SuperOffice
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Long-running Norwegian Nordic-enterprise CRM (SuperOffice AS, Oslo) with EU/EEA hosting and on-premise edition; Axcel-owned with Carlyle backing.
SuperOffice offers EU hosting in Norway, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CRM.
Assessment notes
Long-running Norwegian Nordic-enterprise CRM (SuperOffice AS, Oslo) with subsidiaries across NO/SE/DK/DE/NL/CH/LT. The hosting question is now answered: the Trust Center names Visma Software International AS as the hosting partner and the pre-approved sub-processor list puts hosting and database storage for SuperOffice CRM Online in Norway, operated by Visma IT & Communications AS. What still weighs against it is the rest of the processor chain — Microsoft (Azure document storage plus AI language services), Mailgun, Amplitude and Userflow are all US-owned, with Userflow processing in the United States — and the 2025 continuation-fund round led by Carlyle AlpInvest with US Carlyle as ultimate parent. The generic privacy statement also still references the invalidated Privacy Shield framework (last updated May 2023). US-PE ownership at the fund layer plus four US-owned processors keep CLOUD Act exposure at material despite Norwegian hosting.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 4 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About SuperOffice
SuperOffice is one of the longest-running European CRM vendors, founded in 1989 in Oslo and operated by SuperOffice AS (Wergelandsveien 27, 0167 Oslo, Norway) with subsidiaries in Sweden, Denmark, Germany, the Netherlands, Switzerland, and Lithuania. The product targets Nordic enterprise B2B with three modules: Sales (deal management and forecasting), Marketing (campaign management and lead generation), Service (customer support), plus AI-assisted summaries and content generation, and 1,000+ integrations including Microsoft Dynamics, SharePoint, Slack, Trello, and Zapier. The company emphasises 30+ years of European CRM expertise.
Ownership is layered: in April 2020 Norwegian SuperOffice AS was acquired by Axcel, the Danish private-equity firm; on 3 June 2025 Axcel secured a €266M continuation fund led by Carlyle AlpInvest, with US-headquartered Carlyle as the ultimate parent of the AlpInvest sub-fund. So while the operating entity sits firmly in Norway/EEA and earlier ownership was fully Nordic, the continuation-fund layer adds meaningful US-PE exposure that procurement-grade buyers should understand. CEO as of 2026 is Bjørn Røsten.
Compliance disclosures have improved but are still mixed. The Trust Center publishes a pre-approved sub-processor list (last updated 27 August 2025) naming seven processors, and it answers the hosting question: Visma IT & Communications AS operates hosting and infrastructure for SuperOffice CRM Online with Norway as the processing location, under a security agreement between SuperOffice AS and Visma Software International AS as hosting partner. The rest of the chain is where the exposure sits: Microsoft (Azure document storage plus AI language services), Mailgun, Amplitude and Userflow are US-owned, with Userflow processing in the United States. The generic privacy statement (still published 1 May 2023) also continues to cite the EU-U.S. Privacy Shield Framework as an alternative legal basis, which has been invalidated since Schrems II (July 2020) and replaced by the Data Privacy Framework; outdated wording three years on is a transparency red flag. US-PE ownership at the fund layer plus four US-owned processors keep CLOUD Act exposure at Material despite the Norwegian hosting.
Pricing in EUR is enterprise-grade and the lineup was replaced in 2026: Starter €45, Core €65, Growth €95, Plus €130 and Super €160 per user/month on annual billing, with monthly, quarterly and semi-annual cycles also offered; an interactive demo replaces a self-serve free trial. Best fit: Nordic and DACH mid-market and enterprise B2B teams that want a long-running European CRM with deep Microsoft-stack integration. Procurement-led EU-only buyers should read the Trust Center sub-processor list, which now names each processing location, and establish which entity holds the ISO/IEC 27001:2023 certificate published there: the certificate on file names Visma Software International AS, the hosting partner, rather than SuperOffice AS, which is why no certification is recorded on this listing.
Sub-processor map · 7
-
Amplitude Inc. USUnited States
Product analytics and usage statistics (processed in Frankfurt)
-
Mailgun Technologies Inc. USUnited States
Email service provider for campaigns and ticket replies (processed in Frankfurt)
-
Microsoft Corporation USUnited States
Azure document storage; SuperOffice AI language analytics (processed in NL and IE)
-
Userflow Inc. USUnited States
In-product user onboarding and activation
-
i-Centrum AB EUSweden
App Store applications (Bookmycalendar, Contract Manager, Activity Board, Map4You Pro)
-
InfoBridge B.V. EUNetherlands
Calendar synchronization with Microsoft 365 / Google Workspace
-
Visma IT & Communications AS EUNorway
Hosting and operations of all servers/infrastructure; database storage (Norway)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amplitude Inc. | United States | Product analytics and usage statistics (processed in Frankfurt) | US |
| Mailgun Technologies Inc. | United States | Email service provider for campaigns and ticket replies (processed in Frankfurt) | US |
| Microsoft Corporation | United States | Azure document storage; SuperOffice AI language analytics (processed in NL and IE) | US |
| Userflow Inc. | United States | In-product user onboarding and activation | US |
| i-Centrum AB | Sweden | App Store applications (Bookmycalendar, Contract Manager, Activity Board, Map4You Pro) | EU |
| InfoBridge B.V. | Netherlands | Calendar synchronization with Microsoft 365 / Google Workspace | EU |
| Visma IT & Communications AS | Norway | Hosting and operations of all servers/infrastructure; database storage (Norway) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of SuperOffice
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €24/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Capsule CRM
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
centralstationCRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€24/mo |
combit CRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |