Vivaldi

Incorporated and operated entirely within the EEA — Vivaldi Technologies AS in Oslo, with the main software operation split Norway/Iceland. GDPR applies in full and EU consumers are protected, but the decisive limiter is that neither Norway nor Iceland is an EU member state. Vivaldi sits inside the EEA single market yet outside EU treaty jurisdiction, the CJEU's direct reach, and EU institutional enforcement — hence a mid-band rather than top-band score.

Founder- and employee-owned with no external/foreign capital. The operating company's parent is Vivaldi Invest AS — also Norwegian — and founder Jon von Tetzchner is the principal backer; the company publicly states it has no external investors. Voting control and economic majority are firmly Nordic/EEA. Not scored higher only because both the parent and the listing/economic base are Norway (EEA), not an EU member state, and the precise cap table is not fully public.

Among the strongest infra stories in this index for a non-EU-incorporated firm: Vivaldi runs its OWN servers in Iceland (Hringdu data centers) for sync, telemetry pings, the Lingvanex translation engine, and Vivaldi Social — no US hyperscaler in the path and therefore no CLOUD Act / FISA 702 exposure. Sync is end-to-end encrypted. Held below the top band because Iceland is EEA (not EU) and the data sits outside EU-member jurisdiction, and because the browser itself is ~95% Chromium (Google-steered engine upstream).

Operationally Nordic-centered: HQ in Oslo, second hub in Seltjarnarnes/Reykjavik (Iceland), Icelandic-Norwegian founder-CEO and a Norwegian-registered workforce. Roughly 60 staff across seven countries, 25 nationalities — overwhelmingly EEA. A small US office in Gloucester, Massachusetts and developer presence outside Europe slightly dilute the otherwise EEA-centered footprint; kept below top band because the operating center of gravity is EEA rather than EU-member soil.