Youtrust
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Caen/Paris-based French QTSP (eIDAS-qualified, ANSSI-supervised), B Corp, profitable, 30k+ customers; rebranded from Yousign to Youtrust in July 2026.
Youtrust offers EU hosting in France, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under E-signature.
Assessment notes
Yousign (Caen + Paris, France; founded 2013; rebranded to Youtrust in July 2026, legal entity still YOUSIGN SAS) is a Qualified Trust Service Provider (QTSP) on the European Commission's Trust List for France, verified directly against the French trusted list at the 2026-08 re-verify: qualified certificates for electronic signature (granted 2023-10-27), qualified certificates for electronic seal (granted 2019-12-16 and 2025-09-30), qualified timestamping (units UH7 and UH8 granted, earlier units withdrawn on the normal rotation cycle) and, new since the last audit, qualified remote QSCD management (granted 2026-07-09). ANSSI-supervised, and B Corp certified. The company is profitable since end of 2025 with €40M+ ARR, 30,000+ corporate customers, and 50M+ documents/year. Two caveats keep the score at 3/5. Cap table: the 2021 Series A of US$36.6M (€30M) was led by Lead Edge Capital (a New-York-based US growth-equity firm) alongside French eFounders, with Bpifrance and Eiffel Investment Group also on the register; current ownership mix not disclosed, so the listing sits at eu_hq_us_funded. Infrastructure: the sub-processor list published 2026-07-02 names AWS, Microsoft Azure and Google as cloud infrastructure and storage providers (French and European regions, but US-owned at rest) alongside French OVH, plus Auth0 (US-owned) for authentication and Segment with US hosting for analytics, which places the listing at cloud_act_exposure: material on the same basis as Signicat. The QTSP qualification, French-only stated hosting and Arkhineo legal archiving remain genuine strengths.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Youtrust
Youtrust is a Caen- and Paris-headquartered French digital-trust platform founded in 2013 as Yousign; the rebrand to Youtrust completed in July 2026, the whole site moved to youtrust.com and the legal entity remains YOUSIGN SAS. The rename accompanies a broader expansion into eIDAS 2.0 workflows. The company is a Qualified Trust Service Provider (QTSP) on the European Commission's Trust List for France: fully eIDAS-qualified across the three signature levels (Simple Electronic Signature, Advanced Electronic Signature, Qualified Electronic Signature) and supervised under the French ANSSI regulatory framework with the "Trusted Third Party" designation. The product is enriched by identity verification, document verification, electronic seals, and all-in-one compliance workflows for KYC / KYB / AML / CFT, targeting finance, real estate, insurance, healthcare, and B2B verticals.
Operating scale: 30,000+ corporate customers, 50M+ documents processed annually, €40M+ ARR, profitable since end of 2025, presence in France, Italy, Spain, Germany, Austria, UK, and B Corp certified (the certification for companies that meet high standards of social + environmental performance, public transparency, and legal accountability). The B Corp posture is unusual in the EU digital-trust segment and is itself a positive procurement signal for buyers who weight ESG alongside sovereignty.
Cap-table caveat: in June 2021, Yousign raised a US$36.6M (€30M) Series A led by Lead Edge Capital (a New York-based growth-equity firm) alongside French eFounders (Hexa) as returning investor. The current ownership mix after subsequent dilution and Yousign's path to profitability has not been publicly disclosed at audit time; the listing sits at eu_hq_us_funded (EU-headquartered but with a documented US-VC lead investor on record) with the ANSSI-QTSP regulatory anchor + profitability + B Corp as positive signals that partially offset the unconfirmed ownership picture. Best fit: French and EU regulated industries (banks, insurers, real-estate, healthcare) that need QES under ANSSI-supervised eIDAS infrastructure with API integration and complete identity-verification workflows. Direct competitors in this category: Signaturit / Namirial Group (Spanish-Italian, but US-private-equity-owned since Bain Capital's 2025 acquisition and hosted at rest on AWS, so cloud_act_exposure: material), Skribble (Swiss, dual ZertES and eIDAS QES brokered from Swisscom rather than held in its own right, CLOUD Act exposure Minor since Cloudflare entered its published chain).
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Youtrust
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Austria · $10/moUS-LinkedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
SpainEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
NorwayEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Eversign (Xodo Sign)
Austria
|
US-Linked | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$10/mo |
Signaturit (Namirial)
Spain
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Signicat
Norway
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |