Zum Inhalt springen
EU VETTED

Threema

Videokonferenzen · Schweiz
Gegründet 2012 · threema.com

Swiss E2EE messenger (Pfäffikon SZ, founded 2012), own servers in ISO 27001-certified Swiss data centres, no phone number required; consumer + enterprise (Threema Work) + on-prem.

Threema ist ein EU-eigener Dienst mit Hosting in der Schweiz und ohne erkennbares CLOUD-Act-Risiko. Gelistet unter Videokonferenzen.

Bewertungsnotizen

Threema GmbH (Pfäffikon SZ, Switzerland, CHE-221.440.104) runs its own hardware in two physically separated, redundant data centres in the Zurich area and processes personal data for all essential functions exclusively on those Swiss servers, publishes a DPA and a named sub-processor annex without a login, ships open-source clients with reproducible builds, and is Swiss-incorporated with EU adequacy: no CLOUD Act exposure for EU or Swiss data subjects. Correction at the 2026-08 re-verify: the ISO 27001 certificate belongs to Threema's colocation partner, not to Threema GmbH — the vendor's own wording is that it "runs its own servers in data centers of an ISO 27001-certified collocation partner" — so certifications is now empty rather than claiming a certification Threema does not itself hold. The sub-processor annex names only four parties: two Swiss SMS providers, Leaseweb Netherlands BV operating the Selective Forwarding Units that route end-to-end encrypted group calls, and Twilio Inc. (USA) restricted to phone-number verification for data subjects outside Switzerland, the EU and the EEA.

Befund

CLOUD Act
Eigentümer
Unterauftragsverarbeiter
4 · 1 US

Geprüfte Signale

Jurisdiktion
  • EU-/Angemessenheits-Hosting: Ja
  • EU-/Angemessenheits-Betreiber: Ja
  • Keine US-CLOUD-Act-Exposition: Ja
Transparenz
  • Öffentlicher AVV: Ja
  • Unterauftragsverarbeiter offengelegt: Ja
  • Open-Source-Clients: Ja
  • Zertifizierung durch Dritte: Nein
Springen zu

Über Threema

Threema is a Swiss end-to-end encrypted messaging application developed and operated by Threema GmbH (Pfäffikon SZ, Switzerland, Commercial Register: CHE-221.440.104), founded in December 2012 by three Swiss developers as a privacy-first alternative to WhatsApp, launching on Apple's App Store the same month the app was conceived. The legal entity was formally registered as Threema GmbH in spring 2014 to support professional expansion. Key milestones: post-Snowden traction in 2013, Threema Work (business edition) launched 2016, surpassed 10 million users in early 2021 following WhatsApp's controversial terms-of-service update, and a new CEO appointed in 2024.

The product portfolio is three-tier. Threema Private (consumer): one-off purchase app for iOS + Android + desktop, no phone number or email required for sign-up; fully anonymous use possible. Threema Work (business): managed admin console, MDM integration, enforced encryption policies, SSO via SAML/OIDC, priced at €3/user/month (Core) or €5/user/month (Professional); 30-day free trial for up to 30 users. Threema OnPrem (self-hosted): the full Threema Work stack deployable on customer infrastructure, for buyers who require complete data sovereignty inside their own security perimeter. All three tiers share the same cryptographic core: end-to-end encrypted messages, voice calls, video calls, group chats, file transfers, and polls using the NaCl/libsodium cryptography library; encryption by default with no plaintext fallback.

Compliance posture is among the strongest in the messenger category. Threema runs its own hardware in two physically separated, redundant data centres in the Zurich area, operated by an ISO 27001-certified colocation partner; the vendor's own wording places that certificate with the partner rather than with Threema GmbH. Data processing for all essential functions runs on those Swiss servers (confirmed in the publicly available DPA), with one documented exception: end-to-end encrypted group calls are routed through Selective Forwarding Units operated by Leaseweb Netherlands BV in the Netherlands, an intra-EEA flow in which the forwarder only ever handles ciphertext. Switzerland holds an EU adequacy decision (Art. 45 GDPR), SCC-free for EU↔CH transfers. The DPA (threema.com/en/dpa) is publicly accessible without login and references standard contractual safeguards for any third-party functions. The company explicitly positions Threema as compliant with NIS 2, DORA, and CER EU directives. Ownership: Threema was acquired by Comitis Capital GmbH (a German investment firm focused on purpose-driven companies) from Afinum Management GmbH in early 2026, still EU-controlled, no US capital. Open-source: a Google-free Android version (Threema Libre) ships via F-Droid with reproducible builds for independent verification; the app source code is publicly auditable. Best fit: privacy-conscious individuals replacing WhatsApp or Signal with a Swiss-hosted option; German and EU enterprises needing an auditable E2EE messaging platform under their own IT control; regulated sectors subject to NIS 2 / DORA that need a compliant internal comms layer.

Unterauftragsverarbeiter-Karte · 4

Quelle
  • Twilio Inc. US
    Vereinigte Staaten

    Telephone number verification for data subjects outside Switzerland/EU/EEA only

  • F24 Schweiz AG EU
    Schweiz

    Telephone number verification SMS

  • Leaseweb Netherlands BV EU
    Niederlande

    Selective Forwarding Units routing end-to-end encrypted group calls

  • Swissphone Wireless AG EU
    Schweiz

    Telephone number verification SMS

Quelle: veröffentlichte Unterauftragsverarbeiter-Liste des Anbieters, gelesen am 26 Aug 2026.

1 von 4 Unterauftragsverarbeitern sind in US-Eigentum oder haben ihren Sitz in den USA. Dies sind ergänzende Verarbeiter, die keine geschützten Kundendaten speichern, und ändern daher die Bewertung nicht. Das CLOUD-Act-Risiko wird mit „keines“ bewertet.

Rahmenwerke & Zertifizierungen · keine gelistet

Wir haben die Website des Anbieters und die Register der Zertifizierungsstellen geprüft. Keine aktiven Zertifizierungen gefunden zum Zeitpunkt der letzten Prüfung (2026-08-26).

Funktionsmatrix

Tabelle 2Funktionen von Threema

Self-Hosting Ja
Max. Teilnehmer 16 Teilnehmer
Bildschirmfreigabe Ja
Ende-zu-Ende-Verschlüsselung Ja

Integration & Zugriff

REST API Ja
SSO (SAML / OIDC) Ja

Compliance & Governance

Audit log Nein
Self-host / on-prem option Ja

Preise & Tarife

ab 3 €/Monat
Freemium
Preisseite ansehen

Öffentliche Dokumente

  • Auftragsverarbeitungsvertrag (AVV)
    threema.com/en…
    Öffnen
  • Liste der Unterauftragsverarbeiter
    threema.com/en…
    Öffnen
  • Nutzungsbedingungen
    threema.com/en…
    Öffnen

Alternativen in dieser Kategorie

  • Element (Matrix)
    Vereinigtes Königreich
    EU-gehostet
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Ja
  • kMeet (Infomaniak)
    Schweiz
    EU-souverän
    Öffentl. AVV: Ja Subprozessoren: Ja Open Source: Nein
  • Olvid
    Frankreich · 10 €/Mt.
    EU-ansässig
    Öffentl. AVV: Nein Subprozessoren: Nein Open Source: Ja
Alle videokonferenzen-Alternativen ansehen

In diesen Übersichten gelistet