Workbooks
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Reading-based UK mid-market CRM, BGF-funded, multi-currency pricing in GBP/EUR/USD; post-Brexit jurisdiction with US sales office.
Workbooks offers EU hosting in the United Kingdom, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under CRM.
Assessment notes
Reading-based UK mid-market CRM (Workbooks Online Limited, BGF-funded) with multi-currency pricing in GBP/EUR/USD and a TechRadar #1 mid-market ranking. The legal documents do resolve: the Master Services Agreement (last updated August 2026) carries the Data Processing Addendum inside it, and a separate sub-processors and sub-contractors policy is published as a PDF. What that policy shows is the problem for an EU buyer. Hosting is a UK data centre operated by Equinix, Inc. (US-owned); Workbooks Online Inc., a Delaware entity, has access to Protected Data for North American customers and may access EEA customers' data for support; InvisibleCRM staff in the USA and Ukraine can access Protected Data through the Exchange sync service; and Google Apps, Box and SurveyMonkey are listed with data located in the USA. Governing law follows the contracting entity — England and Wales for Workbooks Online Limited, Delaware for Workbooks Online Inc. UK post-Brexit jurisdiction plus a Delaware co-contracting entity with data access plus US-located application data make CLOUD Act exposure material on verified grounds.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Workbooks
Workbooks is a Reading-headquartered UK CRM positioned for mid-market businesses, operated from Unit 9, Suttons Business Park, Reading RG6 1AZ. The product covers contact management, opportunity management, quotations, ticketing, marketing automation, sales forecasting, sales order processing, accounting integration, project management, and AI-enabled CRM features. The company differentiates with a transparent "no-BS" pricing posture and three implementation tracks: SelfStart (self-guided), JumpStart (28-day), and Shared Success (collaborative workshops), and reports an average customer retention rate of over ten years. Workbooks has been rated #1 CRM software for midsize businesses by TechRadar Pro in 2024 and is recognized as a High Performer by G2 across US, UK, and EMEA. Total funding raised is approximately US$30.6M, primarily from BGF (Business Growth Fund), a UK investor.
For an EU-sovereignty audit the listing is partial: Workbooks operates from the UK (post-Brexit, "other" ownership tier under our rubric) and has a US sales office in Massachusetts; multi-currency pricing in GBP, EUR, and USD signals an Atlantic customer base. The legal documents do resolve, once you have the right URLs. The Master Services Agreement last updated August 2026 carries the Data Processing Addendum inside it, and a separate sub-processors and sub-contractors policy is published as a PDF. What that policy shows is the substance of the exposure: the data centre is in the United Kingdom but operated by Equinix, Inc.; Workbooks Online Inc., a Delaware entity, has access to Protected Data for North American customers and occasionally for EEA customers on support grounds; InvisibleCRM staff in the USA and Ukraine can reach Protected Data through the Exchange synchronisation service; and Google Apps, Box and SurveyMonkey are listed with data located in the USA. Governing law follows the contracting entity, England and Wales for Workbooks Online Limited and Delaware for Workbooks Online Inc., which is why CLOUD Act exposure is recorded as Material on verified grounds rather than by assumption.
Pricing is multi-currency and EU-aware: CRM Edition £32 / €26 / US$ per user/month with 100GB storage and standard support; Business Edition £67 / €60 PUPM adds order/invoice management and accounting integration; a "Try for free" offer is advertised on the homepage with limits not fully detailed. Best fit: UK and EU mid-market sales teams who want a long-running British vendor with deep customer-success investment and don't need an EU-only ownership chain. Strict-CLOUD-Act EU buyers should read the sub-processors and sub-contractors policy alongside clause 20.1 of the current MSA, which splits governing law between England and Wales and Delaware depending on the contracting entity, before signing.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Workbooks
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
United KingdomEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €24/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
GermanyEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Capsule CRM
United Kingdom
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
centralstationCRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€24/mo |
combit CRM
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
— |