Skip to content
Independently verified · Quarterly re-audit
EU VETTED

SumUp

VERIFIED
Payments · United Kingdom
Founded 2012 · sumup.com ↗

London-based mPOS fintech (originally Berlin), 4M+ SMBs, heavy US-VC funding (Goldman Sachs led €1.5B 2024); €15B IPO in prep.

Why this score?

SumUp is London-headquartered British fintech (HQ moved from Berlin to London long ago, founded 2012 by Daniel Klein, Alessandro Leoni, Marc Alexander Christ, Stefan Jeschonnek), serving 4M+ SMBs across the US, UK, Germany, France, and dozens of other markets — but the cap table is heavily US-funded (Goldman Sachs led €1.5B May 2024, plus Bain Capital Credit, Crestline, Oaktree, American Express), the company operates a US entity (SumUp Inc., Delaware), uses US banking partners (Fifth Third Bank as Payment Facilitator, Piermont Bank for banking services), and a London / New York IPO at up to US$15B is being weighed — score 3/5 with material CLOUD Act exposure.

SCORE
3.0/5
CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
JUMP TO
OVERVIEW

About SumUp

SumUp is a London-headquartered British fintech (founded in Berlin in 2012 by Daniel Klein, Alessandro Leoni, Marc Alexander Christ, and Stefan Jeschonnek; CEO Daniel Klein) focused on mobile point-of-sale (mPOS), card terminals, and integrated payments for small businesses. The product targets the segment Square dominates in the US — micro-merchants, mobile traders, market vendors, hospitality, retail — with a hardware-led entry (the iconic SumUp Air card reader at €19 one-time) and a flat transaction fee (~1.69% in DACH; varies by market). The company serves 4M+ SMBs across the United States, the United Kingdom, Germany, France, and dozens of other markets across Europe and South America. For an EU-sovereignty audit SumUp sits squarely in the "European brand, US-funded structurally" tier. The cap table is dominated by US institutional investors: **Goldman Sachs** (which led a US$624M / €1.5B funding round in May 2024 at an US$8.5B valuation), **Bain Capital Credit**, **Crestline**, **Oaktree Capital Management**, and **American Express** all hold significant positions, alongside Temasek (Singapore), BBVA Ventures (Spain), and Groupon (US). The company operates **SumUp Inc.** (a Delaware entity at 1209 Orange Street, Wilmington — the classic Delaware-registered-agent address) for US operations and uses US banking partners (Fifth Third Bank as registered Payment Facilitator and Piermont Bank for FDIC-member banking services in the US). SumUp is publicly considering a stock-market listing in **either London or New York** at a valuation of up to US$15B — the eventual venue will define ownership posture but both are non-EU listings. Pricing: SumUp Air card reader €19 one-time + 1.69% per transaction in DACH (rates vary by country); SumUp Solo terminal €79; SumUp One subscription €19/month for 0.99% rate on supported markets. No monthly fee on the base plan. Best fit: micro-merchants and hospitality / retail SMBs wanting an inexpensive hardware-led card-acceptance solution. Procurement-grade EU buyers requiring an EU-controlled ownership chain should choose Adyen, Worldline, or Mollie (NL/FR public-listed European processors) instead.
SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-11).
FEATURES

Capability matrix

INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
from €0/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

Vendor does not publish a public DPA. Without a publicly accessible Data Processing Addendum, small EU customers cannot self-serve the processor agreement — this caps the compliance score (see How we score).
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — missing
    missing
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    sumup.com/legal…
    Open ↗
ALTERNATIVES

Alternatives in this category