Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Steady

VERIFIED

Steady Media GmbH, Voltastr. 5, 13355 Berlin, Germany

Membership platforms · Germany
Founded 2016 · steady.page ↗

Berlin membership platform for publishers (Steady Media GmbH): 10% commission, acts as merchant of record and handles EU VAT, but publishes no DPA and no sub-processors list.

In short

Steady, in the Membership platforms category, offers EU hosting with Germany as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.

Assessment notes

Steady is a Berlin membership platform for publishers and media makers, operated by Steady Media GmbH and backed by German investors (Müller Medien and the Berlin public VC fund IBB Ventures / VC Fonds Kreativwirtschaft), so ownership is unambiguously EU. It is also the only platform in this category that acts as the merchant of record: Steady bills members, collects and remits VAT across EU member states, and pays creators out in one settlement, which removes the cross-border VAT work a creator would otherwise carry. The compliance picture is weaker than the ownership picture. Steady publishes no DPA and no sub-processors list, its privacy notice is dated February 2022, and it does not state where the platform is hosted. The notice itself names a long US chain: Cloudflare (DDoS and CDN), Intercom, Inc. (in-product chat, San Francisco), imgix (image CDN), embed.ly / A Medium Corporation (embedded content), Google Analytics, and the Meta pixel, with Google Workspace, Zendesk and Mailchimp visible in the mail configuration: Material. Member payments run over PayPal (Europe) S.à r.l., Apple Pay via Apple Distribution International, and SEPA direct debit via GoCardless Ltd (UK); no EU-incorporated card acquirer is named. Missing DPA caps this at 3/5 on its own.

CLOUD ACT
OWNERSHIP
SUB-PROCS
17 · 12 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Steady

Steady is a membership platform built for publishers and independent media, operated by Steady Media GmbH from Voltastraße in Berlin. Founded in 2016 by the team behind Krautreporter, it sells memberships for newsletters, magazines, podcasts and video channels, with a hosted member area, an email sending layer, member analytics and a public API. Its investors are German: Müller Medien and the Berlin public venture fund IBB Ventures (VC Fonds Kreativwirtschaft), which is why ownership reads as EU-owned with no US capital in the cap table.

The commercial model is a flat 10% commission on member revenue, plus the payment provider's own fee, with nothing to pay until money comes in. What genuinely separates Steady from the rest of this category is that it is the merchant of record: it contracts with the member, issues compliant invoices, collects and remits VAT at the member's own country rate across the EU, and transfers the creator one consolidated payout. For a German or French creator with subscribers in a dozen member states, that removes the single most tedious part of running paid memberships. Members can pay by card, PayPal, Apple Pay or SEPA direct debit.

For a sovereignty audit the record is mixed and the gaps are documentation gaps. Steady publishes no data processing agreement and no sub-processors list, the privacy notice carries a February 2022 date, and nowhere does the company state which data centre or country the platform runs in. What the notice does disclose is a substantial US chain: Cloudflare in front of the site, Intercom, Inc. for in-product chat, imgix as image CDN, embed.ly (A Medium Corporation) for embedded media, Google Analytics and the Meta pixel, and Google Workspace, Zendesk and Mailchimp visible in the mail records: Material. On the money side, PayPal (Europe) S.à r.l. is a Luxembourg entity under US ownership, Apple Pay runs through Apple Distribution International, and SEPA direct debit goes through GoCardless Ltd in the UK; no EU-incorporated card acquirer is named anywhere. Best fit: European publishers that value the VAT and invoicing work being done for them, and that can accept a vendor which has not yet published the procurement paperwork.

SUB-PROCESSORS

Sub-processor map · 17

  • Apple Distribution International US
    Ireland

    Member payments via Apple Pay

  • Cloudflare, Inc. US
    United States

    CDN and DDoS protection in front of steady.page and steadyhq.com

  • embed.ly (A Medium Corporation) US
    United States

    Embedding third-party media on publisher pages

  • Google Ireland Limited (Google Analytics) US
    Ireland

    Website analytics (consent-gated); data may be transferred to Google sub-processor facilities outside the EU under SCCs

  • Google Ireland Limited (Google Workspace) US
    Ireland

    Corporate and support email (from public MX and SPF records)

  • imgix US
    United States

    Image content delivery network

  • Intercom, Inc. US
    United States

    In-product chat support (stores message content and IP addresses)

  • Intuit Mailchimp US
    United States

    Marketing email delivery (from public SPF record)

  • Meta Platforms Ireland Limited US
    Ireland

    Meta pixel conversion tracking and advertising (consent-gated); event data forwarded to Meta Platforms, Inc. in the US

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. US
    Luxembourg

    Member payments via PayPal

  • Twitter International Company US
    Ireland

    Conversion tracking for advertising (consent-gated)

  • Zendesk, Inc. US
    United States

    Support ticketing and support email (from public SPF record)

  • GoCardless Ltd non-US
    United Kingdom

    Member payments via SEPA direct debit

  • Hotjar Ltd EU
    Malta

    Heatmaps and on-site behaviour analytics (consent-gated)

  • Ortto (Autopilot) non-US
    Australia

    Marketing automation email delivery (from public SPF record)

  • Powerplay GmbH (Cello) EU
    Germany

    Referral tracking and referral rewards

  • Tally BV EU
    Belgium

    In-product feedback surveys

12 of 17 sub-processors are US-incorporated. CLOUD Act exposure applies.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-10).
FEATURES

Capability matrix

Recurring memberships Yes
One-off tips No
Pay-per-post No
Members-only content hosting Yes
Digital shop No
Connect your own payment account No
VAT collected and remitted for you Yes
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
Custom pricing

Contact vendor for tier or volume pricing.

View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    steady.page/en…
    Open ↗
ALTERNATIVES

Alternatives in this category

Herohero
Czechia · Founded 2021
US-LINKED

Czech creator membership platform (Herohero a.s., Prague): flat 10% all-in fee and strong local reach, but the terms also contract through a Delaware corporation and content sits on Google Storage.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
DIRECT
Ko-fi
United Kingdom
EU-HOSTED

UK creator platform (Ko-fi Labs Limited) for tips, memberships and digital shops: 0-5% service fee, but payouts run only through PayPal, Inc. or Stripe, Inc., with no EU payment option.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL
Liberapay
France · Founded 2015
EU-HOSTED

French non-profit association running an open-source recurring-donation platform: 0% platform cut, but hosted on AWS Ireland with Stripe and PayPal as the only payment routes.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MATERIAL