SimpleLogin
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-founded (2019) email-alias service acquired by Proton AG in 2022; unlimited aliases, custom domains, PGP forwarding and catch-all on Premium, hosted across Proton/UpCloud data centres in DE, CH, NL and FR.
SimpleLogin is a European service hosted in Switzerland, with at most minor, transient US exposure under the CLOUD Act. It is listed under Email aliasing.
Assessment notes
SimpleLogin is operated by Proton AG (Geneva, Switzerland, company number CHE-354.686.492), the same legal entity behind Proton Mail, following its April 2022 acquisition of the Paris-founded SimpleLogin team. Alias and mailbox data is hosted on Proton's own servers and on UpCloud, across data centres in Germany, Switzerland, the Netherlands and France, all EU/EEA or Swiss jurisdictions, so no core data flows through US infrastructure. Proton AG publishes a general Data Processing Agreement covering "email, calendar, drive and other services", which is publicly accessible without login but does not name SimpleLogin explicitly among the covered products. Named sub-processors are Paddle and Apple for payments, hCaptcha for bot protection, Cloudflare for DNS, and Zendesk for support tickets: all ancillary, none touching alias or forwarded-email content at rest, which keeps CLOUD Act exposure minor rather than material. The determining factor holding this listing at 4/5 rather than 5/5 is that the DPA is a company-wide document rather than a SimpleLogin-specific one, combined with a longer list of ancillary US-owned sub-processors than Proton's own mail-only listing carries.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 9 · 5 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Card-free payment available: YesAccepts cryptocurrency via Coinbase Commerce and SEPA/ACH/BACS wire transfer via Paddle, alongside cards.
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About SimpleLogin
SimpleLogin was founded in Paris in 2019 by Son Nguyen Kim, a Vietnamese-French engineer and former Criteo machine-learning researcher, and acquired by Proton AG (Geneva, Switzerland, company number CHE-354.686.492) in April 2022; the founding team went on to build Proton Pass. SimpleLogin is now legally operated by Proton AG rather than a separate French entity. Data is hosted on Proton's own servers and on UpCloud, across data centres in Germany, Switzerland, the Netherlands and France; no single country is stated as the primary location. The Free plan includes 10 aliases, 1 mailbox, reply-from-alias, browser extensions and mobile apps; Premium (from $4/month billed monthly, or $36/year billed annually) adds unlimited aliases, unlimited custom domains, catch-all domains, five subdomains, unlimited mailboxes and PGP encryption of forwarded mail. The client and server code is open source under AGPL-3.0 and self-hostable via Docker (github.com/simple-login/app). Named sub-processors: Paddle (card/PayPal payments), Apple (iOS in-app payments), hCaptcha (bot protection on login/register), Cloudflare (DNS), and Zendesk (support tickets); none of these touch alias or forwarded-email content at rest. Proton AG publishes a general Data Processing Agreement, but it does not name SimpleLogin explicitly among covered services.
Sub-processor map · 9
-
Apple USUnited States
iOS in-app payment processing
-
Cloudflare USUnited States
DNS
-
Coinbase Commerce USUnited States
Cryptocurrency payment processing
-
hCaptcha USUnited States
Bot protection on login and registration
-
Zendesk USUnited States
Support ticketing
-
Paddle.com Market Ltd non-USUnited Kingdom
Card and PayPal payment processing
-
Plausible Analytics EUEstonia
Privacy-aware website analytics
-
Proton AG EUSwitzerland
Operator and primary hosting of alias and mailbox data at rest
-
UpCloud EUFinland
Hosting across data centres in Germany, Switzerland, the Netherlands and France
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Apple | United States | iOS in-app payment processing | US |
| Cloudflare | United States | DNS | US |
| Coinbase Commerce | United States | Cryptocurrency payment processing | US |
| hCaptcha | United States | Bot protection on login and registration | US |
| Zendesk | United States | Support ticketing | US |
| Paddle.com Market Ltd | United Kingdom | Card and PayPal payment processing | non-US |
| Plausible Analytics | Estonia | Privacy-aware website analytics | EU |
| Proton AG | Switzerland | Operator and primary hosting of alias and mailbox data at rest | EU |
| UpCloud | Finland | Hosting across data centres in Germany, Switzerland, the Netherlands and France | EU |
Source: the vendor’s published sub-processor list, read 10 Jul 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of SimpleLogin
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
United Kingdom · €0.87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
Cyprus · €2.99/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
NetherlandsEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
addy.io
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
€0.87/mo |
AdGuard Mail
Cyprus
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
€2.99/mo |
AliasVault
Netherlands
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |