Tidio
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Szczecin-based Polish chatbot + live chat (founded 2013 by Tytus Gołas), 300k+ businesses, SOC 2; US-VC-funded (PeakSpan).
Tidio offers EU hosting in Poland, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Helpdesk.
Assessment notes
Tidio (Szczecin, Poland; founded 2013 by Tytus Gołas at age 20 and Marcin Wiktor) is the fastest-growing Polish customer-service / chatbot platform with 300,000+ businesses on the platform and SOC 2 certification. Series B led by PeakSpan Capital (US growth equity, NYC) with Inovo Venture Partners (Poland) and InPost CEO Rafał Brzoska, US$26.8M total raised. EU HQ but US-VC-led cap table: the PeakSpan Capital lead investor position flags the listing as eu_hq_us_funded. Hosting is on AWS (confirmed by the vendor, region not published) and the AI features (Lyro AI Agent, Hubi AI) add an LLM dependency whose provider Tidio still does not name, so CLOUD Act exposure stays material. The DPA is a public un-gated PDF, but the sub-processors list moved into a Trust Center (trust.tidio.com) that hands it out only on request, and the SOC 2 Type II report is likewise request-only. Tidio is also a self-declared EU-US Data Privacy Framework participant.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Tidio
Tidio is a Szczecin-headquartered Polish customer-service platform founded in 2013 by Tytus Gołas (at age 20, in Szczecin) and Marcin Wiktor, and one of the fastest-growing Polish SaaS exports of the decade. The product covers live chat, helpdesk ticketing, chatbots, and an AI agent layer, recently expanded with Lyro AI Agent (customer-service automation) and Hubi AI (marketing automation) on top of the core multi-channel inbox. The company reports more than 300,000 businesses on the platform with strong G2 / Capterra / Shopify / WordPress ratings (4.6-4.7 across reviewers). The company carries SOC 2 attestation.
For an EU-sovereignty audit the procurement-grade picture is mixed. The Polish HQ and founder team are clean European; total funding raised is approximately US$26.8M and the Series B was led by PeakSpan Capital (a US growth-equity firm headquartered in New York) alongside Inovo Venture Partners (Poland) and InPost CEO Rafał Brzoska's individual investment. The PeakSpan lead at the cap-table layer plus the recent AI product expansion (which structurally requires either US LLM-API dependencies like OpenAI / Anthropic or self-trained models on hyperscaler GPU) keeps the listing at eu_hq_us_funded with material CLOUD Act exposure under our strict-ownership stance. The hosting provider is now vendor-confirmed as AWS, with no region published, which independently sustains the material flag. Tidio still names no LLM vendor for Lyro or Hubi anywhere public, and both the sub-processor document and the SOC 2 Type II report moved behind a request gate in the trust centre, so neither can be read before contacting the vendor.
Pricing is freemium and published in US dollars, billed per billable conversation rather than per seat: Free at $0 (50 billable conversations, 10 seats), Starter from $24.17 per month, Growth from $49.17, Plus $300 plus usage and Premium on quote, with Lyro AI and Flows sold as separate add-ons. The headline figures are the annual-billing per-month equivalents. Best fit: SMB e-commerce businesses on Shopify / WooCommerce that need integrated chat + chatbot + AI agent automation, Polish + European SMBs that want a Polish-founded alternative to Intercom / Drift, and any organisation that can accept a US-VC-funded EU brand with the typical AI-stack US-cloud dependencies. Procurement-grade EU-only buyers requiring clean ownership should look at Crisp (FR), Userlike (DE), or chatlyn (AT, Nordic-VC-funded only) instead.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Tidio
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
France · $45/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €87/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Poland · $19/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Crisp
France
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: No
|
$45/mo |
Userlike (Lime Connect)
Germany
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€87/mo |
LiveChat (Text)
Poland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$19/mo |