Ownership and jurisdiction: Questions to ask before your next renewal

Quick question before you keep reading: do you actually know who owns your SAM vendor? Not who founded it, but who owns it right now, this year? 

If you’re not sure, you’re not alone. 

IDC’s June 2025 Future Enterprise Resiliency and Spending Survey¹ found that 45% of organizations, and 56% of digital-native companies, named data sovereignty and potential cloud changes their single biggest concern heading into 2026. That’s a lot of IT leaders lying awake over the same question. 

Here’s why it matters more than it used to: three major SAM vendors are now owned by the same company. Not the same type of company. Literally the same one: Thoma Bravo, a private equity firm out of Chicago. 

But that’s not really breaking news… Those deals already closed. What’s worth your time is what it means the next time you’re up for renewal, because ownership structure is one factor that may influence the legal framework surrounding access to data. Doesn’t matter where the servers physically sit. 

How we got here

Let’s walk through it, because the timeline tells you everything. 

Thoma Bravo agreed to buy a majority stake in Flexera back in December 2020, for around $2.85 billion². Not their first rodeo with the company either, they’d owned it once before, back in 2008³. 

Then, in February 2024, Flexera folded Snow Software into the fold⁴. Snow was founded in Stockholm back in 1997, and had built a genuinely loyal following across the Nordics. 

And then USU. Founded in Germany in 1977, it was basically the safe pick for European enterprises for decades. Thoma Bravo acquired a majority stake in USU in December 2024.⁵ 

So: three vendors, one owner.  

Worth naming what’s outside that circle too, since it puts things in perspective. 

ServiceNow? US public company.  

Certero? Based in the UK, and post-Brexit, that’s its own jurisdiction, not the EU.  

This leaves Xensam as the only major SAM platform still standing that’s actually European-owned, headquartered in Sweden, and answers to EU law and nothing else. 

“But our data’s stored in Europe”

Sure.  

That’s usually where this conversation goes next, and it’s a fair instinct.  

But it may not be that simple.

The US CLOUD Act, signed back in March 2018⁶, allows US law enforcement to compel companies under US jurisdiction to disclose data in their possession or control, regardless of where that data physically sits. Jurisdiction, not server location, is often what determines whether a company can be reached this way.not the server.

If your SAM vendor is subject to U.S. jurisdiction, for example because it is headquartered in the U.S. or has a qualifying legal presence there, its data may be subject to lawful U.S. disclosure orders regardless of where the data is stored.

Now, let’s not overdo it either, because the honest version of this argument is more useful than the scary one. This isn’t a standing backdoor where US agencies can pull European business data whenever they feel like it. A request needs a warrant, tied to an actual investigation, reviewed by a judge, and companies can push back if it conflicts with local law. AWS’s own transparency reporting⁷ says that as of June 2025, it’s had zero disclosures of enterprise or government content data stored outside the US since it started tracking that number. 

So no, your CMDB probably isn’t getting subpoenaed next Tuesday. But the legal exposure is real and structural, and “our servers are in the EU” was never the protection people assumed it was. That’s the part worth remembering before you sign the next renewal, not after.

Want the legal deep dive instead? Our Your data, your jurisdiction, your control piece covers the CLOUD Act argument in full. 

The one vendor that’s still actually European 

Sovereignty gets Xensam a seat at the table. 

To our knowledge, Xensam is the only major independently European-owned SAM platform.

What that actually looks like: Stockholm HQ, no US parent anywhere in the ownership chain, subject to GDPR and NIS2 and nothing outside that. Xensam holds its own SOC 2 Type II certification, and the infrastructure runs on UpCloud, a Finnish provider certified to ISO 27001, so neither the company nor the hosting depends on anyone outside the EU. New data centers went live in Copenhagen in December 2025 and Stavanger in January 2026, if keeping data inside specific national borders matters to your legal team, that’s now an option. 

But you don’t switch SAM tools just to make a point about jurisdiction. You switch because the tool needs to be better, and this one is: SaaS-native, AI-powered, built from day one for hybrid environments instead of bolted on after the fact. 

You’re live in weeks, not months. Normalization happens automatically instead of eating someone’s Tuesday. More than half of Xensam’s customers came over from legacy SAM vendors, and not one has gone back. 

If you want the deeper case for why the whole category needed rebuilding for this era, our piece on Software License Management in the era of SaaS, hybrid IT, and AI goes further into that. 

Before your next renewal, ask these three things 

It doesn’t have to be complicated.  

Next time you’re reviewing a SAM contract, or sizing up a new one, consider these three questions: 

• Where’s the vendor actually headquartered, and who owns them right now? Not who founded them. Who’s cashing the checks today. 

• Where’s your data hosted, and does that provider hold its own independent certifications, SOC 2, ISO 27001, rather than just inheriting the parent company’s paperwork? 

• What do the contract’s data processing terms actually say about jurisdiction and government access requests? It’s usually the one that matters most. 

None of these take long to check. All three take a lot longer to fix after you’ve already signed. 

Worth a conversation?

If your SAM vendor’s ownership has quietly changed and nobody’s connected the dots on what that means for your data, now’s a better time to look than after you’ve already signed the renewal.