Is it really European?

1. What counts as headquarters

A company counts as European here if its headquarters is in the EU, the EEA, the UK or Switzerland, as stated by the company itself: in its imprint or legal notice, its terms of service, or its privacy policy. Those are the documents that name the legal entity you sign a contract with and the entity responsible for your data.

Three things that often get taken as proof of being European do not count:

• Where the company was founded. A company can be started in Europe and later contract with its customers through a US corporation.
• An EU data region. Many US software companies offer hosting in an EU region. That decides where the servers are, not who runs the company or which law it answers to.
• A European office or subsidiary. A sales office in Berlin or a Dublin subsidiary is not a headquarters if the terms of service name a US parent as the other party to your contract.

Press coverage, funding databases and marketing pages were not used as evidence. They are often out of date, and they rarely say which entity signs the contract.

2. What we found

We checked in two passes. On 16 August 2026 a crawler fetched the legal pages of all 194 companies then listed, extracted every company name and address, and we reviewed each one that mentioned a non-European entity by hand. On 19 October 2026 we went back, by hand, to every company the first pass could not settle and every company listed since.

The single most common false alarm was a US company named as a supplier. A German accounting software company's page carried a Google trademark notice; a French AI lab named the US host of its website; others named Stripe, AWS or a video plugin. None of that says anything about where the vendor is headquartered, which is why every flag was read by a person before anything was removed.

The other common gap is simpler: 58 of the 172 legal pages the crawler could read did not state a company name and address in a form it could find. Some publish it in a PDF or load it with JavaScript, some on a page with an unusual name, and a few nowhere at all.

3. Four ways a company looks more European than it is

The companies that did not pass fall into a small number of patterns. We name them only with what their own legal pages say, and link the page.

Before either pass, in March 2026, 14 tools were removed whose recorded headquarters was outside Europe. 12 of them were open-source projects, among them Matomo, Bitwarden and Sentry. You can run open-source software on your own European servers, which is useful, but that does not make the company that publishes it European.

On 20 October 2026 we removed 16 companies after this check: the 12 that fail the test, the mixed cases whose parent company is headquartered outside Europe, and companies that have shut down. 6 mixed cases stay listed: Algolia, Anyline, Contentful, Dataiku, Gladia, Nabla. Their parent company is European, and only customers in other regions sign with a non-European subsidiary.

Smaller errors: the right country, the wrong city

Across both passes, 9 listings named a city or country that differs from the registered address on the company's own legal pages. None of these changes whether the company is European, and all have been corrected. These are the ones found in the second pass:

• Fatture in Cloud. Listed in Milan; the provider, TeamSystem S.p.A., has its registered office in Pesaro.
• Gladia. Listed in Rennes; the terms now give the head office as Roubaix.
• Netcup. Listed in Nuremberg; netcup GmbH has its registered office in Karlsruhe.
• Payconiq. Listed in Brussels; the registered office of Payconiq International S.A. is in Luxembourg.
• ReachFive. Listed in Paris; the product is now sold by Purse SASU, registered in Lille.
• Taiga. Listed in Madrid; the provider, Taiga Cloud Services S.L., is registered in Vigo.
• Whereby. Listed in Oslo; Whereby AS is registered in Måløy. Oslo is only the agreed court.
• Yousign. Listed in Paris; the operator, now called Youtrust SAS, is registered in Caen.
• ZITADEL. Listed in Zurich; CAOS AG, the Swiss company behind the product, is in St. Gallen.

Could not be confirmed

For 6 listings we could not confirm the headquarters from the vendor's own pages: some sites blocked automated access, and some name no company at all. That does not make them non-European, but we cannot yet show that they are.

• Nalvin: The site now shows only a notice that the team is joining Lovable, and its legal pages are gone.
• NordPass: The whole site blocked automated access during our check, so we could not read its terms.
• Personio: The imprint and privacy pages blocked automated access during our check. Personio's help centre names Personio SE & Co. KG, a German company form, as the issuer of invoices, but we could not read the address.
• Photopea: The only legal page names no company or address.
• Plezi: The whole site blocked automated access during our check, so we could not read its legal notice.
• Woodpecker CI: A community open-source project with no company behind it. The site credits "Woodpecker Authors" and has no imprint, terms or privacy page.

4. The directory today

Of the 220 companies in the directory on 20 October 2026, 209 have a European headquarters confirmed by their own legal pages, 6 are mixed, 0 fail the test and 5 could not be confirmed. The figures below describe all 220 listings and are computed from the directory data.

By country

Germany and France together account for 40% of listings. That reflects where companies have applied and where we have looked as much as where European software is built, so read it as a description of this directory, not of the European market.

Where the data is stored

A European headquarters does not guarantee European hosting: some of these companies run on US cloud providers or let you pick a region. The figures above are the hosting information recorded for each listing. Unlike headquarters, we have not re-checked them against contracts or sub-processor lists.

Open source

32 of 220 listings (15%) publish their product as open source, which means you can read the code rather than take the vendor's word for what it does.

Security certifications

We have checked the published certifications of 43 companies so far, and record a certification only when the vendor itself claims it for its own organisation, not for its hosting provider. 41 publish at least one; 3 hold a European scheme such as BSI C5, SecNumCloud or HDS. 177 have not been checked yet, so these numbers describe the checked group only.

5. How to check a vendor yourself

You need nothing but a browser and the vendor's website.

1. Open the terms of service and find the first paragraph. It says who the agreement is "between". That company, and its address, is who you are buying from.
2. Check whether the answer depends on where you are. Search the terms for "if you are located in" or "EEA". Some vendors contract with Europeans through a European entity and with everyone else through a US one, or the other way round.
3. Find the data controller in the privacy policy. It is usually in the first or the last section. Under GDPR this is the company responsible for your data.
4. Read the imprint or legal notice. Business websites in Germany and Austria are required to publish an imprint, and French sites publish "mentions légales". It gives the registered office and the company register number, which you can look up in the national register.
5. Look for a parent company. Phrases like "a subsidiary of", "affiliate of" or "part of the … group" tell you who ultimately owns the business.
6. Ignore suppliers. A US company named as a sub-processor, payment provider or website host is not the vendor. It matters for where your data goes, not for where the vendor is based.
7. Check the governing law and courts. Near the end of the terms, these clauses say which country's law applies and where a dispute would be heard, whatever language the website is in.

If you are choosing between tools rather than vetting one, the full company list shows where each company is based, and the alternatives pages group them by the US tool they replace.

6. Data, limits and corrections

• The per-company record, with the entity, address, source page and a short quote for every company checked in the second pass, is available as JSON. If you use it, please credit european-saas.eu.
• Legal pages change. Each finding is dated, and is a statement about the page on that date. ElevenLabs is an example: since our first check its privacy policy has named a Polish subsidiary as data controller for users in the EEA, UK and Switzerland, while its terms of service still name the New York corporation.
• Our criterion is EU, EEA, UK or Switzerland. A company headquartered elsewhere in Europe fails it, even though it is European by any geographic definition.
• This is a check of one directory, not a sample of the European software market. The share of companies that fail would look different in a list assembled another way.
• If you represent a company named here and your legal pages say something different, send us the page and we will correct the record. The same goes for any company we list that you think fails the test. Write tosubmit@european-saas.eu.

First published 19 October 2026. Last updated 20 October 2026.