Mastodon
Verified“A genuinely European open-source town square — German-run, Hetzner-hosted, mid-transition to an EU nonprofit.”
- Protocol
- ActivityPub
- Hosting
- Hetzner 🇩🇪
- Funding
- Nonprofit / donations
- Team
- ~10-14 staff
79 = midpoint of Control 75 & Data 83
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 15 sourced facts across 8 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 72% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
78
Operating entity is Berlin-incorporated and fully within EU/GDPR reach. Deducted for the unfinished ownership transition and a US 501(c)(3) temporarily holding key assets.
Why 78? 4 sourced facts · click to expand
Operating entity registered in Berlin, Germany
joinmastodon.org/about · as of 2026-06-12
Lost German charitable (gGmbH) status when Germany removed software projects from eligibility
Mastodon Blog (Nov 2025) · as of 2025-11
Intended future home is a Belgian nonprofit, not yet legally established
Mastodon Blog (Nov 2025) · as of 2025-11
US 501(c)(3) temporarily holds the trademark and assets
joinmastodon.org/about · as of 2026-06-12
Control & Ownership
72
Founder gave up sole ownership to a European nonprofit path; no equity investors or listing. Held back because the trademark/assets currently sit in a US 501(c)(3) and the Belgian owner is not yet incorporated.
Why 72? 4 sourced facts · click to expand
Founder transferred sole ownership; project to be wholly owned by a European nonprofit
Mastodon Blog (Jan 2025) · as of 2025-01
Founder stepped down as CEO into an advisory role
TechCrunch · as of 2025-11-18
No equity investors and no stock-market listing; funded by donations
Mastodon Blog (Jan 2025) · as of 2025-01
US 501(c)(3) acts as interim asset-holder and fundraising hub
Mastodon Blog (Nov 2025) · as of 2025-11
Data →
Where your data lives and who can reach it
Data & Infrastructure
80
Flagship server runs on a German cloud provider (Hetzner), so user data sits on EU-owned infrastructure with no CLOUD Act exposure. The open protocol is self-hostable. Slight deduction because the official privacy policy text could not be fully retrieved to confirm storage specifics.
Why 80? 3 sourced facts · click to expand
mastodon.social is hosted on Hetzner, a German cloud provider
benjojo: Who hosts the fediverse · as of 2026-06-12
Software is open source and runs on the open ActivityPub protocol; instances are self-hostable
Mastodon documentation · as of 2026-06-12
Server is managed and moderated by the German Mastodon nonprofit
Privacy Guides · as of 2025-07-15
Operations & People
88
Headquartered in Berlin with EU-based leadership and a small EU-centered team, reporting in euros. Clearly EU-centered operations.
Why 88? 4 sourced facts · click to expand
Headquartered in Berlin, Germany
joinmastodon.org/about · as of 2026-06-12
Executive Director is EU-based; leadership team is EU-centered
TechCrunch · as of 2025-11-18
Operating budget reported in euros
Mastodon Blog (Jan 2025) · as of 2025-01
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Has the Belgian AISBL nonprofit been legally incorporated yet, and have the trademark and assets been transferred from the US 501(c)(3) to it?
Determines whether final ownership/control lands fully in the EU or stays partly under a US entity. Lowers ownership and legal confidence until completed.
- ?
Exactly where (which country/data center) does Hetzner store mastodon.social data, and does the official privacy policy name the hosting provider and any sub-processors (e.g. a CDN)?
Hetzner operates EU and non-EU regions; the privacy policy text could not be fully retrieved, so precise data residency is inferred rather than confirmed.
- ?
What share of the leadership and workforce is physically based in the EU vs. remote/US?
Board includes non-EU figures (e.g. Biz Stone, US); affects the operations and ownership-governance read.
EU Cloud Sovereignty Framework lens
SEAL framework targets cloud/SaaS providers; this is an analogous sovereignty mapping for a decentralized open-protocol social network, not a certification.
Strategic
Mission explicitly to keep the platform under European nonprofit control, not corporate ownership.
Legal & jurisdictional
EU operating entity in Berlin, but ownership transition incomplete and assets temporarily held by a US 501(c)(3).
Data & AI
User data on a German cloud provider (Hetzner); open protocol, no ad/AI data-broker model. No end-to-end encryption for DMs.
Operational
Berlin HQ, EU-based executive leadership, euro reporting, small dedicated team.
Supply chain
Core infra on EU provider Hetzner; specific sub-processors/CDN not publicly confirmed.
Technological
Fully open-source, built on the open ActivityPub standard; self-hostable and federated, avoiding single-vendor lock-in.
Security & compliance
Operates under GDPR; standard SSL. No end-to-end encryption for private messages.
Environmental sustainability
No verified data found on energy sourcing or sustainability reporting for the hosting footprint.
EU alternatives
The open protocol means you can run your own instance on EU infrastructure with full data control.
German-originated open-source ActivityPub-compatible social platform; federates with Mastodon.
Open-source federated photo-sharing on ActivityPub; project lead is Canada-based, but self-hostable in the EU.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology