Sovereignty Scan
Scanning domain: monday.com
We are checking DNS, hosting, detected tools and EU alternatives. Large sites can take a moment on the first request.
Sovereignty Scan
Scanning domain: monday.com
We are checking DNS, hosting, detected tools and EU alternatives. Large sites can take a moment on the first request.
27 of 32 detected tools fall under ( reach).
Vendor review recommended: 2 of 32 detected tools were assigned via the auto-imported database (TLD heuristics, without manual curation). Please verify the flagged matches before forwarding to the DPO.
We show the 3 easiest switches with matching EU alternatives.
Assessment
High CLOUD Act risk. Booking, marketing, and hosting run through providers with US ties.
Personal Data
HochContact, appointment and customer data in US tools.
Marketing Data
HochTracking, email lists, conversion data.
Infrastructure
HochHosting, CDN, DNS and email delivery.
The 3 biggest levers for monday.com
Sorted by impact per effort. The first switch typically delivers more than the next two combined.
Terminbuchung · Calendly Inc. (US)
Termin- und Kontaktdaten Ihrer Interessenten werden in den USA gespeichert. CLOUD Act gilt.
More than a fine
Fines make headlines, but rarely balance sheets. They arrive late, selectively, and are negotiable. What US tools cost you sooner is the sum of lost tenders, suspicious enterprise clients, a growing audit backlog, personal liability for your management, and a tool that could be shut down tomorrow with a single executive order.
Procurement
Federal, state, and enterprise procurement now make "EU hosting" and "CLOUD Act-free" knockout criteria. A single US tool in your stack is enough for disqualification — without ever making the shortlist.
by 2027
Federal administration sovereignty roadmap (BMI, "Sovereign IT 2027")
Trust & Churn
Since Schrems II, every serious procurement department checks the DPA annex. A US logo under "subprocessor" means a renewal negotiation — or a lost deal you never see as a lost deal.
73%
of GDPR-aware B2B buyers check subprocessors (Gartner, 2024)
Operational Burden
Every US tool requires its own Data Protection Impact Assessment, Standard Contractual Clauses, and a Transfer Impact Assessment. With every subprocessor change, the audit cycle restarts — usually unnoticed.
8–16 h
effort per tool and audit cycle, recurring
Management Liability
Under corporate governance law, those who ignore the state of the art are liable with personal assets, not the company treasury. D&O insurance regularly excludes GDPR intent and gross negligence.
Personal assets
of management in case of damage
Geopolitics
CLOUD Act, OFAC sanctions, a new Schrems ruling: when Washington pulls the plug, there is no transition period. Real precedent: in 2025, Microsoft blocked International Criminal Court accounts on US orders.
0 days
transition period for US embargo or account lockout
And when the authority does knock
Authorities in Germany investigate slowly but increasingly systematically. The expected value is lower than the headline, but the reach is not.
€50,000
realistic risk · max. €200,000 (Art. 83 (5) GDPR, up to 4% of annual revenue)
Detected Tools · 32 found
| Tool | Category | Hosting | Owner | Risk | EU Alternative |
|---|---|---|---|---|---|
Calendlyin product CSP-Header → assets.calendly.com | Terminbuchung | AWS US-East-1 | Calendly Inc. US · CLOUD Act DPF | Hoch | |
Qualtrics SPF-ASN → QUALTRICS-01 - Qualtrics LLC, US | Umfragen / Research | AWS US | Qualtrics LLC US · CLOUD Act | Hoch | |
Demandbase JS-Bundle → .demandbase.com/ | Account-Based Marketing | AWS US | Demandbase, Inc. US · CLOUD Act | Hoch | |
