Profound
Partially CompliantUS enterprise AI visibility analytics platform. Not European: data is processed in the United States under Standard Contractual Clauses.
Subject to the US CLOUD Act: a US parent company can be compelled to disclose data it holds, including data stored in the EU.
Paidfrom $99/mo
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | United States |
| Ownership | Non-European |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | United States“Annex III lists every sub-processor as processing in the United States, with one exception listed as "United States, Germany"; infrastructure is AWS and Google Cloud.” |
| EU Servers Available | |
| Data Processing Agreement | View DPA |
| Sub-processor List | Not verified |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Last Verified | 11 August 2026 |
| Notes | US company. Read from its own DPA at tryprofound.com/legal/data-processing-agreement: all Annex III sub-processors process in the United States except Pylon Labs, Inc. ("United States, Germany"); infrastructure is AWS and Google Cloud operating primarily from the US; EU transfers use Module 2 (Controller-to-Processor) SCCs under Irish governing law, with the UK Addendum for UK transfers. The sub-processor list is embedded in Annex III rather than published separately. The DPA does not name the legal entity or its state of incorporation. |
About Profound
The American Benchmark in GEO
Profound is the best-funded platform in AI visibility analytics and the one most European teams end up comparing others against. It sits at the enterprise end: prompt-volume data on what users actually ask AI assistants, and analytics on how AI crawlers read a site.
It is listed here because European buyers evaluate it, not because it meets the criteria the rest of this directory is built around. It does not.
Where the Data Goes
Profound's own Data Processing Agreement is unusually clear, and worth reading before you buy:
- Every sub-processor in Annex III processes data in the United States, with a single exception listed as "United States, Germany"
- Infrastructure runs on AWS and Google Cloud, operating primarily from the US
- EU transfers rely on Module 2 (Controller-to-Processor) Standard Contractual Clauses, governed by Irish law, with the UK Addendum for UK transfers
That is a properly documented arrangement. It is also, unambiguously, US data processing with SCCs as the safeguard, which means US disclosure law reaches it in a way that no contractual clause overrides. Read the Schrems II checklist if that matters for your data.
If EU Residency Is a Requirement
It is not the tool for you, and the honest answer is to look at the European GEO platforms instead: Rankscale covers more engines, Peec AI is Berlin-registered, and Otterly.AI hosts its platform in Frankfurt. If it does not, Profound's depth is real and the DPA is one of the clearer ones in this category.
Key Features
Pros & Cons
Categories
Profound GDPR & data protection: common questions
Is Profound GDPR compliant?
Partly. Profound meets some of the requirements, with caveats worth reading before you commit. Profound is based in United States, outside the EU/EEA, data is hosted in the United States, and a Data Processing Agreement is published.
Where does Profound store data?
Profound states: "Annex III lists every sub-processor as processing in the United States, with one exception listed as "United States, Germany"; infrastructure is AWS and Google Cloud.". Data is hosted in the United States.
Does Profound offer a Data Processing Agreement (DPA)?
Yes. Profound publishes a DPA at https://www.tryprofound.com/legal/data-processing-agreement. A DPA is required under Article 28 GDPR whenever a provider processes personal data on your behalf.
What a DPA has to cover →Is Profound a European company?
No. Profound is based in United States, outside the EU/EEA. It may still be a sound choice (EU hosting and a signed DPA matter more than a flag) but the ownership is not European.
Is Profound subject to the US CLOUD Act?
Yes. US authorities can compel disclosure of data held by a US company or its subsidiaries, regardless of the country the servers sit in. EU hosting alone does not remove this, the question is who controls the data, not where the disk is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.
Schrems II compliance checklist →Related Tools

Rankscale
Austrian GEO platform tracking brand visibility across 17+ AI search engines, with citation analysis and AI-readiness page audits.

Visiblie
Belgian AI visibility platform tracking whether ChatGPT, Gemini and Perplexity name your brand, sold as a platform or as a done-for-you retainer.

Otterly.AI
Austrian AI search monitoring. Tracks brand mentions, links and sentiment in ChatGPT, Perplexity, Gemini and Google AI Overviews.
Spot an error in the compliance data? Get in touch