"Hosted in the EU" is easy to claim and hard to check. EU Alts is a directory of European alternatives to US software, and for each verified listing we record who owns the company, where it is headquartered and what it actually runs on. We counted what we had.
The short version: of 126 verified listings, 56 (44%) have a US owner or a US-owned infrastructure provider on record, for 39 (31%) we could not establish the hosting from public sources, and 31 (25%) are marked as not exposed, of which only one carries a source we can link to.
All numbers are from our database on 29 October 2026. Listings are refreshed over time, so they will change.
The numbers
| Result | Listings | Share of 126 |
|---|---|---|
| US owner or US-owned hosting on record ("exposed") | 56 | 44% |
| Hosting could not be established from public sources | 39 | 31% |
| Marked not exposed | 31 | 25% |
Behind the 56 exposed listings:
- 47 name a US-owned cloud provider as their host: Amazon Web Services (28 listings), Google Cloud (11), Microsoft Azure (2) and a few others. One listing names both AWS and Google Cloud.
- 12 have a US owner or US parent company.
- The two groups overlap, and a few listings are exposed for other recorded reasons.
Behind the 31 marked not exposed: only one, Codeberg, has a source link for a positive claim. We show "outside the reach of the US CLOUD Act" only when ownership, headquarters and hosting are all recorded, all European, and backed by a source. For the other 30, the facts are not all there yet, so the page says "not independently verified" instead of making the claim.
What "exposed" means, and does not
Under the US CLOUD Act, a US company can be required to hand over data it controls even when the servers are in Europe. So choosing an EU region at AWS, Google Cloud or Azure does not by itself put the data out of reach of US law. "Exposed" on EU Alts means that such an owner or provider is recorded. It does not mean any request was ever made, and it is not a statement about anyone's intentions.
It also says nothing about quality. Several of the vendors below are good products from European companies with real EU data centres. The point is narrower: an EU data centre and an EU company are not the whole legal picture.
Five examples, each from the vendor's own page
We checked these on 29 October 2026. Each line says what the vendor's own page says, nothing more.
- Wire (messaging): its data processing addendum lists Amazon Web Services EMEA SARL, Luxembourg, for hosting, with processing location "EU" (source).
- Whereby (video meetings): its security page says it "relies mostly on AWS for its core infrastructure", "using the Dublin, Ireland availability zone" (source).
- Livestorm (webinars): its trust centre lists Amazon Web Services as a subprocessor and under infrastructure. No region is published (source).
- Tally (forms): its GDPR page lists Google Cloud for hosting and storage, country Belgium, and says form data is "stored in Europe" (source).
- Codeberg (code hosting): its FAQ says most services run on its own hardware in a rented facility in Berlin, with some tasks on netcup and Hetzner, both German (source). It does not say which tasks.
How we counted
For each listing we record the headquarters, the ownership (including any parent company), the hosting provider and country, and where the information came from. A listing counts as verified once those facts have been checked. The first round of research behind these records used AI-assisted web research, and was reviewed and corrected by the operator. Verification dates run from 31 July to 3 September 2026, so the oldest facts are about three months old.
Limits
- This is a snapshot of one directory, not a survey of the whole market. The listings are the ones we have added and verified so far.
- "Could not be established" means we found no public statement, not that the vendor hides anything.
- Nothing here is legal advice. Whether a particular transfer is lawful depends on your own situation.
- If a fact about your company is wrong or out of date, write to us through the security and corrections page and we will check it and correct the listing.
What to do with this
Ask vendors three questions: who owns you, what provider hosts the data, and where is your published source for that? Then check that the answer comes from the vendor's own documents and not only from a marketing page. Our CLOUD Act guide explains how to read the answers, and each listing on EU Alts shows what we found and when we checked.