps (Norway, via Buypass/SK ID), qualified certificates and remote signature-creation device management (Spain, via UANATACA/ACCV) and qualified signature/seal validation (Lithuania, via the 2021-acquired Dokobit). Beyond e-signing it covers bank-grade e-ID authentication (BankID, MitID, iDIN, itsme), onboarding/KYC, and fraud/identity verification (bolstered by the Sphonic and Inverid acquisitions). Ownership is the key nuance: since April 2019 Signicat has been majority-owned by Nordic Capital (a European private-equity investor, via Fund IX), acquired from Secure Identity Holding and Viking Venture III; Viking Venture III re-invested and remains a Norwegian minority shareholder alongside employee shareholders. There is no US-VC control and no US parent, but Nordic Capital is a PE firm whose funds use Jersey/Luxembourg structures, so this is "other" rather than a clean local-hero "eu_owned" tag. Compliance posture is strong on paper: ISO/IEC 27001:2022, ISO/IEC 27018:2019 (DNV-verified), SOC 2 Type II, OpenID Certified, plus ENS High and Cyber Essentials Plus, with a GDPR-aligned DPA and a public sub-processors appendix, and eIDAS QTSP status. The caveat for sovereignty-focused buyers is infrastructure: the platform is multi-cloud across Google Cloud, AWS and Microsoft Azure (all EEA regions) plus T-Systems and Orange Business, three US-owned hyperscalers at rest, which drives CLOUD Act exposure to "material" despite EEA data residency. Best fit: regulated EU enterprises (banking, insurance, public sector) needing broad national e-ID coverage and qualified signing under one contract; buyers who weight US-infrastructure exclusion above feature breadth will not find a clean answer among the qualified providers here, because Youtrust, Universign and Signaturit all now carry US-owned cloud in the at-rest path; the closest option in this category is Skribble, whose signed documents stay with Swiss and German providers.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Signicat
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Austria · $10/moUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
SpainEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €23/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Eversign (Xodo Sign)
Austria
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$10/mo |
Signaturit (Namirial)
Spain
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Skribble
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€23/mo |