Public website
Hetzner
European provider- Observed
- alugha.com resolves to 167.235.110.247 and 2a01:4f8:1c1f:71c3::1 in Hetzner's network. Website routing does not establish where every media, AI, backup or billing operation runs.
Video platforms · Video hosting services
alugha
Multilingual video hosting from Germany
GermanyEUEU hostedFree plan♻ Ownership reviewed, controller unresolvedHigh non-EU dependencyScope verdict
Ownership reviewed, controller unresolved
The operator is Alugha GmbH, O7, 17, 68161 Mannheim, Germany, registered at Amtsgericht Mannheim under HRB 720060, VAT DE295708974. The official register returned a current company record on 15 September 2026. The imprint names Gregor Greinert, Bernd Korz and Meike Korz as managing directors. A shareholder-list filing dated 22 April 2014, received on 30 July 2014, was visible, but its contents could not be retrieved. Directors and historical investors do not establish current majority or voting control. VIES validated the VAT number but returned no name or address. German law applies; Mannheim is the specified business-customer venue, and the German terms take precedence.
Operational dependency warning
Relies heavily on non-European providers
Current public evidence shows 6 non-European infrastructure or email dependencies across 5 providers: Brevo / domain-verification signal, Exoscale / A1 Telekom Austria Group, Google, Microsoft, Sign in with Apple. The reviewed operational path is therefore not entirely European.
alugha is a hosted video platform built around multilingual content. A single video can carry several audio and subtitle tracks, while dubbr provides transcription, translation, voiceover and collaborative editing. The hosted platform is proprietary; the separately published player SDK uses the MIT licence.
Alugha GmbH operates the service from Mannheim. Its legal identity is established, but ultimate ownership and voting control remain unresolved. The company advertises German and EU hosting; its DPA also names processing in Switzerland and US video encoding. It says storage and compute use renewable electricity, while acknowledging that not every delivery component can guarantee it.
Pricing
Free includes 200 credits/month, 2 audio tracks per video and 720p quality. Creator is shown at 10 euro/month, or 7.92 euro/month with annual billing, with 2,000 credits and 3 tracks. Business is 99 euro/month, or 79.17 euro/month annually, with 30,000 credits and 10 tracks. Paid prices exclude VAT. Storage, traffic and AI use credits; monthly credits expire, while extra credits start at 5 euro per 1,000 and do not expire. Free public sharing and embedding require payment-method verification.
Data and operations
Infrastructure and email path
Verified operational dependencies, shown separately from ownership and from the service's core data hosting.
Core service hosting
Hetzner
European provider- Observed
- The public DPA names Hetzner cloud hosting in Germany and Finland. These are disclosed processing locations, not an independently inspected deployment or a complete backup-region schedule.
Core service hosting
Microsoft Azure
Non-European provider- Observed
- The DPA names Microsoft Azure cloud infrastructure in Germany and Ireland. EU processing locations are distinct from Microsoft's US corporate control.
Why this matters
Reviewed evidence places Microsoft Azure in the core service path, so customer data may be processed under non-European control. Check the cited source for the documented region and scope.
Core service hosting
OVHcloud
European provider- Observed
- The DPA lists OVHcloud hosting in Germany and France. The supplier's European-control finding follows the existing OVH Groupe voting-rights evidence; alugha does not assign every dataset to a specific region or cloud service.
Core service hosting
Exoscale / A1 Telekom Austria Group
Non-European provider- Observed
- The DPA names Exoscale hosting in Austria, Germany and Switzerland. Switzerland is outside the EU/EEA. Exoscale is part of A1 Telekom Austria Group, whose controlling shareholder is América Móvil; European locations do not establish European supplier control.
Why this matters
Reviewed evidence places Exoscale / A1 Telekom Austria Group in the core service path, so customer data may be processed under non-European control. Check the cited source for the documented region and scope.
Supporting services
Bunny CDN
Provider control not verified- Observed
- The DPA lists BunnyCDN with location EU (Slovenia), and cdn.alugha.com resolves through alugha.b-cdn.net. That entry does not document an EU-only delivery configuration. Ultimate supplier control remains unresolved in the directory; a Slovenian entity or an edge IP does not settle it.
Supporting services
Qencode
Provider control not verified- Observed
- The DPA explicitly lists Qencode for video encoding with location U.S. This is a disclosed processing dependency outside the EU, despite broad EU-only hosting wording elsewhere. Exact data flows and current configuration are not mapped, and ultimate supplier control was not independently established.
Supporting services
Mistral
Provider control not verified- Observed
- The DPA names Mistral for AI services in France; a Mistral domain-verification TXT record corroborates a vendor relationship without proving which models or data are used. The current ownership audit leaves Mistral's ultimate control unresolved. No per-model region, retention or training schedule was obtained.
Core service hosting
Undisclosed offsite backup providers and regions
Provider control not verified- Observed
- The DPA and TOMs promise regular backups, offsite storage and tested recovery procedures. They do not identify backup providers, exact regions or fixed deletion periods for each media, log and backup category.
Incoming business email
mail.lima-city.de
Provider control not verified- Observed
- MX 0 mail.lima-city.de
- Evidence
- Current daily MX lookup ↗
Authorised outbound email
lima-city
Provider control not verified- Observed
- The SPF record includes _all-out.lima-city.de. This authorizes outgoing mail and does not by itself show how every transactional message is delivered.
Authorised outbound email
Microsoft 365
Non-European provider- Observed
- The SPF record includes spf.protection.outlook.com and has Microsoft domain-verification records. These are mail/domain configuration observations, not evidence that all customer media is held by Microsoft.
Why this matters
This domain authorises Microsoft 365 to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.
Supporting services
Hetzner DNS
European provider- Observed
- Authoritative name servers are helium.ns.hetzner.de, oxygen.ns.hetzner.com and hydrogen.ns.hetzner.com. DNS is separate from media origin and encoding.
Payment processing
Paddle
Provider control not verified- Observed
- The pricing FAQ names Paddle as payment processor. Free users must verify a valid payment method to share videos publicly or embed the player. The applicable checkout entity and ultimate supplier control were not established here.
Supporting services
Google single sign-on
Non-European provider- Observed
- The privacy policy names Google Ireland Limited and its US parent Google LLC for optional authentication. It still cites Privacy Shield; this is dated transfer wording, not evidence of a current valid transfer arrangement for every service.
Why this matters
The published disclosure lists Google single sign-on for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Supporting services
Sign in with Apple
Non-European provider- Observed
- The privacy policy names Apple Inc. in the United States for optional authentication. This concerns account identity and does not establish video-storage geography.
Why this matters
The published disclosure lists Sign in with Apple for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Supporting services
updown.io status pages
Provider control not verified- Observed
- cdn.status.alugha.com and api.status.alugha.com resolve through page.updown.io to 159.89.98.98. This identifies externally hosted status pages, not customer-media origins. Ultimate supplier control remains unresolved in the directory.
Supporting services
Brevo / domain-verification signal
Non-European provider- Observed
- A brevo-code TXT record is present. It is a domain-verification signal only; actual marketing-mail use and data scope were not verified. The supplier's non-European-control status follows the existing joint-control evidence, not its French headquarters.
Why this matters
The published disclosure lists Brevo / domain-verification signal for supporting services. Depending on the function, account or customer data may reach this non-European provider. See the source for the documented scope.
Open source