DocuSign Skript / Iframe → docusign.net | E-Signatur | AWS / Azure (Global, EU-Region möglich) | DocuSign Inc. US · CLOUD Act | Hoch | |
HubSpot JS-Bundle → js.hs-scripts.com | CRM / Formulare | AWS US-East-1 | HubSpot Inc. US · CLOUD Act DPF | Hoch | |
Qualified Skript / Iframe → .qualified.com/ | Conversational Marketing / Pipeline | AWS US | Qualified.com Inc. US · CLOUD Act | Hoch | |
Salesforce SPF → _spf.salesforce.com | CRM | Salesforce Hyperforce | Salesforce Inc. US · CLOUD Act DPF | Hoch | |
 Amazon Advertising JS-Bundle → .amazon-adsystem.com | Ad-Tech / Retail Media | AWS US | Amazon.com, Inc. US · CLOUD Act | Hoch | |
 Amazon CloudFront HTTP-Header via → 1.1 729df732e462051d839fc78e4d6ecec6.cloudfront.net (Clou… | CDN | AWS Edge (Global) | Amazon Web Services Inc. US · CLOUD Act DPF | Mittel | |
Amazon SES SPF-ASN → AMAZON-AES - Amazon.com, Inc., US | Transaktions-E-Mail | AWS (Region je nach Account) | Amazon Web Services Inc. US · CLOUD Act DPF | Hoch | |
cdnjs JS-Bundle → cdnjs.cloudflare.com | JavaScript-CDN | Cloudflare Anycast (global) | Cloudflare, Inc. (Betreiber + Maintainer) US · CLOUD Act | Mittel | |
Cloudflare HTTP-Header cf-ray → 9f5f2715eaef9e55-CDG | CDN | Anycast (Global) | Cloudflare Inc. US · CLOUD Act DPF | Mittel | |
FullStory Skript / Iframe → edge.fullstory.com | Session-Replay | GCP US | FullStory Inc. US · CLOUD Act | Hoch | |
Google Analytics JS-Bundle → G-9HZ2RE5VH7 | Analytics | Google Cloud (Global) | Alphabet Inc. US · CLOUD Act DPF | Hoch | |
Google Mail Sending SPF → _spf.google.com | Ausgehender E-Mail-Versand | Google Cloud (Global) | Alphabet Inc. US · CLOUD Act DPF | Hoch | |
Google Tag Manager Skript / Iframe → googletagmanager.com/gtm.js | Tag Management | Google Cloud (Global) | Alphabet Inc. US · CLOUD Act DPF | Hoch | |
Google Workspace MX-Record → alt1.aspmx.l.google.com | Office-Suite / E-Mail | Google Cloud (Global) | Alphabet Inc. US · CLOUD Act DPF | Hoch | |
jsDelivr JS-Bundle → cdn.jsdelivr.net | JavaScript-CDN | Multi-CDN: Cloudflare, Fastly, Bunny, G-Core (load-balanced) | Prospect One sp. z o.o. (jsDelivr-Maintainer) EU · CLOUD Act | Mittel | |
LinkedIn Insight Tag JS-Bundle → snap.licdn.com/li.lms-analytics | Tracking-Pixel | Azure | Microsoft Corp. US · CLOUD Act DPF | Mittel | |
Mailchimp SPF → servers.mcsv.net | E-Mail-Marketing | AWS US-East-1 | Intuit Inc. US · CLOUD Act DPF | Hoch | |
Microsoft Advertising JS-Bundle → bat.bing.com/bat.js | Werbe-Tracking (Bing Ads) | Azure US | Microsoft Corporation US · CLOUD Act | Hoch | |
PartnerStack JS-Bundle → .growsumo.com | Analytics | Cloudflare | PartnerStack Global | Niedrig | |
Pinterest Conversion Tagin product CSP-Header → s.pinimg.com | Marketing-Pixel | Pinterest Cloud (US) | Pinterest, Inc. US · CLOUD Act | Hoch | |
Rackspace Email SPF-ASN → RACKSPACE - Rackspace Hosting, US | Geschäfts-E-Mail | Rackspace (US/UK/DE) | Rackspace Technology US · CLOUD Act | Hoch | |
Reddit Ads JS-Bundle → www.redditstatic.com | Analytics | Fastly | Reddit Ads Global | Niedrig | |
SendGrid SPF-ASN → SENDGRID - SendGrid, Inc., US | Transaktions-E-Mail | AWS US | Twilio (SendGrid) US · CLOUD Act | Hoch | |
Sentry JS-Bundle → Sentry.init( | Error-Tracking | GCP US | Functional Software Inc. US · CLOUD Act DPF | Mittel | |
The Trade Desk JS-Bundle → .adsrvr.org/ | Demand-Side Platform (DSP) | USA (eigene Infrastruktur) | The Trade Desk, Inc. US · CLOUD Act | Hoch | |
VeraSafe Skript / Iframe → www.verasafe.com/ | Analytics | Cloudflare | VeraSafe Global | Niedrig | |
Wistia JS-Bundle → fast.wistia.com | Video-Hosting | AWS US | Wistia Inc. US · CLOUD Act | Mittel | |
WordPress Meta-Generator → WordPress 6.7.1 | CMS (Open-Source) | Self-Hosted (variabel) | WordPress Foundation (Open-Source) bzw. betreibender Host Other | Niedrig | |
WPML Skript / Iframe → /wp-content/plugins/sitepress-multilingual-cms/ | Analytics | AWS | WPML Global | Niedrig |
Calendly
Terminbuchung
EU Alternative
+2Qualtrics
Umfragen / Research
EU Alternative
+2Demandbase
Account-Based Marketing
EU Alternative
+2DocuSign
E-Signatur
EU Alternative
+2HubSpot
CRM / Formulare
EU Alternative
+2Qualified
Conversational Marketing / Pipeline
EU Alternative
+2Salesforce
CRM
EU Alternative
+2Amazon Advertising
Ad-Tech / Retail Media
EU Alternative
+2Amazon CloudFront
CDN
EU Alternative
+2Amazon SES
Transaktions-E-Mail
EU Alternative
+2cdnjs
JavaScript-CDN
EU Alternative
+2Google Analytics
Analytics
EU Alternative
+2Google Mail Sending
Ausgehender E-Mail-Versand
EU Alternative
+2Google Tag Manager
Tag Management
EU Alternative
+2Google Workspace
Office-Suite / E-Mail
EU Alternative
+2jsDelivr
JavaScript-CDN
EU Alternative
+2LinkedIn Insight Tag
Tracking-Pixel
EU Alternative
+2Mailchimp
E-Mail-Marketing
EU Alternative
+2Microsoft Advertising
Werbe-Tracking (Bing Ads)
EU Alternative
+2Pinterest Conversion Tag
Marketing-Pixel
EU Alternative
+2Rackspace Email
Geschäfts-E-Mail
EU Alternative
+2Sentry
Error-Tracking
EU Alternative
+2The Trade Desk
Demand-Side Platform (DSP)
EU Alternative
+2WordPress
CMS (Open-Source)
EU Alternative
+2Session-Replay
Transaktions-E-Mail
Eight pages: legal classification per tool, migration effort, prioritized roadmap. Ready to use in the boardroom or with your Data Protection Officer.
The DPO decides on DPAs, TIAs, and subprocessor approvals. With one click, they receive a compact summary of this scan, directly in their inbox.
Share Kit · for LinkedIn, X, TikTok & more
A card with logo, grade, and detected tools. On LinkedIn and X it auto-renders large; for TikTok & Reels there's a 9:16 format to download.
Suggested text
I just ran monday.com through meetergo's Sovereignty Scan. Result: Grade E (23/100). 27 of 34 detected tools fall under US jurisdiction (CLOUD Act reach). Detected US tools: Calendly, Qualtrics, Demandbase, DocuSign + 23 more. The score is a risk indicator, not a GDPR verdict — but exactly the overview I want on the table at the next third-country transfer discussion. How sovereign is your own web stack?
Ends with a question on purpose — the algorithm likes questions.
Trust page, footer, RFP response. Updates automatically after every re-scan. Clicking the image opens the full report.
<a href="https://scan.meetergo.com/de/r/monday.com" target="_blank" rel="noopener" aria-label="monday.com: Sovereignty-Score E – meetergo Sovereignty Scan"> <img src="https://meetergo.com/scan/api/og?domain=monday.com&grade=E&score=23&tools=34&us=27&logo=monday.com&theme=light&eu=32&tools_list=Calendly%2CQualtrics%2CDemandbase%2CDocuSign" alt="monday.com: Sovereignty-Score E – meetergo Sovereignty Scan" width="600" height="315" loading="lazy" style="max-width:100%;height:auto;border-radius:14px;border:1px solid #e5e5e5" /> </a>
Embed Badge
Switch two US tools, re-scan. The code below will then show the new grade.
<a href="https://scan.meetergo.com/de/r/monday.com" target="_blank" rel="noopener" aria-label="Sovereignty Score: E – monday.com">
<iframe src="https://scan.meetergo.com/scan/api/badge/monday.com?variant=card&theme=light" width="360" height="240"
title="Sovereignty Score: E – monday.com" loading="lazy"
style="border:0;display:block;max-width:100%"
sandbox="allow-popups allow-popups-to-escape-sandbox"></iframe>
</a>Instead
meetergo
1-Klick-Import aus Calendly: Event-Types, Verfügbarkeiten und Routing direkt übernehmen. Server in Frankfurt, DSGVO-konform.
Umfragen / Research · Qualtrics LLC (US)
Umfrage- und CX-Research über Qualtrics (US), Befragten-Antworten gelangen in den US-Rechtsraum.
Instead
meetergo
Formulare, CRM und Terminbuchung in einer Plattform: DSGVO-fertig, mit 1-Klick-Import aus Typeform.
Account-Based Marketing · Demandbase, Inc. (US)
Demandbase, Inc. (San Francisco, CA) ist eine US-amerikanische ABM-Plattform (hat Engagio übernommen). Firmendaten und IP-Intelligence werden in den USA verarbeitet; CLOUD Act gilt.
Instead
meetergo
Lite-CRM mit Kontakten, Notizen und Pipeline, direkt mit Buchungen verknüpft.
34entries
27TIAs
34DPAs
Legal basis: GDPR Art. 28, 30, 44 ff. · EDPB Recommendations 01/2020 (Schrems II).
Sorted by effort. Expand a row for details.
Terminbuchung
Per 1-Klick-Import übernehmen Sie Event-Types, Verfügbarkeiten und Routing-Regeln aus Calendly direkt in meetergo, kein CSV-Hantieren, kein manueller Nachbau.
Time-to-Value: Live in <1 Tag dank 1-Klick-Import
Umfragen / Research
Formularlogik (Branching, Routing) und Felder werden 1:1 in EU-Smart-Forms überführt.
Time-to-Value: 3–5 Werktage
Account-Based Marketing
CRM-Migration via natives Export-Tool oder API; Kontakte, Deals, Properties bleiben erhalten. Aufwand entsteht durch Workflow-Rebuild.
Time-to-Value: Migration in ~3 Werktagen
E-Signatur
Buchung → Vertrag → Signatur in einem Flow, ohne Tool-Wechsel.
Time-to-Value: Buchungs-Signatur sofort, Vollmigration 2–4 Wochen
CRM / Formulare
Native HubSpot-Integration: Kontakte, Deals und Properties syncen bidirektional.
Time-to-Value: Integration in 1 Werktag
Conversational Marketing / Pipeline
Chat-Verläufe per Export/API ziehen (für Compliance-Archiv), Snippet austauschen, Routing/Kanäle in EU-Tool nachbauen.
Time-to-Value: Migration in ~3 Werktagen
CRM
CRM-Migration via natives Export-Tool oder API; Kontakte, Deals, Properties bleiben erhalten. Aufwand entsteht durch Workflow-Rebuild.
Time-to-Value: 2–6 Wochen
Ad-Tech / Retail Media
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Transaktions-E-Mail
API-Endpoint umbiegen, DKIM/SPF auf den neuen Sender anpassen, E-Mail-Templates portieren. DKIM-Validierung ist der pfadkritische Schritt.
Time-to-Value: 1–2 Wochen
Session-Replay
Aufzeichnungen sind nicht migrierbar. Neuer Recorder ab Cutover-Tag; Heatmap-Baseline muss sich erst aufbauen.
Time-to-Value: 1 Werktag (Setup) + ~30 Tage Datenaufbau
Analytics
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Ausgehender E-Mail-Versand
API-Endpoint umbiegen, DKIM/SPF auf den neuen Sender anpassen, E-Mail-Templates portieren. DKIM-Validierung ist der pfadkritische Schritt.
Time-to-Value: 1–2 Wochen
Tag Management
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Tracking-Pixel
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
E-Mail-Marketing
API-Endpoint umbiegen, DKIM/SPF auf den neuen Sender anpassen, E-Mail-Templates portieren. DKIM-Validierung ist der pfadkritische Schritt.
Time-to-Value: 1–2 Wochen
Werbe-Tracking (Bing Ads)
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Analytics
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Marketing-Pixel
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Analytics
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Transaktions-E-Mail
API-Endpoint umbiegen, DKIM/SPF auf den neuen Sender anpassen, E-Mail-Templates portieren. DKIM-Validierung ist der pfadkritische Schritt.
Time-to-Value: 1–2 Wochen
Error-Tracking
DSN-URL austauschen, SDKs bleiben kompatibel (GlitchTip ist Sentry-API-kompatibel). Alte Issues bleiben in der alten Instanz.
Time-to-Value: 3–5 Werktage
Demand-Side Platform (DSP)
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Analytics
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
Video-Hosting
meetergo ersetzt kein Video-Hosting. Quick-Win: Privacy-Embed (z.B. youtube-nocookie.com) mit Consent-Gate. Vollwechsel: EU-Video-Hosting (Vimeo EU-Region, Bunny Stream EU/Slowenien, selbst gehostetes Peertube). Embeds und Player-IDs austauschen.
Time-to-Value: 1–3 Werktage pro Plattform (Embed-Swap)
Analytics
Tag austauschen, Goals/Ziele neu konfigurieren, ggf. Daten via API/BigQuery für Vergleichsperiode exportieren.
Time-to-Value: 1–2 Wochen
CDN
DNS auf neuen CDN umstellen (TTL vorher senken), Cache-Regeln und WAF-Policies portieren, Origin-IPs ggf. neu verstecken.
Time-to-Value: 1–2 Wochen
JavaScript-CDN
DNS auf neuen CDN umstellen (TTL vorher senken), Cache-Regeln und WAF-Policies portieren, Origin-IPs ggf. neu verstecken.
Time-to-Value: 1–2 Wochen
CDN
DNS auf neuen CDN umstellen (TTL vorher senken), Cache-Regeln und WAF-Policies portieren, Origin-IPs ggf. neu verstecken.
Time-to-Value: 1–2 Wochen
Office-Suite / E-Mail
MX-Cutover mit Doppelbetrieb in der Übergangsphase; Mail-Migration via IMAP, Kalender und Drive-Files separat.
Time-to-Value: 4–8 Wochen
JavaScript-CDN
DNS auf neuen CDN umstellen (TTL vorher senken), Cache-Regeln und WAF-Policies portieren, Origin-IPs ggf. neu verstecken.
Time-to-Value: 1–2 Wochen
Geschäfts-E-Mail
MX-Cutover mit Doppelbetrieb in der Übergangsphase; Mail-Migration via IMAP, Kalender und Drive-Files separat.
Time-to-Value: 4–8 Wochen
CMS (Open-Source)
DevOps-Projekt: IaC (Terraform/Pulumi) auf europäischen Anbieter migrieren, Daten via Transfer-Service, am Ende DNS-Cutover. Greenfield-Workloads sind schneller als Migrationen.
Time-to-Value: 2–6 Monate
Fastest lever: Booking & lead routing. Infrastructure (hosting, DNS, CDN) is a separate project.
Operational Signals
Five operational signals that any DNS resolver or TLS handshake exposes. They show who's behind the domain — even when the brand promises something different.
Cookies the server sets on the very first visit, before anyone clicks a cookie banner.
Cryptographic signature of DNS responses. Prevents attackers from redirecting the domain to malicious servers.
Encrypts the connection between browser and website. The Certificate Authority (CA) guarantees the domain belongs to the stated owner.
Who actually owns the website's IP address. Shows the real hosting corporation, even if the contractual partner is different.
Hostname the IP points back to. Often unset for Anycast CDNs (Cloudflare, Vercel).
Capped per bucket, low-confidence hits weighted half, EU vendors not deducted.
Total deductions: −80 · Sovereignty bonus: +3
0 cookie(s) set before consent.
The Sovereignty Scan evaluates publicly accessible signals (homepage and legal page HTML, DNS, MX, SPF, and ASN data) and compares them against our database of approximately 3,000 vendors. The mapping of tools to owners and jurisdictions is based on public sources (legal notices, privacy policies, Wappalyzer, RIPE/ARIN registrations) and is intended as a first indication at the time of evaluation, not a legally binding assessment.
The A–E grade is a risk indicator, not a GDPR compliance verdict. For a concrete GDPR assessment — especially regarding Data Processing Agreements (DPA), Standard Contractual Clauses (SCC), and Transfer Impact Assessments (TIA) — please consult your Data Protection Officer or external legal counsel. meetergo makes no claim as to whether a specific vendor can be used in a GDPR-compliant manner in any particular use case.
Correction & Response: If you are the domain owner, Data Protection Officer, or press office of the assessed domain and the signals shown here do not reflect your current tool configuration, we welcome corrections and will update the listing promptly after review.
Weniger Anbieter, weniger AV-Verträge, weniger Datenschutzaufwand. Eine deutsche Plattform für Buchung, Qualifizierung, Signatur und Sales-Content, DSGVO-konform mit Servern in Frankfurt.
Enterprise-Hinweis: Eine Plattform = ein AV-Vertrag, ein Auditschnitt. Reduziert die Compliance-Last erheblich.