Is KI BMS subject to the CLOUD Act?

No. The CLOUD Act compels US-based companies (or US subsidiaries) to hand over data they control, regardless of where it physically lives. KI BMS has no US entity, no US contracts, and no US-controlled infrastructure in the data plane. Stripe processes payment data and is US-headquartered, but that boundary is well-defined: payment metadata only, never your records.

Where exactly is my data stored?

On dedicated servers we operate ourselves, physically located in Germany. The audit log, attachments, embeddings - everything in the data plane - lives there. Backups stay within the same EU jurisdiction in different physical locations and roll off on a 30-day window. We deliberately do not name the exact data centre - knowing the rack does not buy the customer anything and would make operator changes a public event.

Do you log IPs or session metadata to a US service?

No third-party analytics, no Google Analytics, no Meta pixel, no third-country tag manager. The first-party device + session ledger lives in our own Postgres + Redis - same EU boundary as the rest of the data plane. Logs are operational only and rotate at 30 days.

What happens if I'm a customer outside the EU?

You can use KI BMS from anywhere. The data still lives in the EU; the request travels from your location to our servers and back. That's a posture choice on our side, not a geo-restriction on yours.

KI BMS

Pricing

Compare

KI BMS: the EU alternative to Onlyfy by XING

Same job, hosted in the EU. KI BMS runs in Germany under German law - your data stays in EU jurisdiction end to end.

EU alternative

ATS

Comparison

DACH

Finn GlasCo-Founder + Engineering

·January 19, 2026·

2 min read

If your reason for moving off Onlyfy by XING is data sovereignty, the comparison gets simpler. KI BMS is hosted in Germany on infrastructure we operate ourselves - no US-headquartered company in the request path. The CLOUD Act does not reach what physically lives here.

At a glance

Onlyfy by XING is right when your recruiting focus is active sourcing - in-house recruiters direct-messaging XING profiles, with a 21M DACH-profile talent pool in the same tool. KI BMS is right when your recruiting focus is inbound - public roles, incoming applications, KI pre-sorting, fast rejection templates. Both EU-hosted; both GDPR-clean.

EU jurisdiction

What 'EU-hosted' actually means here, end to end

KI BMS runs on dedicated machines we operate ourselves, physically located in Germany. There is no US-headquartered subprocessor in the request path - the data plane (your records, your files, your audit log) lives entirely in EU jurisdiction. Two third parties exist outside that boundary: Stripe (payment information only, under the EU-US Data Privacy Framework) and the mail relay for transactional email. Neither sees your records. Onlyfy by XING's setup is the variable - if their primary infra is US-based, the CLOUD Act applies regardless of what their privacy page claims.

KI BMS vs Onlyfy by XING: EU comparison

	Ours KI BMS	Theirs Onlyfy by XING
Hosted in Germany
Network-sourced talent pool		21M XING profiles
Direct messaging (sourcing)
Careers page included
Multi-job-board posting
KI fit-score built in		Add-on
GDPR auto-anonymisation		Configurable
Free tier
Starting price	€0 / €1 / €10 / month	Quote (higher)
Contract model	Monthly	Annual + sourcing licences

When to pick which

Pick KI BMS when

Your hires come primarily from public roles + careers page + referral.

Active sourcing isn't your main channel - application volume is sufficient.

KI pre-sort with per-application reasoning > talent-pool size.

Pick Onlyfy by XING when

Senior and specialist roles where public applications barely come in and active sourcing is the only path.

You have in-house sourcing recruiters who message XING profiles daily.

DACH focus; XING is the standard platform in your market.

EU-jurisdiction questions

Specific to where the data lives, who can subpoena it, and what crosses borders.

Start with KI BMS

Free plan, no credit card. We host in Germany. Export + delete are self-serve.

Written by

Finn Glas

Co-Founder + Engineering

Finn is one of the Co-Founders. He owns the engineering side, the infrastructure, and most of the late-night fixes that ship before anyone notices.

finn.glas at aicuflow dot comLinkedIn Website