pCloud
Verified“Swiss-incorporated, Bulgaria-run, and the only cloud locker that owns its own EU iron.”
- Users
- 22M+
- Founded
- 2013
- External funding
- ~$3M
- Owns its DCs
- Yes
56 = midpoint of Control 52 & Data 60
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 12 sourced facts across 6 independent sources, last verified 2026-06-12. 4 open questions hold confidence at 72% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
48
Incorporated and headquartered in Switzerland (pCloud International AG, Baar) — outside the EU, so EU law does not reach the parent directly, though Switzerland has GDPR-adequacy and the firm names itself GDPR data controller. Operational base and bulk of staff are in Sofia, Bulgaria (EU member), which gives meaningful EU nexus. EU-operating under a non-EU (Swiss) home = mid-band.
Why 48? 3 sourced facts · click to expand
Legal entity and seat
NorthData (Swiss commercial register) · as of 2026-06-12
Named EU data controller
pCloud Privacy Policy · as of 2026-06-12
Operational base in the EU
Wikipedia: pCloud · as of 2026-06-12
Control & Ownership
55
Privately held and founder-controlled (Tunio Zafer, Anton Titov), with only a single ~$3M Series A (2015) from unnamed private investors — no US venture capital, no public listing, no foreign parent identified. Control sits with EU/CH-resident founders. But the holding entity is Swiss (non-EU), and the exact cap table/economic split is undisclosed, capping confidence below the EU-economic-majority band.
Why 55? 3 sourced facts · click to expand
Founders and control
Wikipedia: pCloud · as of 2026-06-12
Total external funding
Business Wire · as of 2026-06-12
Current board
NorthData (Swiss commercial register) · as of 2026-06-12
Data →
Where your data lives and who can reach it
Data & Infrastructure
58
Genuinely differentiated: pCloud owns and operates its own data centers and explicitly does NOT rent from AWS, Google Cloud or Azure, so an EU customer choosing the EU region keeps data on self-owned hardware in Luxembourg (EU) with no US hyperscaler in the path — a strong residency posture. Scored mid-high rather than top-band because the only alternative region is Dallas, Texas (US, CLOUD Act exposed); the Swiss parent is non-EU; and the specific Luxembourg colocation/facility operator is undisclosed.
Why 58? 3 sourced facts · click to expand
Owns its infrastructure, no hyperscaler
Cloudwards: pCloud EU vs US servers · as of 2026-06-12
EU data region location
pCloud Data Regions · as of 2026-06-12
US region jurisdiction risk
Cloudwards: pCloud EU vs US servers · as of 2026-06-12
Operations & People
62
Day-to-day operations, engineering and the majority of staff are in Sofia, Bulgaria (EU); leadership (Zafer, Titov) is EU/CH-based. The corporate HQ and reporting home is Switzerland (non-EU), and the US Dallas footprint plus global, USD-leaning consumer pricing pull it toward mixed rather than fully EU-centered. EU-leaning overall.
Why 62? 3 sourced facts · click to expand
Operational headquarters
Wikipedia: pCloud · as of 2026-06-12
Leadership
Wikipedia: pCloud · as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
4 open questions — they lower confidence, never the score
- ?
Who hosts/operates pCloud's Luxembourg facility (which colocation provider, and is the hardware fully pCloud-owned)?
Determines how much of the EU residency claim rests on self-owned vs. third-party EU infrastructure — affects infra confidence.
- ?
Exact shareholder cap table and economic-ownership split of pCloud International AG.
Founders are named but precise voting/economic majority and any minority investors are undisclosed — limits ownership scoring certainty.
- ?
Full named sub-processor list (payment, analytics, monitoring) and their jurisdictions.
Even with EU-region storage, US sub-processors for billing/analytics could reintroduce foreign-law data exposure.
- ?
Is the original Bulgarian operating company (pCloud Ltd) still the employer/processor, and how does it relate to the 2022 Swiss AG?
Clarifies whether the EU nexus (Bulgaria) is the substantive operator or just a branch under the Swiss parent.
EU Cloud Sovereignty Framework lens
SEAL targets cloud infrastructure providers; this is an analogous sovereignty mapping for a consumer/business storage service, not a SEAL certification.
Strategic
Founder-owned, profitable, no foreign parent or US capital — but strategically anchored in Switzerland (non-EU), not the Union.
Legal & jurisdictional
Swiss-incorporated (GDPR-adequate, non-EU) with EU operational nexus in Bulgaria; names itself EU data controller.
Data & AI
EU region pins all files/metadata/backups to Luxembourg on self-owned hardware; US Dallas region is opt-in and CLOUD Act-exposed.
Operational
Run from Sofia, Bulgaria (EU) with EU-based founders; legal HQ and reporting home remain Swiss.
Supply chain
Avoids US hyperscalers for storage — a real supply-chain win — but full sub-processor (billing/analytics) jurisdictions are undisclosed.
Technological
Owns and operates its own data centers rather than reselling AWS/Azure/GCP capacity; offers client-side (zero-knowledge) encryption.
Security & compliance
Claims GDPR compliance, Swiss privacy law and zero-knowledge crypto; no independent SEAL/ISO certification verified here.
Environmental sustainability
No data center energy or sustainability disclosures found in this review.
EU alternatives
Spain-incorporated, EU-operated zero-knowledge cloud storage — fully EU jurisdiction for both control and data.
End-to-end encrypted, EU data residency and Hungarian engineering roots, but now owned by Swiss Post (Swiss, non-EU parent) like pCloud's Swiss home.
Independently owned, runs its own Swiss data centers — strong sovereignty story but Switzerland is outside the EU, same caveat as pCloud.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology