Threema
Verified“Swiss-run, German-owned, sovereign — but not EU.”
- Users
- 12M+
- Majority owner
- DE 🇩🇪
- Data residency
- 100% CH
- Model
- Paid, no phone #
48 = midpoint of Control 49 & Data 46
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 16 sourced facts across 7 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 82% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
35
Incorporated and operated entirely in Switzerland (canton Schwyz) — a non-EU jurisdiction. The messaging service is provided by Threema GmbH under Swiss law (FADP), which is robust and adequacy-recognized but is NOT EU law. GDPR/EU enforcement reaches it only extraterritorially for EU users; there is no EU establishment. Strong on sovereignty, weak on EU-law reach, which is what this index measures.
Why 35? 4 sourced facts · click to expand
Legal form and registered office
Moneyhouse (Swiss commercial register data) · as of 2026-06-12
Swiss company number (UID) and founding date
Moneyhouse (Swiss commercial register data) · as of 2026-06-12
Service provided under Swiss law; outside US CLOUD Act
Threema FAQ — Server location · as of 2026-06-12
Switzerland is not an EU member state
Threema FAQ — Ownership · as of 2026-06-12
Control & Ownership
62
Pulled UP for an EU index by the January 2026 buyout: majority control now sits with Comitis Capital GmbH (Frankfurt am Main, Germany) — an EU-domiciled private-equity firm — held via Swiss vehicle Threema Holding AG (Zurich). So voting and economic majority are German (EU), though it is private (no listing venue) and ultimate Comitis fund/LP structure isn't disclosed. Previous owner Afinum was also Munich-based. EU economics, but opaque private-equity layering caps the score.
Why 62? 4 sourced facts · click to expand
Majority owner as of early 2026
Threema FAQ — Ownership · as of 2026-06-12
Acquirer location and sellers
Comitis Capital announcement · as of 2026-06-12
Secondary buyout from prior PE owner
Privacy Guides · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
50
Outstanding on sovereignty, but not EU-resident, so capped for this index. Threema runs ITS OWN servers (not a US hyperscaler) in two ISO 27001 colocation data centers in the Zurich area; personal data is processed and stored exclusively in Switzerland, outside the CLOUD Act. The catch for an EU index: data lives in Switzerland, not the EU. Group-call media routers may sit abroad but carry only E2E-encrypted streams and log no identities. Aggressive data minimization (no phone number, encrypted metadata) further reduces exposure.
Why 50? 4 sourced facts · click to expand
Self-operated servers in Swiss data centers
Threema FAQ — Server location · as of 2026-06-12
Data stored exclusively in Switzerland
Threema FAQ — Server location · as of 2026-06-12
Group-call media routers may be abroad
Threema FAQ — Server location · as of 2026-06-12
Data minimization: no phone number, encrypted metadata
Mozilla Foundation — Privacy Not Included · as of 2026-06-12
Operations & People
40
Fully Swiss-centered, which for an EU index reads as 'mixed-to-foreign': HQ, development, leadership and data centers are all in Switzerland (Pfäffikon SZ / Zurich), and pricing/reporting is in CHF (and EUR). Management board is Swiss-based (Robin Simon, Danilo Bargen, Miguel Rodriguez). Strong, coherent, sovereign operation — but it is Swiss-centered, not EU-centered, and the new German owner has pledged management continuity.
Why 40? 4 sourced facts · click to expand
Development and HQ in Switzerland
Threema FAQ — Server location · as of 2026-06-12
Management board (Swiss-based)
Moneyhouse (Swiss commercial register data) · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
What exact percentage and fund structure does Comitis Capital hold, and who are its ultimate LPs/beneficial owners?
Deal terms were undisclosed; the ultimate economic owners behind the German PE vehicle are unknown, so 'EU economic majority' rests on Comitis's German domicile rather than a verified cap table.
- ?
Will the German owner keep data centers, management and the open-source/privacy posture in Switzerland long-term?
Continuity is a stated pledge, not a binding guarantee; a future shift of infra or governance would change every dimension.
- ?
Where exactly do the abroad group-call media routers sit, and under whose jurisdiction?
They carry only E2E-encrypted streams and log no identities, but their location is not disclosed, leaving a minor residual infra-jurisdiction gap.
EU Cloud Sovereignty Framework lens
SEAL was designed to rate cloud-service providers; this is an analogous sovereignty mapping for a messaging app, not a formal SEAL certification.
Strategic
Sovereign, privacy-first independent messenger — but now controlled by a German PE firm, with strategic direction set outside Switzerland and the EU proper.
Legal & jurisdictional
Swiss FADP and Swiss courts apply; strong and outside the CLOUD Act, but Switzerland is non-EU so EU/GDPR reach is only extraterritorial.
Data & AI
E2E encryption (NaCl), encrypted metadata, no phone number, data minimization by design, open-source apps; data stored exclusively in Switzerland.
Operational
HQ, dev and leadership in Switzerland; self-run, not dependent on a US hyperscaler.
Supply chain
Owns its servers but relies on a third-party ISO 27001 colocation partner; app distribution via Apple/Google stores is a US-platform dependency.
Technological
Open-source clients, audited cryptography, self-hostable (Threema OnPrem) — strong technological autonomy.
Security & compliance
ISO 27001 data centers, biometric access controls, independent security audits, GDPR/FADP-aligned privacy policy.
Environmental sustainability
No public, verifiable data on energy sourcing or carbon footprint of its data centers was found.
EU alternatives
EU-incorporated (Germany) secure messenger with E2E encryption; stronger on EU jurisdiction, but ownership has shifted toward US investors — verify current control.
Open Matrix protocol, fully self-hostable in the EU; the company is UK-based (non-EU post-Brexit), but the protocol can be run entirely under EU control.
German-owned, German-hosted encrypted communication; squarely within EU jurisdiction and GDPR for those who require EU residency over Swiss.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology