Skip to content
EU VETTED

Steady

Steady Media GmbH, Voltastr. 5, 13355 Berlin, Germany

Membership platforms · Germany
Founded 2016 · steady.page

Berlin membership platform for publishers (Steady Media GmbH): 10% commission, acts as merchant of record and handles EU VAT, but publishes no DPA and no sub-processors list.

Steady offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Membership platforms.

Assessment notes

Steady is a Berlin membership platform for publishers and media makers, operated by Steady Media GmbH and backed by German investors (Müller Medien and the Berlin public VC fund IBB Ventures / VC Fonds Kreativwirtschaft), so ownership is unambiguously EU. It is also the only platform in this category that acts as the merchant of record: Steady bills members, collects and remits VAT across EU member states, and pays creators out in one settlement, which removes the cross-border VAT work a creator would otherwise carry. The compliance picture is weaker than the ownership picture. Steady publishes no DPA and no sub-processors list, its privacy notice is dated February 2022, and it does not state where the platform is hosted. The notice itself names a long US chain: Cloudflare (DDoS and CDN), Intercom, Inc. (in-product chat, San Francisco), imgix (image CDN), embed.ly / A Medium Corporation (embedded content), Google Analytics, and the Meta pixel, with Google Workspace, Zendesk and Mailchimp visible in the mail configuration: Material. Member payments run over PayPal (Europe) S.à r.l., Apple Pay via Apple Distribution International, and SEPA direct debit via GoCardless Ltd (UK); no EU-incorporated card acquirer is named. Missing DPA caps this at 3/5 on its own.

Findings

CLOUD Act
Ownership
Sub-processors
17 · 12 US

Verified signals

Jurisdiction
  • EU / adequacy hosting: Yes
  • EU / adequacy operator: Yes
  • No US CLOUD Act exposure: No
Transparency
  • Public DPA: No
  • Sub-processors disclosed: No
  • Open-source clients: No
  • Third-party certification: No
Jump to

About Steady

Steady is a membership platform built for publishers and independent media, operated by Steady Media GmbH from Voltastraße in Berlin. Founded in 2016 by the team behind Krautreporter, it sells memberships for newsletters, magazines, podcasts and video channels, with a hosted member area, an email sending layer, member analytics and a public API. Its investors are German: Müller Medien and the Berlin public venture fund IBB Ventures (VC Fonds Kreativwirtschaft), which is why ownership reads as EU-owned with no US capital in the cap table.

The commercial model is a flat 10% commission on member revenue, plus the payment provider's own fee, with nothing to pay until money comes in. What genuinely separates Steady from the rest of this category is that it is the merchant of record: it contracts with the member, issues compliant invoices, collects and remits VAT at the member's own country rate across the EU, and transfers the creator one consolidated payout. For a German or French creator with subscribers in a dozen member states, that removes the single most tedious part of running paid memberships. Members can pay by card, PayPal, Apple Pay or SEPA direct debit.

For a sovereignty audit the record is mixed and the gaps are documentation gaps. Steady publishes no data processing agreement and no sub-processors list, the privacy notice carries a February 2022 date, and nowhere does the company state which data centre or country the platform runs in. What the notice does disclose is a substantial US chain: Cloudflare in front of the site, Intercom, Inc. for in-product chat, imgix as image CDN, embed.ly (A Medium Corporation) for embedded media, Google Analytics and the Meta pixel, and Google Workspace, Zendesk and Mailchimp visible in the mail records: Material. On the money side, PayPal (Europe) S.à r.l. is a Luxembourg entity under US ownership, Apple Pay runs through Apple Distribution International, and SEPA direct debit goes through GoCardless Ltd in the UK; no EU-incorporated card acquirer is named anywhere. Best fit: European publishers that value the VAT and invoicing work being done for them, and that can accept a vendor which has not yet published the procurement paperwork.

Sub-processor map · 17

  • Apple Distribution International US
    Ireland

    Member payments via Apple Pay

  • Cloudflare, Inc. US
    United States

    CDN and DDoS protection in front of steady.page and steadyhq.com

  • embed.ly (A Medium Corporation) US
    United States

    Embedding third-party media on publisher pages

  • Google Ireland Limited (Google Analytics) US
    Ireland

    Website analytics (consent-gated); data may be transferred to Google sub-processor facilities outside the EU under SCCs

  • Google Ireland Limited (Google Workspace) US
    Ireland

    Corporate and support email (from public MX and SPF records)

  • imgix US
    United States

    Image content delivery network

  • Intercom, Inc. US
    United States

    In-product chat support (stores message content and IP addresses)

  • Intuit Mailchimp US
    United States

    Marketing email delivery (from public SPF record)

  • Meta Platforms Ireland Limited US
    Ireland

    Meta pixel conversion tracking and advertising (consent-gated); event data forwarded to Meta Platforms, Inc. in the US

  • PayPal (Europe) S.à r.l. et Cie, S.C.A. US
    Luxembourg

    Member payments via PayPal

  • Twitter International Company US
    Ireland

    Conversion tracking for advertising (consent-gated)

  • Zendesk, Inc. US
    United States

    Support ticketing and support email (from public SPF record)

  • GoCardless Ltd non-US
    United Kingdom

    Member payments via SEPA direct debit

  • Hotjar Ltd EU
    Malta

    Heatmaps and on-site behaviour analytics (consent-gated)

  • Ortto (Autopilot) non-US
    Australia

    Marketing automation email delivery (from public SPF record)

  • Powerplay GmbH (Cello) EU
    Germany

    Referral tracking and referral rewards

  • Tally BV EU
    Belgium

    In-product feedback surveys

Source: the vendor’s published sub-processor list, read 10 Aug 2026.

12 of 17 sub-processors are US-owned or US-based. CLOUD Act exposure applies.

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-08-10).

Capability matrix

Table 2Capabilities of Steady

Recurring memberships Yes
One-off tips No
Pay-per-post No
Members-only content hosting Yes
Digital shop No
Connect your own payment account No
VAT collected and remitted for you Yes

Integration & access

REST API Yes
SSO (SAML / OIDC) No

Compliance & governance

Audit log No
Self-host / on-prem option No

Pricing & tiers

Custom pricing

Contact vendor for tier or volume pricing.

View pricing page

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement. This is recorded as no public DPA (see How we assess).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    steady.page/en…
    Open

Alternatives in this category

  • Herohero
    Czechia
    US-Linked
    Public DPA: No Sub-processors: No Open source: No
  • Ko-fi
    United Kingdom · $12/mo
    EU-Hosted
    Public DPA: No Sub-processors: No Open source: No
  • Liberapay
    France
    EU-Hosted
    Public DPA: No Sub-processors: Yes Open source: Yes
See all membership platforms alternatives