
Unleash
Partially CompliantOpen-source feature management platform from Bricks Software AS in Oslo, Norway, with a free self-hosted tier, SOC2/ISO27001-certified hosted Enterprise plans, and a customer choice between EU and US data residency.
Subject to the US CLOUD Act: a US provider in this tool's processing chain can be compelled to disclose data it holds, including data stored in the EU. The vendor itself is European-owned.
Open Sourcefrom Free (self-hosted, open source); hosted Enterprise from $75/seat/month
GDPR Compliance Data
Not independently verified| GDPR Status | Partially Compliant |
| HQ Country | Norway |
| Ownership | European-owned |
| Foreign Disclosure Exposure | US CLOUD Act / FISA 702 |
| Data Hosting Location | Global"Data residency options in the US or EU" listed as Included on both pricing tiers (getunleash.io/pricing, read raw 2026-09-07). Subprocessors page: AWS, "Customer hosted instances. User accounts," Location "EU or US*", footnoted "*AWS Region depends on each customer selection. Options: Europe (Frankfurt) or US-East" (getunleash.io/subprocessors, read raw 2026-09-07). This is a customer-selected choice, not an EU default applied automatically. |
| EU Servers Available | |
| Data Processing Agreement | Not verified |
| Sub-processor List | View sub-processors |
| Schrems II Risk | Medium Risk |
| SCCs in Place | |
| Last Verified | 7 September 2026 |
How we reached this
Norwegian legal entity for non-US customers: Bricks Software AS, Edvard Storms gate 2, 0166 Oslo, Norway; a separate Bricks Software Inc. (2261 Market Street STE 86259, San Francisco, CA) is named in the Terms of Service as the contracting entity for US-located customers only, read raw 2026-09-07. No document reviewed states the parent/subsidiary relationship between the two, so ownershipOrigin is recorded as EU_OWNED on the basis that the entity a European customer actually contracts with is Norwegian, but the dual-entity structure is flagged rather than treated as settled. PARTIAL rather than COMPLIANT for a documentation-quality reason unusual in this directory: the paperwork itself is unusually thorough (a full GDPR processor DPA with EU Commission SCCs 2021/914/EU incorporated by reference, correct Module/Clause selections for EEA, UK and Swiss transfers, and a published subprocessors table), but what it discloses is that EU hosting is opt-in rather than default -- the subprocessors page states the AWS region "depends on each customer selection" between Europe (Frankfurt) and US-East, and two of the three named subprocessors (Zendesk for support, LogRocket for free-trial session recording) are US-based regardless of the customer's AWS region choice. dataHostingLocation is recorded as GLOBAL rather than EU because both regions are genuinely offered and neither is stated as the default a customer receives by doing nothing. extraterritorialExposure is US_CLOUD_ACT because AWS, Zendesk and LogRocket are all US companies and the CLOUD Act reaches data any of them physically holds regardless of the AWS region a customer selects, consistent with the reasoning applied to Vainu and SEO.AI elsewhere in this directory. schremsIIRisk MEDIUM reflects the SCCs being properly in place (sccInPlace true) against the residual US-subprocessor exposure. dpaEvidence PUBLISHED: the DPA is a complete, specific document at its own URL, not a generic template. LogRocket session recording masks user input and PII by default per the Privacy Policy and applies only to free-trial users, processed under its own DPA with SCCs per that same policy.
About Unleash
Feature Flags First, Experimentation as One Use Case
Unleash is not built primarily as an A/B testing tool the way Optimizely, AB Tasty or Kameleoon are; it is a feature flag and progressive-delivery platform where A/B/n testing with flag variants is one of several use cases alongside gradual rollouts, canary releases and kill switches. For a team whose "experiments" are really staged feature rollouts with measurement attached rather than marketing-page optimisation, that is a meaningfully different tool than a visual-editor testing suite, and it belongs in this comparison for exactly that reason.
What It Does
- Unlimited feature flags, projects and environments on every plan, including the free open-source tier
- A/B/n testing with flag variants and user segmentation & stickiness
- Impact metrics, automated progression, and safeguards for rollout monitoring
- Four-eyes approval and change request workflows for flag changes
- 25+ official SDKs, with server-side SDKs evaluating flags locally so no end-user data leaves the customer's own infrastructure
- SOC2 Type II, ISO27001 and FedRAMP-track compliance on hosted Enterprise plans
Genuinely Open Source, Not Source-Available
The core is licensed AGPLv3 (Apache 2.0 for official Docker images and pre-v8 releases), self-hostable on Docker or Kubernetes, with no seat limit -- capped at 1 project, 2 environments and 5,000 feature flags per instance, which is a real ceiling but a workable one for most teams starting out. Thousands of teams reportedly run it in production this way with no bill at all.
Unleash Enterprise Pay-As-You-Go is $75/seat/month, billed monthly with a 14-day free trial and no contract; annual Enterprise is custom-quoted. Client-side monthly active users and flag evaluations are never billed on either tier, which matters for a tool whose whole job is being evaluated constantly in production.
EU or US Hosting -- A Real Choice, Not an EU Default
The pricing page states plainly: "Data residency options in the US or EU. Included [on both Pay-As-You-Go and annual Enterprise]." The published subprocessors page is more specific still: AWS is listed as a subprocessor for "Customer hosted instances. User accounts," located *"EU or US"**, with the footnote: "AWS Region depends on each customer selection. Options: Europe (Frankfurt) or US-East."
That means a European customer who wants EU-only hosting has to select it; it is not the default a customer gets by doing nothing, and two of the three named sub-processors -- Zendesk (support) and LogRocket (session recording, free-trial users only) -- are US-based regardless of which AWS region a customer picks. The Data Processing Agreement is thorough on the legal side of this: EU Commission Standard Contractual Clauses (2021/914/EU) are incorporated by reference for EEA, UK and Swiss transfers, with the relevant Module and Clause options specified rather than left vague.
Norwegian Entity, With a US Sibling for US Customers
Operated by Bricks Software AS, Edvard Storms gate 2, 0166 Oslo, Norway, for any customer located outside the United States. The Terms separately name Bricks Software Inc., 2261 Market Street STE 86259, San Francisco, CA, as the contracting entity for US-located customers -- meaning a European customer's contract is with the Norwegian entity specifically, not the US one. No document reviewed states which entity is the ultimate parent or how the two are related beyond both operating under the Unleash brand, so that structure is disclosed here rather than resolved.
Where It Fits
If the need is a visual page-optimisation editor, AB Tasty, Convert Experiences or Kameleoon fit that job more directly. If the need is flag-driven progressive rollout with experimentation layered on top, and a genuinely free self-hosted option matters, Unleash is the closer Optimizely alternative. See also PostHog for a product-analytics-plus-flags combination, and the wider A/B Testing category.
Key Features
Pros & Cons
Categories
Replaces
Unleash GDPR & data protection: common questions
Is Unleash GDPR compliant?
Partly. Unleash meets some of the requirements, with caveats worth reading before you commit. Unleash is a European company headquartered in Norway, data is hosted across multiple regions globally.
Where does Unleash store data?
Unleash states: ""Data residency options in the US or EU" listed as Included on both pricing tiers (getunleash.io/pricing, read raw 2026-09-07). Subprocessors page: AWS, "Customer hosted instances. User accounts," Location "EU or US*", footnoted "*AWS Region depends on each customer selection. Options: Europe (Frankfurt) or US-East" (getunleash.io/subprocessors, read raw 2026-09-07). This is a customer-selected choice, not an EU default applied automatically.". Data is hosted across multiple regions globally. An EU region is available.
Does Unleash offer a Data Processing Agreement (DPA)?
We could not locate a published DPA for Unleash. That does not mean one is unavailable. Many vendors provide it on request or inside the account area rather than publishing it. Ask before you sign.
What a DPA has to cover →Is Unleash a European company?
Yes. Unleash is headquartered in Norway and, as far as we can establish, European-owned.
Is Unleash subject to the US CLOUD Act?
Indirectly. Unleash itself is European-owned and headquartered in Norway, so the company is not subject to US jurisdiction. The exposure runs through a US provider in its processing chain, a host, CDN or other sub-processor, which can be compelled to disclose data it holds even when that data sits on EU servers. That is a narrower exposure than a US-owned vendor, and the compliance notes above say which provider it is. Standard Contractual Clauses are in place for transfers, which is the required safeguard but does not override a lawful US order.
Schrems II compliance checklist →Who are Unleash's sub-processors?
Unleash publishes its sub-processor list at https://www.getunleash.io/subprocessors. Worth reading: a vendor hosting in the EU can still route data through non-EU sub-processors, which is where residency claims usually come apart.
Related Tools

AB Tasty
French A/B testing and personalization platform with EU data hosting.

Kameleoon
French experimentation and personalization platform. Full GDPR compliance.

Convert Experiences
Dutch privacy-focused A/B testing platform with no personal data storage.
Spotted something wrong?
Martech moves fast. Vendors change hosting regions, get acquired, publish a new DPA or rewrite their pricing, and they rarely announce it. We check what we publish and date every compliance review, but some of what you see here will be out of date before we catch it.
If you work at Unleash and something on this page is wrong, tell us and we will fix it. Readers, same invitation. Pointing us at the page that proves it gets it changed fastest.