{
 "source": "https://nordcompare.com/eu-hosted-software/",
 "licence": "CC BY 4.0",
 "rows": [
  {
   "tool": "Systeme.io",
   "category": "Email marketing",
   "data_stored": "In the EU",
   "contract_with": "ITACWT Limited, Ireland",
   "us_sub_processors": "Not stated",
   "note": "The privacy policy says data sits in AWS’s Irish data centre with no transfers outside the EU. We found no public sub-processor list.",
   "sources": "https://systeme.io/privacy-policy",
   "location_read": "2026-11-05"
  },
  {
   "tool": "EmailOctopus",
   "category": "Email marketing",
   "data_stored": "In the EU",
   "contract_with": "Three Hearts Digital Ltd, United Kingdom",
   "us_sub_processors": "Yes",
   "note": "The company is in London. The privacy policy of 1 October 2026 places account data and contact lists with AWS in the European Union, primarily Ireland. AI content moderation may run in other AWS regions, including the United States.",
   "sources": "https://emailoctopus.com/legal/privacy",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Brevo",
   "category": "Email marketing",
   "data_stored": "In the EU",
   "contract_with": "Brevo SAS, France",
   "us_sub_processors": "Yes",
   "note": "Brevo’s security page says its servers are in the EU. The sub-processor list names OVH in France and Google Cloud in Belgium for hosting. Cloudflare and part of SMS routing involve the United States.",
   "sources": "https://www.brevo.com/features/data-security/ https://www.brevo.com/legal/termsofuse/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "MailerLite",
   "category": "Email marketing",
   "data_stored": "In the EU",
   "contract_with": "MailerLite Limited, Ireland",
   "us_sub_processors": "None listed",
   "note": "EEA customers contract with Irish MailerLite Limited. The data processing agreement of 10 July 2026 lists Google Cloud EMEA (Germany and the Netherlands) and Vercom (Poland) as sub-processors.",
   "sources": "https://www.mailerlite.com/legal/privacy-policy https://www.mailerlite.com/legal/data-processing-agreement",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Mailchimp",
   "category": "Email marketing",
   "data_stored": "Outside the EU",
   "contract_with": "Intuit / The Rocket Science Group LLC, United States",
   "us_sub_processors": "Yes",
   "note": "The data processing addendum allows processing “to and in the United States and anywhere else in the world”. The stated transfer basis is the EU–US Data Privacy Framework, with standard contractual clauses as a fallback. Nearly all listed sub-processors are in the United States.",
   "sources": "https://mailchimp.com/legal/data-processing-addendum/ https://mailchimp.com/legal/subprocessors/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "GetResponse",
   "category": "Email marketing",
   "data_stored": "Not stated",
   "contract_with": "GetResponse S.A., Poland",
   "us_sub_processors": "Not stated",
   "note": "GetResponse S.A. is a Polish company. Its privacy policy says recipients are “based mainly in the European Economic Area”. Neither the policy, the data processing agreement nor the security page names a data centre location.",
   "sources": "https://www.getresponse.com/legal/privacy https://www.getresponse.com/legal/data-processing-agreement",
   "location_read": "2026-11-05"
  },
  {
   "tool": "ActiveCampaign",
   "category": "Email marketing",
   "data_stored": "EU region on some accounts",
   "contract_with": "ActiveCampaign, LLC, United States",
   "us_sub_processors": "Yes",
   "note": "The privacy policy describes transfers to the United States, Australia, Ireland, Brazil and Costa Rica. Under the data hosting policy, the region can be the EU for accounts created in Europe, the Middle East or Africa since 2024. Support and security work can still happen outside the region.",
   "sources": "https://www.activecampaign.com/legal/privacy-policy https://www.activecampaign.com/legal/mrdc-policy",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Tidio",
   "category": "Help desk",
   "data_stored": "Not stated",
   "contract_with": "Tidio LLC, United States",
   "us_sub_processors": "Not stated",
   "note": "The privacy policy of 9 September 2026 says data is processed “mainly” within the EEA. The contract is with Tidio LLC in the US, Tidio Poland is joint controller, and transfers to the US are possible. The security page names AWS without a region.",
   "sources": "https://www.tidio.com/privacy-policy/ https://www.tidio.com/security/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Crisp",
   "category": "Help desk",
   "data_stored": "In the EU",
   "contract_with": "CRISP IM SAS, France",
   "us_sub_processors": "Yes",
   "note": "The sub-processor list of 15 July 2026 names DigitalOcean in the Netherlands and Germany for the main servers, AWS in Ireland for backups and Scaleway in France for AI. Several sub-processors are US companies, and Stripe payment data is held in the US.",
   "sources": "https://crisp.chat/en/sub-processors/ https://crisp.chat/en/terms/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Freshdesk",
   "category": "Help desk",
   "data_stored": "EU region on some accounts",
   "contract_with": "Freshworks Inc., United States",
   "us_sub_processors": "Yes",
   "note": "A help article says data centres are in the US, the EEA, the UAE, India and Australia, and that you choose one when signing up. The sub-processor list of 30 September 2026 names Amazon Web Services, Inc. as the main host. The terms of service are with Freshworks Inc. in Delaware.",
   "sources": "https://support.freshdesk.com/support/solutions/articles/235810-where-is-your-data-servers-located- https://www.freshworks.com/privacy/ https://www.freshworks.com/privacy/sub-processor/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Zendesk",
   "category": "Help desk",
   "data_stored": "Not stated",
   "contract_with": "Zendesk, Inc., United States",
   "us_sub_processors": "Not stated",
   "note": "Under the regional data hosting policy, a region can be chosen only with the Data Center Location add-on, or a Suite that includes it. Without it, Zendesk makes no commitment on location. The customer agreement names Zendesk, Inc. and its affiliates.",
   "sources": "https://support.zendesk.com/hc/en-us/articles/4408883599130 https://www.zendesk.com/company/agreements-and-terms/zendesk-customer-agreement/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "1Password",
   "category": "Password managers",
   "data_stored": "EU region on some accounts",
   "contract_with": "AgileBits Inc., Canada",
   "us_sub_processors": "Not stated",
   "note": "The privacy policy says data is hosted where the customer chooses, currently the EU, the US or Canada. The price list ties storage to your currency’s region.",
   "sources": "https://1password.com/legal/privacy",
   "location_read": "2026-11-05"
  },
  {
   "tool": "NordPass",
   "category": "Password managers",
   "data_stored": "EU region on some accounts",
   "contract_with": "Nord Security Inc., United States",
   "us_sub_processors": "Not stated",
   "note": "The NordPass Business privacy notice lets the customer choose the United States or the European Union before starting. Vault items and their metadata stay in that region. The hashed email address and the organisation link are always stored in the United States.",
   "sources": "https://business.nordsec.com/legal/privacy-policy/nordpass https://business.nordsec.com/legal/terms-of-service",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Keeper",
   "category": "Password managers",
   "data_stored": "EU region on some accounts",
   "contract_with": "Keeper Security EMEA Limited, Ireland",
   "us_sub_processors": "Not stated",
   "note": "The security page says organisations may host their tenant in a preferred primary region and lists the US, the EU, Australia, Japan and Canada, all on AWS. The same page says AWS is managed by Keeper employees located in the US.",
   "sources": "https://www.keepersecurity.com/security.html https://www.keepersecurity.com/legal/terms-of-use/?s=tou",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Bitwarden",
   "category": "Password managers",
   "data_stored": "EU region on some accounts",
   "contract_with": "Bitwarden, Inc., United States",
   "us_sub_processors": "Yes",
   "note": "You choose between US and EU storage when creating the account. The sub-processor list names Microsoft in the US and the EU for hosting, while AWS, Fastly and most of the others are in the US.",
   "sources": "https://bitwarden.com/help/server-geographies/ https://bitwarden.com/help/subprocessors/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Dinero",
   "category": "Accounting",
   "data_stored": "In the EU",
   "contract_with": "Visma Dinero ApS, Denmark",
   "us_sub_processors": "Yes",
   "note": "The sub-processor page of 28 July 2026 lists Google Cloud (Germany, the Netherlands, Finland) and Azure (the Netherlands, Sweden) for the application and databases. Outgoing email goes through Mailchimp in the US.",
   "sources": "https://dinero.dk/sikkerhed/underdatabehandlere/",
   "location_read": "2026-11-05"
  },
  {
   "tool": "Billy",
   "category": "Accounting",
   "data_stored": "Not stated",
   "contract_with": "Shine Denmark ApS, Denmark",
   "us_sub_processors": "Yes",
   "note": "Billy now belongs to Shine. Shine’s data processing agreement of 10 October 2025 names AWS EMEA SARL in Luxembourg without a region, and MongoDB Inc. for the database. Several analytics and support sub-processors are in the US.",
   "sources": "https://shine.co/dk/legal/dpa",
   "location_read": "2026-11-05"
  },
  {
   "tool": "e-conomic",
   "category": "Accounting",
   "data_stored": "In the EU",
   "contract_with": "Visma e-conomic A/S, Denmark",
   "us_sub_processors": "Not stated",
   "note": "The security page says accounting data is hosted in the EU with ISO 27001 certified providers. It names neither a country nor a provider.",
   "sources": "https://www.e-conomic.dk/sikkerhed",
   "location_read": "2026-11-05"
  }
 ]
}