weclapp
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German cloud ERP + CRM (weclapp SE), Frankfurt and Karlsruhe data centres, ISO 27001/27018, part of the Dutch Exact Group under US private-equity control.
weclapp offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CRM.
Assessment notes
German Societas Europaea (weclapp SE) running customer ERP/CRM data on a Frankfurt data centre with Karlsruhe backup, both certified ISO 9001/27001/27018/27701/22301/20000-1/PCI-DSS/CSA STAR/SSAE16. Two facts cap the score. First, ownership: weclapp SE has been part of the Dutch Exact Group since 2022, and Exact is a KKR portfolio company (majority since 2019) with Silver Lake co-invested since 2021, so the ultimate control sits with US private equity and the signal is eu_hq_us_funded, not eu_owned. Second, the processor chain: the sub-processor list (verified 2026-08-26, page dated 13 August 2026) shows production storage and processing running on Amazon Web Services via the operations partner Exact Cloud Development Benelux, with Microsoft, Splunk, Akamai, ServiceNow and Secureworks (all US-owned) for monitoring and security. CLOUD Act exposure is material despite the German data region. The AVV/DPA itself is publicly downloadable as a PDF.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 16 · 9 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About weclapp
weclapp is a German cloud ERP + CRM platform operated by weclapp SE, a Societas Europaea legal form adopted to support international expansion, with offices in Frankfurt am Main, Marburg, Kitzingen, and Karlsruhe. Since September 2022 weclapp has been part of the Dutch Exact Group, which is itself a KKR portfolio company with Silver Lake co-invested as a minority since 2021, so ultimate control sits with US private equity and the ownership signal is recorded as EU HQ, US-funded. Founded in 2008, the platform combines CRM, sales pipelines, quotations, invoicing, accounting, project management, and full inventory/warehouse management for SMBs and mid-market companies, with strong integrations into German marketplaces, payment providers, and shipping platforms (Amazon, eBay, Shopify, etc.). The product has won "ERP-System des Jahres" multiple times and is positioned as the first German cloud ERP with TÜV-certified data protection.
For procurement-grade EU buyers the data region is clear but the processor chain is not EU-only. Customer ERP/CRM data is stored on a Frankfurt am Main data centre with a Karlsruhe backup; both facilities carry an exceptional certification stack (ISO 9001, ISO 27001, ISO 27018, ISO 27701, ISO 22301, ISO 20000-1, PCI-DSS, CSA STAR CCM v4.0, SSAE16 / ISAE3402), while weclapp itself holds ISO 27001 and ISO 27018. The dedicated sub-processor page (last updated 13 August 2026) shows production storage and processing running on Amazon Web Services via the operations partner Exact Cloud Development Benelux, with Microsoft, Splunk, Akamai, ServiceNow and Secureworks in the monitoring and security path, so a US-owned hyperscaler does sit in the customer-data path and CLOUD Act exposure is recorded as Material despite the German data region. Doxis AI Solutions B.V. (NL) performs OCR and automated extraction from customer documents. Google, Intercom, Productboard, Meta and LinkedIn are scoped to marketing-site analytics, advertising pixels, customer chat and product roadmapping, with SCCs cited under Art. 46 GDPR for onward transfers. Brevo (FR) handles newsletters and Personio (DE) handles application data.
Pricing in EUR: ERP Starter €39/user/month, ERP Services €86/user/month, ERP Trade €163/user/month, Enterprise custom for 10+ licences. A 30-day free trial requires no credit card and auto-cancels. Best fit: German and DACH SMBs and mid-market companies that need an integrated ERP + CRM with explicit German data residency, multi-ISO certifications, and broad e-commerce-marketplace integrations. The AVV/DPA is publicly downloadable as a bilingual DE/EN PDF, so the friction for a procurement-grade buyer is the processor chain rather than the paperwork: confirm the AWS role in the production path and the Frankfurt / Karlsruhe contractual commitments before signing.
Sub-processor map · 16
-
Akamai Technologies Netherlands B.V. USNetherlands
DDoS and cyber-attack protection (via Exact)
-
Amazon Web Services EMEA SARL USLuxembourg
Production storage and processing (via Exact; data in Frankfurt)
-
DigitalOcean LLC USUnited States
Hosting for weclapp webpages and knowledge base (processed in Frankfurt am Main)
-
Intercom R&D Unlimited Company USIreland
Chat feature for customer communications
-
Microsoft B.V. USNetherlands
Microsoft Defender status monitoring (via Exact)
-
Microsoft Ireland Operations Ltd. USIreland
Storage/processing of mail, files, SharePoint, Teams (via Exact)
-
Secureworks Inc. USUnited States
24/7 Security Operations Center (via Exact)
-
ServiceNow Nederland B.V. USNetherlands
IT process/service management and monitoring (via Exact)
-
Splunk Inc. USUnited States
Monitoring AWS cloud infrastructure (via Exact)
-
CLOUDIWAY SASU EUFrance
Migration of mail, files, SharePoint, Teams (via Exact)
-
DevOn India-NL B.V. non-USIndia
Migration and cloud environment operation support, located in India (via Exact)
-
Doxis AI Solutions B.V. EUNetherlands
OCR text recognition and automated data extraction from customer documents
-
Exact B.V. EUNetherlands
Support services to operate the MS Office suite
-
Exact Cloud Development Benelux B.V. EUNetherlands
Service configuration, security monitoring, performance tracking
-
fiskaly Germany GmbH EUGermany
Fiscalisation solution for KassenSichV
-
Product Fruits s.r.o. EUCzechia
Product tours, surveys and in-app support
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Akamai Technologies Netherlands B.V. | Netherlands | DDoS and cyber-attack protection (via Exact) | US |
| Amazon Web Services EMEA SARL | Luxembourg | Production storage and processing (via Exact; data in Frankfurt) | US |
| DigitalOcean LLC | United States | Hosting for weclapp webpages and knowledge base (processed in Frankfurt am Main) | US |
| Intercom R&D Unlimited Company | Ireland | Chat feature for customer communications | US |
| Microsoft B.V. | Netherlands | Microsoft Defender status monitoring (via Exact) | US |
| Microsoft Ireland Operations Ltd. | Ireland | Storage/processing of mail, files, SharePoint, Teams (via Exact) | US |
| Secureworks Inc. | United States | 24/7 Security Operations Center (via Exact) | US |
| ServiceNow Nederland B.V. | Netherlands | IT process/service management and monitoring (via Exact) | US |
| Splunk Inc. | United States | Monitoring AWS cloud infrastructure (via Exact) | US |
| CLOUDIWAY SASU | France | Migration of mail, files, SharePoint, Teams (via Exact) | EU |
| DevOn India-NL B.V. | India | Migration and cloud environment operation support, located in India (via Exact) | non-US |
| Doxis AI Solutions B.V. | Netherlands | OCR text recognition and automated data extraction from customer documents | EU |
| Exact B.V. | Netherlands | Support services to operate the MS Office suite | EU |
| Exact Cloud Development Benelux B.V. | Netherlands | Service configuration, security monitoring, performance tracking | EU |
| fiskaly Germany GmbH | Germany | Fiscalisation solution for KassenSichV | EU |
| Product Fruits s.r.o. | Czechia | Product tours, surveys and in-app support | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of weclapp
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €24/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Capsule CRM
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
centralstationCRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€24/mo |
combit CRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |