Pleo
Pleo Technologies A/S ·www.pleo.io· As of: 2026-07-30
Our verdict
Distributed card issuing with an approval chain creates no edge, because it solves no customer problem and any competitor can buy the same thing within a week. Going without it, however, costs you lasting visibility: subscriptions sit on private cards, notice periods pass unnoticed, and the monthly close waits on receipts that still have to be chased. This is equipment that prevents backsliding, not something that strengthens the core product.
Who it fits
Solo
suitable with caveats
The entry plan costs four euros a month and carries up to three people. The real benefit, the approval chain, disappears with a single person; what remains is receipt discipline and the accounting export. For one-person firms with heavy foreign spend, the 2.49 percent FX fee starts to bite.
Mid-market
suitable
This is where the use case sits: ten to a hundred people, scattered tool and AI subscriptions, and a finance function that has to close the month. Additional users cost between five and fifteen euros a month, and the DATEV connection exists.
Enterprise
suitable with caveats
Multiple legal entities are only cleanly separated in the upper plans, and the vendor publicly evidences neither ISO 27001 nor SOC 2, but PCI DSS and self-assessments. Whether customers can inspect an auditable access log themselves is undocumented. Both belong on the table before signing.
Buy, switch or build
Off-the-shelf
Corporate credit card from the house bank plus an expense tool
The bank issues one or a few cards, receipts land in a separate expense tool, and finance reconciles the two. That is cheaper on the card itself and often better on exchange rates, because the bank takes no software markup. You pay elsewhere: limits cannot be set per person, new cards take days rather than minutes, and matching receipt to entry stays manual work.
AI-native
Agentic spend platform instead of an approval chain
The young class promises that receipts, categorisation, policy checks and coding are handled by an agent, so humans only see exceptions. Switching vendors purely for that rarely pays, because the established platforms are adding the same agents; this vendor announced its own in June 2026. Whoever switches also swaps the payment licence, and that is where the real risk sits.
Build it yourself
Issuing cards yourself is not an option
Issuing cards yourself requires a payment or e-money licence, anti money laundering processes and ongoing supervision. No software company between one and fifty million in revenue builds that. The sensible build-it-yourself route sits one layer lower: your own analysis on top of the card export that joins subscriptions, contracts and cost centres. That pays off once the subscription landscape gets murky, but it does not replace card issuing.
Our advice
- Solo: Only take it if receipt discipline is genuinely breaking down today.
- Mid-market: Buy, but weigh the FX markup against your dollar spend.
- Enterprise: Buy, and settle certificates, audit logging and entity separation in writing before signing.
Who is behind it
Staying power: Established
Eleven years in market, a licensed e-money institution under Danish supervision, revenue in the low hundreds of millions. The last equity round dates back to 2021, though, and a listed shareholder's internal mark at the end of 2025 sits well below the price of that round.
- Legal entities and registration numbers: Pleo Technologies A/S, CVR 36538686, Copenhagen; Pleo Financial Services A/S, CVR 39155435, Copenhagen · Source · As of 2026-07-30
- Supervision for EU customers: Pleo Financial Services A/S is licensed by the Danish Financial Supervisory Authority as a payment institution and e-money issuer · Source · As of 2026-07-30
- Years in market and customer count: founded in 2015, around 40,000 business customers · Source · As of 2026-06-11
- Revenue and funding: EUR 164 million annual recurring revenue in the fourth quarter of 2025, USD 427.5 million raised in total, last equity round in 2021 · Source · As of 2026-07-30
- Valuation trajectory: the internal valuation mark of shareholder Kinnevik as at the fourth quarter of 2025 sits well below the 2021 round · Source · As of 2026-07-30
- UK sister company: Pleo Financial Services UK Ltd, Companies House 15842283, incorporated on 16 July 2024, active · Source · As of 2026-07-30
Cost of leaving: Moderate
The data comes out: transactions, receipts and coding can be exported as CSV or Excel and through the DATEV connection, and the data processing agreement explicitly puts the burden on the customer to pull transactional data from the application. The expensive part is not the export but the card switch: every recurring charge hangs off an issued card, so each subscription and direct debit has to be moved individually before the old cards die.
Regulation and data
| Data processing agreement | public data processing addendum, version of 14 October 2025The document is published in full as a PDF and names Pleo Technologies A/S, Pleo Financial Services A/S and Pleo Financial Services UK Ltd as the entities involved.Source · As of 2026-07-30 |
|---|---|
| Storage location | AWS in Ireland, region eu-west-1The vendor names Ireland as the storage and processing location for customer data. Individual recipients sit in the United States according to its own list, among them Marqeta, JP Morgan, Mastercard and Anthropic.Source · As of 2026-07-30 |
| Subprocessors | public list with purpose and country of processingNamed among others are Enfuce and Salt Edge in Frankfurt for payment processing and account access, AWS in Ireland, Onfido for identity checks and Anthropic in the United States for AI features. The contract provides for prior notice and a right to object.Source · As of 2026-07-30 |
| Third-country transfer | adequacy decision, otherwise standard contractual clauses with a transfer impact assessmentThe data processing agreement covers both explicitly and makes the standard contractual clauses apply automatically should an adequacy decision be repealed or suspended.Source · As of 2026-07-30 |
| Training on customer data | not addressed in the contractThe data processing agreement contains neither permission nor an explicit ban on using customer data for model training. The German privacy notice mentions artificial intelligence only in the recruiting context. Since Anthropic is listed as a recipient for AI features and agents roll out from July 2026, the question belongs in writing into contract talks.Source · As of 2026-07-30 |
| Retention and deletion | term of the contract, then statutory periods; deletion or return at the customer's choiceBackups remain isolated and excluded from further processing according to the contract. Anti money laundering and bookkeeping law produce multi year periods in practice, which the vendor states in its help centre as at least five years after the end of the business relationship.Source · As of 2026-07-30 |
| Certifications | PCI DSS under SAQ D, Google Cloud Application Security Assessment, HackerOne bug bounty, CAIQ self-assessment, renewed annuallyNeither ISO 27001 nor SOC 2 appears on the trust page or in the data processing agreement. An ISO 27001 claim shows up only in a partner's blog post, not from the vendor itself. A self-assessment is not an attestation.Source · As of 2026-07-30 |
| EU AI Act, Article 50 | unclearOn 11 June 2026 the vendor announced agents for policy, accounts payable, treasury and coding plus its own MCP server, with beta from July 2026. As of this review there is no public statement on the transparency duties under Article 50 of the AI Regulation.Source · As of 2026-06-11 |
| Audit logging | documented on the vendor side, unclear on the customer sideThe data processing agreement describes centrally collected, tamper resistant activity and audit logs on the vendor side. Whether and from which plan the customer can inspect and export an auditable log of access and approvals is not publicly substantiated.Source · As of 2026-07-30 |
What it really costs
Entry price
Starter at four euros a month with one user included and a hard ceiling of three, each further user five euros. Essential costs twenty euros a month, eighteen on annual billing, with further users at eleven euros each.
Source · As of2026-07-30
What gets expensive
Not the base price but the payment side. The FX fee is 2.49 percent on Starter and Essential and 1.99 percent from Advanced upwards. Anyone paying for a lot of tooling in dollars pays that markup on every amount, permanently and regardless of headcount. On top come 0.95 to 1.50 euros per domestic payment, 6 to 8 euros per international transfer and 19 to 29 euros per chargeback. Advanced starts at 99 euros a month for three users, Business from 249 euros.
What it displaces
- Subscriptions on private cards with reimbursement after the fact
- A single company card held by the managing director
- Receipt collection in a spreadsheet and a shoebox
Interfaces
- DATEV integration and CSV export for DATEV Kanzlei Rechnungswesen
- Freely configurable Excel and CSV export
- Connectors for the common accounting systems
- MCP server announced, beta from July 2026
At Convios: Not used by us
Not in use. All statements here come from public vendor documents, not from our own operation.
Evidence
- 1.Plans, per-user prices, FX and transaction fees for the German market · As of 2026-07-30
- 2.Storage location Ireland, encryption, assessed standards PCI DSS, CASA, HackerOne, CAIQ · As of 2026-07-30
- 3.Processing terms, standard contractual clauses, right to object to new sub-processors, deletion and return on termination · As of 2025-10-14
- 4.Named list of recipients and sub-processors with purpose and country · As of 2026-07-30
- 5.Legal entities, registration numbers and authorisation by the Danish financial supervisory authority · As of 2026-07-30
- 6.Announcement of the AI agents and the MCP server, customer count around 40,000 · As of 2026-06-11
- 7.Founding year, funding, recurring revenue and valuation trajectory · As of 2026-07-30
Last reviewed: 2026-07-30byDr. Oliver Gausmann, Convios GmbH
Details out of date? Let us know.