SumUp
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
London-based mPOS fintech (originally Berlin), 4M+ SMBs, heavy US-VC funding (Goldman Sachs led €1.5B 2024); US$10-15B London listing in preparation.
SumUp offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Payments.
Assessment notes
SumUp is London-headquartered British fintech (HQ moved from Berlin to London long ago, founded 2012 by Daniel Klein, Alessandro Leoni, Marc Alexander Christ, Stefan Jeschonnek), serving 4M+ SMBs across the US, UK, Germany, France, and dozens of other markets, but the cap table is heavily US-funded (Goldman Sachs led €1.5B May 2024, plus Bain Capital Credit, Crestline, Oaktree, American Express), the company operates a US entity (SumUp Inc., Delaware), uses US banking partners (Fifth Third Bank as Payment Facilitator, Piermont Bank for banking services), and a London listing at US$10-15B is being prepared: ownership_signal: eu_hq_us_funded, cloud_act_exposure: material; a public self-serve DPA is available, but it grants general authorisation to engage sub-processors without naming any and no sub-processors list is published, which caps the score at 3.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About SumUp
SumUp is a London-headquartered British fintech (founded in Berlin in 2012 by Daniel Klein, Alessandro Leoni, Marc Alexander Christ, and Stefan Jeschonnek; CEO Daniel Klein) focused on mobile point-of-sale (mPOS), card terminals, and integrated payments for small businesses. The product targets the segment Square dominates in the US (micro-merchants, mobile traders, market vendors, hospitality, retail) with a hardware-led entry (the iconic SumUp Air card reader at €19 one-time) and a flat transaction fee (~1.39% in DACH; varies by market). The company serves 4M+ SMBs across the United States, the United Kingdom, Germany, France, and dozens of other markets across Europe and South America.
For an EU-sovereignty audit SumUp sits squarely in the "European brand, US-funded structurally" tier. The cap table is dominated by US institutional investors: Goldman Sachs (which led a US$624M / €1.5B funding round in May 2024 at an US$8.5B valuation), Bain Capital Credit, Crestline, Oaktree Capital Management, and American Express all hold significant positions, alongside Temasek (Singapore), BBVA Ventures (Spain), and Groupon (US). The company operates SumUp Inc. (a Delaware entity at 1209 Orange Street, Wilmington, the classic Delaware-registered-agent address) for US operations and uses US banking partners (Fifth Third Bank as registered Payment Facilitator and Piermont Bank for FDIC-member banking services in the US). As of April 2026 SumUp is reported to be preparing a possible London listing at a valuation of US$10-15B, with Deutsche Bank, Goldman Sachs, Jefferies and JPMorgan lining up the float and leadership said to prefer London to New York. Neither venue is an EU listing, so the ownership signal is unaffected either way.
Pricing in Germany: a pay-as-you-go tier at €0/month and 1.39% in person or 2.5% online, and a Payments Plus subscription (renamed from SumUp One) at €19/month for 0.79% domestic and 1.39% on premium, international and Amex cards, with custom terms above €10,000/month. Hardware is priced separately and is no longer listed on the pricing page. Best fit: micro-merchants and hospitality / retail SMBs wanting an inexpensive hardware-led card-acceptance solution. Procurement-grade EU buyers requiring an EU-controlled ownership chain should look at Adyen (Euronext Amsterdam) or Worldline (Euronext Paris), the two publicly-listed European processors in this category, instead.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of SumUp
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
NetherlandsEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
FranceEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: No -
-
NorwayEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Adyen
Netherlands
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Alma
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: No
|
— |
Dintero
Norway
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |