Penpot

Name: Penpot
Author: Penpot

Open source design collaboration from Spain

SpainEUOpen sourceFree planEU controlledHigh non-EU dependency

Visit website penpot.app

Operational dependency warning

Relies heavily on non-European providers

Current public evidence shows 6 non-European infrastructure or email dependencies across 5 providers: Amazon SES, Brevo, Cloudflare, Google, Zendesk. The reviewed operational path is therefore not entirely European.

Review dependencies ↓

Penpot is a browser-based interface design and prototyping platform for designers and developers. It supports shared libraries, multiplayer editing, comments, inspect mode, plugins and open web standards.

Penpot is built by Kaleidos in Madrid and can be used as a hosted cloud service or installed on infrastructure you control. The core product is open source, and the hosted Professional plan is free for small teams.

Pricing

The Professional cloud plan is free for up to eight editors. Self-hosting the open source edition is free.

External verification

EU verification badge

eu-alt.eu independently verified this service's European ownership. Choose a badge style and link it back to the dated evidence on this page.

Evidence last checked: 2026-09-04

Horizontal · Blue

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-blue.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="360" height="96" loading="lazy"></a>

Horizontal · Black

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-black.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="360" height="96" loading="lazy"></a>

Horizontal · White

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-white.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="360" height="96" loading="lazy"></a>

Compact · Blue

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-compact-blue.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="220" height="132" loading="lazy"></a>

Compact · Black

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-compact-black.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="220" height="132" loading="lazy"></a>

Compact · White

Download SVG

Embed code

<a href="https://eu-alt.eu/en/product/penpot" rel="nofollow"><img src="https://eu-alt.eu/badges/penpot/ownership-compact-white.svg" alt="Penpot: EU ownership independently verified by eu-alt.eu" width="220" height="132" loading="lazy"></a>

Data and operations

Infrastructure and email path

Verified operational dependencies, shown separately from ownership and from the service's core data hosting.

Public website

Cloudflare

Non-European provider

Observed: A 104.20.43.218, 172.66.156.205 · AS13335
Evidence: Live website DNS ↗RIPE network record ↗

Why this matters

Public DNS routes website visits through Cloudflare. Visitor IP addresses and request metadata can reach this non-European provider; this does not identify the core service's data location.

Incoming business email

Google Workspace

Non-European provider

Observed: MX 1 aspmx.l.google.com · 5 alt1.aspmx.l.google.com · 5 alt2.aspmx.l.google.com · 10 alt3.aspmx.l.google.com · 10 alt4.aspmx.l.google.com
Evidence: Current daily MX lookup ↗

Why this matters

Published MX records route incoming business email through Google Workspace. Correspondent details and message content can therefore enter this non-European provider's systems; MX does not reveal the configured storage region.

Authorised outbound email

Amazon SES

US-controlled cloud

Observed: SPF amazonses.com
Evidence: Live SPF record ↗

Why this matters

This domain authorises Amazon SES, infrastructure under US ultimate ownership, to send email. If active, recipient details and message content can be processed there. SPF does not prove active use, the selected AWS region, or use of the separately operated AWS European Sovereign Cloud.

AWS ownership record ↗Sovereign Cloud distinction ↗

Authorised outbound email

Google Workspace

Non-European provider

Observed: SPF _spf.google.com
Evidence: Live SPF record ↗

Why this matters

This domain authorises Google Workspace to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

Brevo

Non-European provider

Observed: SPF spf.sendinblue.com
Evidence: Live SPF record ↗European Commission M.12141: Oakley, General Atlantic and Armand Thiberge joint control ↗General Atlantic: Brevo financing closed, 4 December 2025 ↗

Why this matters

This domain authorises Brevo to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Authorised outbound email

Zendesk

Non-European provider

Observed: SPF mail.zendesk.com
Evidence: Live SPF record ↗

Why this matters

This domain authorises Zendesk to send email. If active, recipient details and message content can be processed by this non-European provider. SPF does not reveal its configured storage region.

Domain and email check

penpot.app

Current public DNS records show who manages this domain, which systems handle incoming business email, and selected published service signals. Refreshed daily.

Updated daily

Domain nameservers

ns-125-b.gandi.net
ns-13-a.gandi.net
ns-72-c.gandi.net

Incoming business email

1 aspmx.l.google.com
5 alt1.aspmx.l.google.com
5 alt2.aspmx.l.google.com
10 alt3.aspmx.l.google.com
10 alt4.aspmx.l.google.com

Mail handled by: Google Workspace Non-European provider

Additional service signals

Published SPF, DKIM and discovery records can reveal configured links to major platforms beyond incoming mail.

Mail-signing setup

Google Workspace

Non-European provider

TXT google._domainkey DKIM key published

A provider-specific DKIM record is published for Google Workspace. This shows configured mail-signing infrastructure, but not that every message currently uses it.

Current DNS record ↗Provider setup guide ↗

Sender authorisation

Google Workspace

Non-European provider

SPF include:_spf.google.com

Google Workspace is authorised to send email for this domain. The SPF entry can be unused or stale and does not reveal the configured data region.

Current DNS record ↗Provider setup guide ↗

This is a targeted check, not a complete zone inventory. Generic Google and Microsoft verification tokens are ignored because they do not prove product use or a data flow. DNS normally cannot list arbitrary subdomains or customer-chosen DKIM selectors, including Salesforce selectors. Missing signals are not proof that a provider is unused.

DNS checked: 2026-10-18 22:08 UTC

Public DNS records identify visible providers and routes, not every backend location or private data-region setting.

Infrastructure checked: 2026-09-04

More from Spain

Analyzati

Penpot

Relies heavily on non-European providers

Pricing

EU verification badge

Horizontal · Blue

Horizontal · Black

Horizontal · White

Compact · Blue

Compact · Black

Compact · White

Infrastructure and email path

Cloudflare

Google Workspace

Amazon SES

Google Workspace

Brevo

Zendesk

More in Document collaboration services

Infomaniak kDrive

Infomaniak Public Cloud

Proton Docs

Proton Drive

Nextcloud Office

Nextcloud

More from Spain