Tool directory: GDPR-compliant tools for your SMB

Online appointment booking for medical practices — EU Art. 9 compliant

Doctolib Business is an appointment, teleconsultation, and patient-communication platform used by more than 300,000 practitioners across Europe. It is ISO 27001 certified and runs on HDS-certified (French health data hosting) infrastructure, with all data kept inside the EU. For DACH medical practices it covers the daily essentials: online booking, automated reminders, video consultations, and secure patient messaging. Because it processes health data under Art. 9 DSGVO, it is suitable for patient data only with a signed AV-Vertrag and proper technical and organisational safeguards. The platform is subscription-based with no free tier, and Doctolib provides a DPA plus an Art. 28 GDPR addendum as standard.

Data

EU only

DPA

Available

Market-leading practice management software for German GP and specialist practices

CGM MEDISTAR is a market-leading practice management software (PVS) for German GP and specialist practices, made by CompuGroup Medical AG in Koblenz. It covers billing, patient records, and the TI connector, with KIM and ePA integration built in. German healthcare IT compliance is a core part of the product, and it is certified for the Telematikinfrastruktur. As it processes Art. 9 DSGVO health data, it is suitable for patient data only with a signed AV-Vertrag and proper technical and organisational safeguards — an AV-Vertrag is standard. The software is subscription-based with no free tier and is aimed at clinical and finance teams running established practices.

Data

EU only

DPA

Available

Free German ERP and warehouse management for online retailers

JTL-Wawi is a widely used, free German ERP and warehouse-management system for online retailers. It handles inventory, orders, and multi-channel synchronisation, and integrates with the JTL-Fulfillment network. It can run locally or in the JTL Cloud hosted in Germany, giving a clean EU data-residency option. An AV-Vertrag is provided and the system supports GoBD-compliant archiving, which is valuable for German bookkeeping obligations. The core is free (freemium), making it attractive for growing shops, with paid add-ons available. JTL-Wawi suits operations and finance teams running e-commerce inventory at scale. It is not intended for Art. 9 DSGVO special-category data.

Data

EU only

DPA

Available

Free digital presence and reservation tools from Deutsche Telekom

DISH Restaurant is Deutsche Telekom's hospitality platform, bundling a website builder, online menu, reservation system and Google integration. It is aimed at restaurants that want a digital presence without juggling multiple vendors. A core advantage is the operator: data stays in Germany under Telekom Deutschland, and an AV-Vertrag is available. The platform offers a free tier, lowering the barrier for small establishments taking their first digital steps. For owner-run restaurants that need a website, menu and reservations quickly — backed by a German telecommunications provider — DISH is a low-risk entry point, though deeper POS or fiscal functions live elsewhere.

Data

EU only

DPA

Available

Cloud POS and management platform for restaurants and hospitality

Lightspeed Restaurant is a full-featured cloud POS and management platform for restaurants and hospitality, with kitchen display, delivery integration and multi-location management. An EU data region is available and a DPA is provided. For German operations, a fiscal compliance module (TSE) is available to meet KassenSichV requirements. This makes Lightspeed a candidate for larger or multi-site operations needing depth beyond a basic register. Note that Lightspeed's data residency is classified as eu_us, so configuring and verifying the EU region — and assessing third-country transfer exposure — is part of responsible deployment. The platform is subscription-based with no free tier.

Data

EU + US (DPF)

DPA

Available

EU document management and workflow automation — GoBD-compliant archiving

DocuWare is a cloud document management and workflow automation platform from Germering near Munich. It provides GoBD-compliant document archiving, digital signatures and workflow automation, serving more than 18,000 customers. The service runs from DocuWare's own data center in Germany, and a GDPR DPA is included. The archiving functions are designed to be GoBD- and AO-compliant, which is central for businesses with statutory retention duties. For law firms, professional-services providers and accounting practices that need audit-proof archiving and automated document workflows on German infrastructure, DocuWare is a mature, established choice. It is subscription-based without a free tier.

Data

EU only

DPA

Available

Automated invoice processing and approval workflows for German SMBs

Candis is a Berlin-based invoice automation platform for German SMBs. It uses OCR to digitise incoming invoices, runs them through configurable approval workflows, and exports the booked data to DATEV for the tax advisor. Data is hosted on AWS in the EU, a GDPR DPA is available, and the platform holds a SOC 2 Type II attestation. Candis is already prepared for the E-Rechnungspflicht 2025, making it a fit for finance teams that want to automate accounts-payable processing while keeping a clear audit trail and EU data residency.

Data

EU only

DPA

Available

All-in-one spend management for European SMBs and mid-market

Spendesk is an all-in-one spend management platform from Paris for European SMBs and the mid-market. It combines virtual and physical corporate cards, employee reimbursements, and invoice automation with real-time spend visibility. The company is EU-regulated by the ACPR, holds a SOC 2 Type II attestation, and provides a GDPR DPA. Data residency is in the EU. For DACH finance teams that want a single platform to issue cards, manage reimbursements, and automate invoices while keeping clear oversight, Spendesk offers a mature EU-based option.

Data

EU only

DPA

Available

Modern cloud CRM for German real estate professionals

Propstack CRM is a modern cloud CRM from Berlin for German real estate professionals. It centres on activity-based workflows with automated follow-ups, portal sync, and pipeline management for deals and contacts. Data is hosted on AWS in Frankfurt, a GDPR AV-Vertrag is available, and the platform offers an activity-based DSGVO Löschkonzept (deletion concept). For agents who want a streamlined, modern CRM with built-in retention logic for contact data, Propstack pairs sales automation with a clear approach to deleting personal data when it is no longer needed.

Data

EU only

DPA

Available

IoT fleet management and telematics with EU data processing option

Samsara Fleet is an IoT fleet management and telematics platform offering GPS tracking, driver-safety scoring, and compliance features such as digital Fahrtenbuch and ELD logging. It scales from a handful of vehicles to large fleets. Samsara is US-founded, but offers an EU data region and processes EU customer data under standard contractual clauses (SCCs). A GDPR data-processing agreement (AV-Vertrag) is available, and customers can select where their data is stored. For DACH fleets, the telematics depth is the appeal — but the US parentage means the eu_us data-residency picture deserves a careful vendor and transfer review before rollout.

Data

EU + US (DPF)

DPA

Available

Sales CRM built in the EU — GDPR-compliant pipeline management

Pipedrive is a sales-focused CRM with a visual pipeline that helps small sales teams track deals from first contact to close. It is straightforward to adopt and built around sales activity rather than sprawling feature sets. Pipedrive was built in the EU — headquartered in Tallinn, Estonia — and stores all data in EU data centres. It is ISO 27001 certified, and a GDPR data-processing agreement (AV-Vertrag) is available on all plans. There is no free tier, but for DACH service businesses that want a clean, sales-first CRM with genuine EU data residency, the compliance story is refreshingly simple.

Data

EU only

DPA

Available

Free time tracking for teams — EU-hosted and GDPR compliant

Clockify is a time-tracking tool for teams with an unusually generous free tier — unlimited users and projects at no cost. That makes it an attractive choice for service firms watching budgets. Clockify is based in Serbia and offers an EU data region. A GDPR data-processing agreement (AV-Vertrag) is signed on Pro and higher plans, and the tool supports MiLoG documentation for German minimum-wage and working-time records. For agencies, law firms, and accountants that bill by the hour, it covers the essentials cheaply — bearing in mind that the AV-Vertrag requires a paid plan.

Data

EU only

DPA

Available

Global event management and ticketing platform with EU DPA

Eventbrite is a global event-management and ticketing platform handling registrations, ticket sales, and event marketing for events of any size. Its large organic audience can help fill public events through built-in discovery. Eventbrite is a US company. An EU data-processing agreement (AV-Vertrag) and standard contractual clauses (SCCs) are available, but some data is processed in the US, giving it an eu_us residency profile that DACH organisers should review carefully. A free tier exists. For consumer-facing public events that benefit from reach, the platform is convenient — provided attendee data and US transfers are handled with proper safeguards.

Data

EU + US (DPF)

DPA

Available

Cloud productivity suite with GDPR-compliant EU data processing

Microsoft 365 bundles Word, Excel, Teams, Outlook and 30+ apps into a single subscription, making it the default productivity suite for most German SMBs. For DACH businesses the key feature is the EU Data Boundary: when enabled, customer data is processed and stored within the EU, which simplifies the GDPR conversation considerably. Microsoft includes a Data Processing Addendum (DPA) and Standard Contractual Clauses (SCCs) in its Online Services Terms, so an AV-Vertrag is available out of the box. That said, the underlying data residency is classified as EU/US, so some processing and support paths can still involve a US parent company. It fits service firms, retailers, law and accounting practices that want one well-integrated stack rather than stitching tools together.

Data

EU + US (DPF)

DPA

Available

All-in-one HR software for DACH SMBs — Munich-based and GDPR-native

Personio is all-in-one HR software covering HR administration, payroll preparation and recruiting for companies with roughly 10 to 2,000 employees. Founded in Munich, it is built GDPR-by-design — including consent management and deletion workflows — which makes it a natural fit for DACH SMBs handling employee data. Data is stored in the German AWS region (Frankfurt), giving EU data residency, and an AV-Vertrag (DPA) is included. There is no free tier, and like other HR systems it is not classified for Art. 9 special-category data such as health records. It suits service businesses, retailers, gastronomy and healthcare employers that want one GDPR-native system for the full employee lifecycle.

Data

EU only

DPA

Available

The standard accounting and tax software for German SMBs and tax advisors

DATEV is the de-facto standard accounting and tax software in Germany, cooperative-owned and used by more than 40,000 German tax advisors and SMBs. It runs on DATEV's own data centers in Nuremberg, so data residency is firmly in Germany — a major reason it dominates regulated bookkeeping in the DACH market. Industry-standard GDPR documentation is included, and it is the de-facto standard for §147 AO compliant bookkeeping. There is no free tier, and as a financial system it is not classified for Art. 9 special-category data. DATEV is offered to German customers and fits accounting practices, service firms and law offices that need a tax-advisor-compatible system with full domestic data residency.

Data

EU only

DPA

Available

German online scheduling platform for healthcare providers

samedi is a German online scheduling platform built specifically for healthcare providers. It combines appointment booking, digital health forms, and automated patient recalls in one system, helping practices fill their calendars and cut administrative load. The company is based in Berlin and hosts data in the German AWS region, keeping patient data inside Germany. Because it handles Art. 9 DSGVO health data, it is suitable for patient information only with a signed AV-Vertrag and appropriate safeguards — and samedi includes a DSGVO-konforme AV-Vereinbarung designed for medical practices. samedi is subscription-based without a free tier, with a DPA available for every practice.

Data

EU only

DPA

Available

Modern cloud accounting and invoicing for German and Austrian SMBs

sevDesk is a modern cloud accounting and invoicing tool from Offenburg, aimed at German and Austrian SMBs. It offers simple online bookkeeping with GoBD-compliant export, a DATEV interface for handing data to tax advisors, and mobile receipt scanning. Data is hosted on AWS in Frankfurt and an AV-Vertrag is included. A 14-day free trial lets businesses test the workflow before committing. For smaller firms in the DACH region that want clean DATEV transfer and German data residency without a steep learning curve, sevDesk is a strong everyday accounting choice.

Data

EU only

DPA

Available

German telemedicine platform — GDPR-compliant video consultations

iDocLive is a German telemedicine platform for GDPR-compliant video consultations. It uses end-to-end encrypted video, is certified by the KBV, and is approved for §5 DiGA, making it a solid fit for German practices moving care online. Hosting is in Germany, and the platform processes Art. 9 DSGVO health data — so patient use is appropriate only with a signed AV-Vertrag and the right safeguards. iDocLive provides both an AV-Vertrag and a Schweigepflicht (confidentiality) addendum. The service is subscription-based with no free tier and targets GPs, specialists, and front-of-house teams in Germany and Austria.

Data

EU only

DPA

Available

Global e-commerce platform with EU data processing addendum

Shopify is a global e-commerce platform for building and running online stores, starting at €29/month. It supports German payment methods natively — SEPA, Klarna and PayPal — and offers a large app ecosystem including German tax and invoicing tools. For data protection, Shopify provides an EU DPA and Standard Contractual Clauses (SCCs), plus an EU data-processing option. However, its data residency is mixed EU/US, which is a genuine GDPR consideration for DACH merchants and means transfer mechanisms must be assessed. Shopify is subscription-based with no free tier. It is not intended for Art. 9 DSGVO special-category data.

Data

EU + US (DPF)

DPA

Available

German order management and invoicing for multi-channel e-commerce

Billbee is a German order-management and invoicing tool for multi-channel e-commerce. It connects Amazon, Zalando, Shopify and 40+ sales channels, then automatically generates GoBD-compliant invoices and handles VAT automation for §14 UStG compliance. The software is hosted in Germany, which gives DACH merchants a clean EU data-residency story, and an AV-Vertrag is included. There is a free tier, with paid subscriptions for higher volumes. Billbee suits operations and finance teams that sell across several marketplaces and want compliant German invoicing without manual effort. It is not intended for Art. 9 DSGVO special-category data.

Data

EU only

DPA

Available

EU-based shipping automation platform for e-commerce

Sendcloud is an EU-based shipping-automation platform for e-commerce. From one dashboard it connects DHL, DPD, UPS, Hermes and 80+ carriers, automating label printing, tracking, and returns for online shops. The company is headquartered in Eindhoven (Netherlands), keeps data in the EU, and offers a GDPR DPA, with support for German carrier compliance. A free tier covers up to 400 shipments per month, with paid plans above that. Sendcloud suits operations teams that ship across multiple carriers and want one consolidated workflow. It is not intended for Art. 9 DSGVO special-category data.

Data

EU only

DPA

Available

iPad POS system for German restaurants — GoBD-compliant cash register

orderbird is a Berlin-based iPad point-of-sale system built specifically for German gastronomy. It ships with a certified TSE (Technische Sicherheitseinrichtung) to meet the requirements of the KassenSichV under §146a AO, so every transaction is recorded tamper-proof from day one. The system integrates directly with DATEV, simplifying the handover of daily takings to your tax advisor and supporting GoBD-compliant bookkeeping. A data-processing agreement (AV-Vertrag) is included in every plan, and data is hosted in the EU. For restaurants, cafés and bars that need a fiscally compliant cash register without enterprise complexity, orderbird is a pragmatic, DACH-native choice.

Data

EU only

DPA

Available

EU workforce scheduling for shift-based businesses — GDPR-compliant

Planday is workforce scheduling, time tracking and HR for shift-based businesses such as restaurants, hotels and retail. The company is headquartered in Copenhagen, with data hosted in the EU on AWS. A GDPR DPA (DSGVO-Vertrag) is included, and the platform ships with features mapped to German labour law, including ArbZG (Arbeitszeitgesetz) controls for working-time limits and rest periods. This makes it practical for DACH employers managing rotating shifts. For multi-location hospitality and retail teams that need EU-hosted scheduling with labour-law guardrails, Planday is a credible, compliance-aware option — though it is a subscription product without a free tier.

Data

EU only

DPA

Available

German restaurant reservation and guest management system

Resmio is a German reservation and guest-management system covering online table bookings, digital menus and waitlist management. The startup is based in Berlin, with data hosted in Germany. A free tier covers up to 100 covers per month, making it an accessible starting point for small restaurants testing online reservations. An AV-Vertrag is available for the data-processing relationship. For owner-run German restaurants that want straightforward, locally hosted reservations without committing to an enterprise platform, Resmio is a focused, DACH-native option. It concentrates on front-of-house guest flow rather than full POS or fiscal functions.

Data

EU only

DPA

Available

Germany's leading software suite for law firms and notaries

DATEV Anwalt is DATEV's software suite for law firms and notaries in Germany, widely regarded as the de-facto standard. It covers trust accounting (Fremdgeldverwaltung), legal billing under RVG and StBVV, and integration with the beA (besonderes elektronisches Anwaltspostfach). Data is processed in DATEV's Nuremberg data center, and an AV-Vertrag is provided. The trust-accounting functions support the bookkeeping duties under §43a BRAO, which matters for firms handling client funds. For German attorneys and notaries who need RVG-correct billing, compliant Fremdgeld handling and native beA workflows from an established German provider, DATEV Anwalt is the obvious reference point.

Data

EU only

DPA

Available

Legal and tax research platform for German attorneys and accountants

Wolters Kluwer Addison is a legal and tax research platform for German attorneys and accountants. It combines a comprehensive database of commentary and court decisions with automated document generation, backed by a German editorial team. The service runs from a German data center, and a DSGVO DPA is included. The parent company, Wolters Kluwer, is Dutch — keeping the corporate footprint within the EU. For law and accounting practices that need authoritative German legal and tax content alongside document automation, Addison is a research-grade option. It is subscription-based, and its strength lies in editorial depth rather than operational firm management.

Data

EU only

DPA

Available

German cloud accounting and invoicing for freelancers and SMBs

Lexoffice is German cloud accounting and invoicing software from the Haufe Group in Freiburg, built for freelancers and SMBs. It covers GoBD-compliant bookkeeping, e-invoicing in XRechnung and ZUGFeRD formats, and a direct ELSTER interface for tax filing. All data is stored in a data centre in Germany, and an AV-Vertrag (data-processing agreement) is included as standard. With the E-Rechnungspflicht taking effect in 2025, the XRechnung and ZUGFeRD support makes Lexoffice a practical, fully German-jurisdiction option for businesses that want their accounting and DSGVO obligations handled in one place.

Data

EU only

DPA

Available

EU spend management platform — corporate cards, expenses, and AP automation

Payhawk is an EU spend management platform combining corporate Visa cards, expense management, and accounts-payable automation for European companies. It is registered in Bulgaria within the EU and operates as an EBA-licensed e-money institution. Data residency is in the EU and a GDPR DPA is available. For DACH finance teams that want corporate cards, employee expenses, and AP automation in a single EU-regulated platform, Payhawk consolidates spend control without relying on a non-EU card issuer.

Data

EU only

DPA

Available

CRM for German real estate agencies — Immobilien CRM from Cologne

FlowFact CRM is a Cologne-based real estate CRM for German estate agencies. It syncs listings with Immobilienscout24, Immowelt, and other portals, tracks activities, and provides DSGVO-compliant contact management for prospects and owners. Hosting is in Germany and an AV-Vertrag is standard. For agencies that handle large volumes of buyer, seller, and tenant contact data, FlowFact combines portal reach with contact-data handling that stays within German jurisdiction — important for the personal data inherent to real estate work.

Data

EU only

DPA

Available

Leading German real estate software — CRM, portal management, and website

onOffice enterprise is a leading German real estate software from Aachen, offering a full-service platform for estate agents. It covers property management, portal exports, a digital customer portal, and an agency website builder in one system. onOffice runs its own data centre in Germany, and a GDPR DPA plus AV-Vertrag are included. For agencies that want their CRM, portal syndication, customer-facing portal, and website under one roof with German data residency, onOffice enterprise is a comprehensive, well-established choice.

Data

EU only

DPA

Available

Europe's largest freight exchange platform — based in Erkrath, Germany

TIMOCOM is Europe's largest freight exchange, used by more than 55,000 transport companies to find and offer freight capacity across the continent. The platform combines load matching with integrated track-and-trace, so dispatchers can fill empty runs and monitor shipments in one place. For DACH operators, the key draw is the location: TIMOCOM is headquartered in Erkrath (NRW) and runs its own data centre in Germany, with TÜV-certified data security. A GDPR data-processing agreement (AV-Vertrag) is available, and all data stays within the EU. It is a subscription product without a free tier, aimed at established carriers and forwarders rather than occasional users.

Data

EU only

DPA

Available

Transport management and procurement platform for European shippers

Transporeon is a cloud transport management system (TMS) for European shippers, covering tendering, slot booking, and real-time tracking in one platform. It helps procurement and operations teams source carriers, schedule dock slots, and follow shipments end to end. Originally headquartered in Ulm, Transporeon is now part of Trimble. Processing takes place in an EU data centre, and a GDPR data-processing agreement (AV-Vertrag) is available. The platform is subscription-based with no free tier and is geared towards mid-sized and large shippers that run regular freight procurement, rather than occasional senders.

Data

EU only

DPA

Available

Last-mile delivery management platform — EU-hosted and GDPR-compliant

Urbantz is a last-mile delivery management platform built for urban logistics and courier fleets. It handles route optimisation, live delivery tracking, and proof-of-delivery, helping operators run efficient final-mile operations. The company is based in Brussels and hosts on the AWS EU region, keeping data within the EU. It is ISO 27001 certified, and a GDPR data-processing agreement (AV-Vertrag) is included. Urbantz is subscription-based without a free tier, making it best suited to delivery businesses with regular, volume last-mile flows rather than occasional dispatchers.

Data

EU only

DPA

Available

Free CRM with EU data processing and GDPR consent tools

HubSpot CRM is a full customer-relationship, marketing, and sales platform with a notably generous free tier, making it an easy entry point for growing service businesses. HubSpot offers an EU data-hosting option, and GDPR consent templates plus a cookie banner are built in. A data-processing agreement (AV-Vertrag) is included on Enterprise plans. The default residency is eu_us, so DACH organisations should explicitly choose EU hosting and review transfer terms. It suits teams that want marketing, sales, and service tooling under one roof — provided they configure data residency and consent settings deliberately from the outset.

Data

EU + US (DPF)

DPA

Available

Work management platform with EU data residency and GDPR compliance

Monday.com is a visual work-management platform spanning project management, CRM, and workflow automation. Its flexible boards adapt to almost any team process, which makes it popular across operations, sales, and HR. An EU data-centre option is available, a data-processing agreement (AV-Vertrag) plus SCCs are provided, and the platform is ISO 27001 and SOC 2 Type II certified. The default residency is eu_us, so DACH teams should select EU hosting deliberately. A free tier exists for small teams. The trade-off is breadth over depth: powerful and configurable, but the eu_us baseline and US parentage call for a transfer review.

Data

EU + US (DPF)

DPA

Available

Project management and invoicing for DACH service businesses — hosted in Switzerland

MOCO is a slim project-management tool with time tracking, invoicing, and a light CRM, built specifically for agencies and freelancers in the DACH region. It favours focused, everyday workflows over heavy feature lists. Hosting is in Switzerland, a GDPR data-processing agreement (AV-Vertrag) is available from the Starter plan upward, and MOCO offers a DATEV export that fits German accounting practice neatly. There is no free tier, but for DACH service businesses that want time-to-invoice in one place with Swiss data hosting and DATEV integration, MOCO is purpose-built rather than generic.

Data

EU only

DPA

Available

Swiss event management platform — GDPR-compliant, data in Switzerland

evenito is a Swiss event-management platform aimed at corporate and agency clients, covering invitations, registrations, a check-in app, and analytics across the event lifecycle. Headquartered in Zurich, evenito hosts data in Switzerland, offers a GDPR data-processing agreement (AV-Vertrag), and uses BSI-conformant encryption. For DACH organisers handling attendee data for professional events, the Swiss residency and encryption posture are reassuring. There is no free tier — evenito is a subscription product positioned for professional event production rather than casual or one-off use, where the structured registration and check-in features earn their keep.

Data

EU only

DPA

Available