Olvid
Verified“Fully French company. End-to-end EU control — running on Amazon's cloud.”
- Founded
- 2019
- Users
- ~100k
- Certification
- ANSSI CSPN
- Servers
- AWS
73 = midpoint of Control 88 & Data 57
Sovereignty Quadrant
Control ↑ who owns & governs the company · Data → where your data lives. Every dot is a company — click to open it.
Every number below traces to 12 sourced facts across 6 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 78% — they lower confidence, never the score.
Control ↑
Who legally and economically controls the company
Legal & Jurisdiction
90
Incorporated and operated entirely in France as a Société par actions simplifiée (SAS), registered with the Paris commercial court (RCS Paris B 850 667 171), HQ at 26 rue Vignon, 75009 Paris. No foreign parent or holding structure. Fully within reach of French and EU law (GDPR), and the data controller is the French entity itself.
Why 90? 3 sourced facts · click to expand
Legal form and registry
societe.com (RCS Paris record) · as of 2024-07-31
Incorporation date and registered office
societe.com · as of 2024-07-31
Applicable law and data controller
Olvid Privacy Policy · as of 2026-06-12
Control & Ownership
85
Founder-led private French company. CEO/president Thomas Baignères and CTO Matthieu Finiasz (both cryptography PhDs) co-founded it; backers are French (BNP Paribas, Wilco, Agoranov, plus French Tech support). Not listed on any exchange and total funding is small (~$2M), so economic and voting control sit in France. Exact current cap table is access-restricted at the registry, hence not 95+.
Why 85? 3 sourced facts · click to expand
President / controlling founder
societe.com · as of 2024-07-31
Investors are French / no foreign parent
CB Insights / Dealroom (aggregator) · as of 2026-06-12
Beneficial-owner detail gated at registry
societe.com · as of 2024-07-31
Data →
Where your data lives and who can reach it
Data & Infrastructure
35
Olvid's own privacy policy states the servers run on AWS, a US hyperscaler exposed to the US CLOUD Act — the rubric caps this. The strong mitigant is architecture: identities, keys and all metadata stay on the user's device; servers only ever see IP addresses (which Olvid says it does not store) and end-to-end-encrypted blobs, so they 'play no role in security.' Practical data exposure is minimal, but the metal is non-EU-owned and the exact AWS region (EU vs global) is not publicly confirmed.
Why 35? 3 sourced facts · click to expand
Zero-knowledge server design
Olvid Privacy Policy · as of 2026-06-12
Identity/keys kept client-side
Wikipedia (Olvid software) · as of 2026-06-12
Operations & People
90
HQ and all operations in Paris; French leadership and engineering team (~10-19 staff); reports in euros; product is ANSSI-certified (first messaging app to earn CSPN) and mandated for French government use. Entirely EU-centered organisation.
Why 90? 3 sourced facts · click to expand
ANSSI CSPN security certification
ANSSI certification report · as of 2021-05-17
French government adoption mandate
Euronews · as of 2023-11-30
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) →
What we don’t know
3 open questions — they lower confidence, never the score
- ?
Which AWS region(s) host Olvid's servers — EU (e.g. Ireland/Paris) or global?
If non-EU regions are used, data-residency and CLOUD Act exposure rise; EU regions would partially mitigate. Architecture limits the practical impact either way.
- ?
Exact current cap table and any institutional stake sizes
Registry beneficial-owner data is access-gated; cannot fully rule out a large minority investor, though all known backers are French.
- ?
Whether Olvid plans to migrate to a sovereign/EU cloud (e.g. OVHcloud, Scaleway)
A move off AWS would lift the infra score materially and remove the only real sovereignty asterisk.
EU Cloud Sovereignty Framework lens
SEAL (Sovereign European Assessment Layer) is an analogous mapping, not a certification; the underlying framework targets cloud providers, so this is an indicative read for a SaaS messenger, not an audited result.
Strategic
French-owned, founder-controlled, government-endorsed sovereign communications product; no foreign strategic dependency at the company level.
Legal & jurisdictional
French SAS, GDPR data controller, fully within EU/French legal reach; competent courts French.
Data & AI
Zero-knowledge architecture: E2E-encrypted data and metadata, keys and identities stay on-device; servers cannot read content or social graph.
Operational
HQ, leadership and engineering all in Paris; euro reporting; small but fully EU-based team.
Supply chain
Core hosting depends on AWS, a US hyperscaler; exact region unconfirmed. Single non-EU cloud dependency.
Technological
Strong in-house cryptography and open AGPL client; but runs on US cloud infrastructure rather than an EU-owned stack.
Security & compliance
ANSSI CSPN certified (first messenger to achieve it); adopted by French government and RAID police unit.
Environmental sustainability
No public environmental/sustainability disclosure found for Olvid.
EU alternatives
French-government-built Matrix-based messenger for civil servants; sovereign but restricted to public-sector users, not a general consumer/enterprise option.
Open Matrix protocol, self-hostable on EU sovereign cloud; vendor (Element) is UK-based post-Brexit, so 'EU' depends on your own hosting choices.
Strong privacy-first encrypted messenger hosted in Switzerland — European but outside the EU, so not under EU law/enforcement.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes — Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced — challenge it and we correct the record.
- 2026-06-12 — Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 · Human + AI joint review (sources independently checked) · Methodology