Wetransfer
Verified“Dutch brand, Italian owner, American cloud.”
- Owner
- Bending Spoons 🇮🇹
- Hosting
- AWS 🇺🇸
- Users
- ~80M MAU
- Headcount
- ~75% cut
55 = midpoint of Control 72 & Data 38
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 10 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 78% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
84
WeTransfer B.V. is incorporated in the Netherlands as a Besloten Vennootschap (KvK 34380998) with its registered office and HQ in Amsterdam. Its Data Processing Agreement is governed by Dutch law with exclusive jurisdiction in the competent court of Amsterdam, and the data controller is the Dutch entity — EU law plainly reaches it. The only deduction: it now sits under an Italian parent (still EU), and DPO functions have moved to Bending Spoons.
Why 84? 4 sourced facts · click to expand
Legal form and registry
UK Companies House (overseas company FC039105) · as of 2026-06-12
Governing law and jurisdiction of its DPA
WeTransfer Data Processing Agreement (PDF) · as of 2025-11
Data controller entity and address
WeTransfer Privacy Policy (PDF) · as of 2025-07-15
Owned by Italian (EU) parent
Business Wire (acquisition announcement) · as of 2024-07-31
Control & Ownership
60
WeTransfer is 100% owned by Bending Spoons S.p.A. (Milan, Italy) since July 2024 — voting control is EU and the four controlling founders are European. But Bending Spoons filed a Form F-1 in June 2026 to list on Nasdaq (~$20B) with a dual-class structure: founders keep Class A shares at 5 votes each, while public investors get 1-vote Class B. So voting stays EU, but a meaningful slice of economic ownership will move to US public markets and the listing venue is American — squarely a 'EU voting, non-EU economics/listing' case.
Why 60? 4 sourced facts · click to expand
Founders retain voting control via dual-class shares
MLQ News (IPO summary) · as of 2026-06-08
Bending Spoons is Italian, founder-controlled
Wikipedia (Bending Spoons) · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
30
WeTransfer's Trust Center lists Amazon Web Services as its hosting infrastructure — a US hyperscaler. Files uploaded from the EU are reportedly stored in EU regions, but US servers are also used and the privacy policy expressly confirms personal data is transmitted to / stored outside the EEA (including the US under SCCs and the EU-US Data Privacy Framework), which means CLOUD Act exposure. There is no user-selectable EU-only residency, and encryption keys are AWS/provider-managed rather than end-to-end. This is the 'EU regions on a US hyperscaler' band, not sovereign EU infrastructure.
Why 30? 4 sourced facts · click to expand
Personal data transmitted/stored outside the EEA, incl. US
WeTransfer Privacy Policy (PDF) · as of 2025-07-15
Servers in both EU and US; no user EU-only control
NordVPN (Is WeTransfer Safe?) · as of 2026-06-12
Operations & People
50
The HQ remains Amsterdam and the file-transfer brand is European, but the operating centre of gravity has moved to the Italian parent. About 75% of WeTransfer's ~350 Amsterdam staff were cut within two months of the 2024 acquisition, the DPO and privacy contacts are now @bendingspoons.com, and group strategy and finances are run from Milan (with parent revenue reported in USD in its US IPO filing). EU-located and EU-managed at the brand level, but heavily directed and consolidated by Milan — a genuinely mixed picture.
Why 50? 4 sourced facts · click to expand
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Which AWS regions actually hold EU users' files, and what share of EU traffic lands on US servers?
Determines true CLOUD Act exposure; could move infra score up (EU-only regions) or down (significant US storage).
- ?
Post-IPO, what economic stake will US/non-EU public investors hold versus EU founders?
Directly affects the ownership score — voting stays with EU founders, but economic majority could tilt non-EU.
- ?
How much of WeTransfer's engineering/product is still staffed in Amsterdam versus absorbed into Bending Spoons in Milan?
Affects whether operations are still meaningfully Dutch or effectively an Italian-run product line.
- ?
Full named sub-processor list (the public page is JS-rendered and was not machine-readable)
Would confirm whether any non-AWS US providers (e.g. analytics, ad-tech) add further foreign-law exposure.
EU Cloud Sovereignty Framework lens
SEAL was designed for cloud providers; this is an analogous sovereignty mapping for an EU-owned app on US cloud infrastructure, not a certification.
Strategic
EU-owned (Bending Spoons, IT) and EU-incorporated, but strategy is set by an Italian parent heading for a US Nasdaq listing.
Legal & jurisdictional
Dutch B.V., contracts under Dutch law with exclusive Amsterdam jurisdiction; data controller is the EU entity. Fully EU-enforceable.
Data & AI
Personal data transmitted to/stored outside the EEA (incl. US) under SCCs/DPF; provider-managed keys, no end-to-end encryption, no EU-only toggle.
Operational
Amsterdam HQ retained but ~75% of staff cut; DPO and privacy functions moved to parent in Milan.
Supply chain
Core infrastructure depends on AWS (US hyperscaler); full sub-processor list not publicly machine-readable.
Technological
Hosting and key management sit with a US cloud provider; no evidence of sovereign or EU-owned infrastructure.
Security & compliance
ISO/IEC 27001:2022 and PCI DSS v4 certified; GDPR/CCPA aligned; published DPA, SCCs and trust center.
Environmental sustainability
No verified data found on energy use, emissions, or data-center sustainability commitments for WeTransfer specifically.
EU alternatives
End-to-end encrypted file sharing with EU (Ireland/Germany) data residency options, but the company is Swiss-headquartered and owned by Swiss Post — not EU-incorporated.
French file-transfer service positioned as a direct WeTransfer alternative with EU data hosting; closest like-for-like EU-controlled option.
Spanish, EU-incorporated provider offering encrypted file transfer with a privacy/EU-residency focus; verify current hosting regions before relying on it.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology