Skip to content
Independently verified · Quarterly re-audit
EU VETTED
Curated collection

Docs & wikis without US sub-processors

European documentation and wiki tools verified to run with no US sub-processors, compared on ownership, hosting region, CLOUD Act exposure and sub-processor chain.

In short

The documentation and wiki tools listed here operate with no US sub-processors in the data path: an EU/EEA/Switzerland operator with no US parent and no US-incorporated processor. Knowledge bases concentrate a company's most sensitive internal text, so the search, AI-assist and attachment-storage sub-processors matter as much as the hosting region; each listing records the full chain.

EU Vetted Editorial
Verified June 2026 How we verify

Some links on this site are affiliate links. We may earn a commission at no extra cost to you. Editorial signals and rankings are never influenced by affiliate relationships.

Docs and wikis without US sub-processors, as listed on this page, means the operating company is incorporated in the EU, EEA or Switzerland, holds no US parent in its ownership chain, and routes no documentation or knowledge-base data through a US-incorporated processor at any point in the stack. Three separate facts have to line up (where the operator is incorporated, who ultimately owns it, and what the full sub-processor list contains), and any one of them failing is enough to break the claim. A tool that is EU-hosted but owned by a US parent, or EU-owned but relying on a US-incorporated search engine or attachment-storage layer, does not clear the bar.

This page lists the documentation and wiki tools in our directory that meet this test, benchmarked on the criteria a buyer evaluates: hosting region, ownership signal, CLOUD Act exposure and the sub-processor chain. The distinction matters particularly for this category because knowledge bases hold a company's most sensitive long-form internal text, and the exposure often enters through layers that are secondary to the core editor. We match each listing against the vendor's own sub-processor disclosures and recheck the list every quarter.

Why it matters

US jurisdiction over a company follows it wherever the servers sit; that is the CLOUD Act in short. In documentation tools specifically, the core editor is usually the part that is genuinely EU-hosted and EU-owned, while the exposure re-enters through the layers that make the tool searchable and useful: a full-text search index backed by a US-incorporated service, an AI-assist feature routing document text through a US foundation model API, or attachment storage sitting on an S3-compatible layer operated by a US-owned provider. Indexing is the quiet one: a search or AI-assist vendor typically ingests a copy of every document to build its index, which means the reachable surface can be broader than the primary editor's own storage.

A wiki concentrates your most sensitive internal text (strategic planning documents, incident post-mortems, internal credentials referenced in prose, customer notes), making the exposure profile of those peripheral layers more consequential than it would be in a lower-sensitivity category. The directory records ownership and sub-processors as separate, evidenced signals, and this page surfaces the full chain specifically for the documentation and wiki category, with the search and AI-assist layer called out on its own line.

At a glance

Key facts per option, checked against each vendor's own documents.

  • Anytype

    hosted in Germany, zero-knowledge end-to-end encryption, no CLOUD Act exposure, free tier available.

    Best for: Local-first notes and knowledge tool for privacy-conscious knowledge workers and researchers wanting a Notion or Obsidian alternative with offline, end-to-end-encrypted sync.

  • BookStack

    hosted in United Kingdom, encrypted at rest, no CLOUD Act exposure, from €0/mo.

    Best for: Self-hosted wiki for IT teams building internal knowledge bases who want an MIT-licensed Confluence alternative with no vendor counterparty.

  • CryptPad

    hosted in France, zero-knowledge end-to-end encryption, no CLOUD Act exposure, free tier available.

    Best for: Collaboration suite for privacy-maximalist teams, journalists, and EU public-sector buyers who need a full office suite the vendor cannot read.

  • HumHub

    hosted in Germany, encrypted at rest, no CLOUD Act exposure, free tier available.

    Best for: Self-hosted intranet and social network for EU corporates, public-sector, and educational organisations wanting an AGPLv3 platform.

  • Joplin

    hosted in France, encrypted at rest, no CLOUD Act exposure, from €3/mo.

    Best for: Note-taking app for privacy-conscious individuals, journalists, and freelancers wanting a self-hostable Obsidian or Evernote alternative with EU data residency.

  • Wiki.js

    hosted in Canada, encrypted at rest, no CLOUD Act exposure, from €0/mo.

    Best for: Self-hosted wiki for developer and engineering teams building internal documentation on a Node.js stack with Git-versioned content.

How to choose

Start by assessing what data your knowledge base will actually hold. Regulated buyers (public sector, legal, finance, healthcare) tend to rule out any US-incorporated processor in the chain outright, contractual safeguards notwithstanding, since the CLOUD Act does not defer to contract terms. The AI-assist layer deserves particular scrutiny: many EU-hosted wiki tools offer AI features that route document text through a US-incorporated model provider, which would reintroduce exposure. Check each profile explicitly for whether AI routing is EU-operated or can be disabled.

For self-hosting consideration: several EU-operated hosted wikis clear the bar without requiring self-hosting. Self-hosting gives full control over the chain but adds operational overhead. It is one valid route, not the only one. For small teams and solo founders, look for EU-owned hosted options with a short, verifiable sub-processor list. For enterprise procurement, cross-check this page against the certification filters (BSI C5, SecNumCloud, EUCS) to narrow to products meeting both the jurisdictional and the security-audit bar. The filters above sort the list by hosting country, ownership or CLOUD Act exposure if you want to cut it down further.

SWITCHING GUIDES

Switching from US docs & wikis?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

FAQ

Frequently asked questions

Why are sub-processors especially sensitive for a knowledge base?
A wiki concentrates internal documentation: strategy, incidents, credentials in prose, customer notes. The search index, any AI-assist feature and attachment storage all process that text, so a US-incorporated processor in one of those layers exposes the most sensitive corpus you hold. We record each one separately.
What counts as 'no US sub-processors' here?
An EU/EEA/Swiss operating company, no US parent, and no US-incorporated sub-processor in the data path. That is the directory's 'CLOUD Act exposure: none' bar, verified against public sub-processor lists and ownership records.
Do these tools offer AI features without US processors?
It varies. AI-assist often routes through a US-incorporated model provider, which would re-introduce exposure even on an EU-hosted tool. Where a listing offers AI, check the profile for whether the model layer is EU-operated or can be disabled.
Is self-hosting required to avoid US sub-processors?
No. Several EU-operated hosted wikis clear the bar without self-hosting. Self-hosting is one route to control the chain, but the hosted options here are verified on the same criteria. Pick based on your operational capacity, not the assumption that hosted means exposed.
How often is this re-verified?
Quarterly, with a last-verified date on each listing; AI and search layers change often, so the chain is re-checked each audit.
Methodology

How we verified every listing here.

For each product we read the public DPA, sub-processors document, hosting region declaration, certifications, and corporate ownership records. Each is timestamped. Signals are editorial, re-verified quarterly. We never accept self-attestation.

Read methodology →