BookStack
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
UK solo-dev MIT-licensed self-hosted wiki + documentation platform (Dan Brown, 2015); no SaaS, no vendor counterparty risk.
BookStack is a European service hosted in the United Kingdom, with at most minor, transient US exposure under the CLOUD Act. It is listed under Docs & wikis.
Assessment notes
BookStack is a fully MIT-licensed open-source self-hosted wiki and documentation platform created by UK-based developer Dan Brown in 2015 (first commit 12 July 2015, initially under the working name 'Oxbow') with no commercial entity controlling the project, no SaaS operated by the maintainer team, and no telemetry or vendor-counterparty risk. Built on PHP/Laravel + MySQL, supports 10+ UI languages, includes LDAP / SAML / OIDC SSO, role-based permissions, WYSIWYG editing, PDF/Markdown export. Pure self-host on customer-chosen EU infrastructure (Hetzner / OVHcloud / Scaleway / IONOS) delivers no CLOUD Act exposure and no vendor counterparty: gold-standard for procurement-grade self-host.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About BookStack
BookStack is a fully open-source, self-hosted wiki and documentation platform created in 2015 by Dan Brown, a UK-based full-stack web developer. The project was initially started under the working name "Oxbow" (first commit 12 July 2015) and has grown over the past decade into a category-defining "open-source Confluence alternative", particularly popular with IT teams, technical documentation sites, internal knowledge bases, and home-lab self-hosters. The codebase is fully MIT-licensed and source-available on Codeberg (mirror on GitHub), meaning buyers can fork, modify, redistribute, and use commercially with no licence restrictions or copyleft obligations.
Technical stack: PHP with the Laravel framework + MySQL, standard LAMP-style deployment that runs on any Hetzner / OVHcloud / Scaleway / IONOS VPS with minimal resource requirements. Content organisation is structured into Books → Chapters → Pages with WYSIWYG and Markdown editing, full-text search, role-based access controls, LDAP / SAML / OIDC SSO, multi-language UI for 10+ locales, PDF and Markdown export, image management, and a clean RESTful API. The project explicitly does not operate a managed SaaS: third-party sponsor companies (Stellar Hosted, Cloudabove) offer BookStack hosting commercially but are explicitly not vetted or supported by Dan Brown's project team, so the "official" BookStack experience is self-host.
For procurement-grade EU buyers BookStack is structurally one of the cleanest listings in this directory: no commercial entity to acquire or pressure, no VC investors, no parent company, fully MIT-licensed source code that can be forked at will, no managed cloud to worry about region selection on. Best fit: IT teams building internal knowledge bases, technical documentation projects, EU public-sector buyers who want MIT-licensed self-host as the procurement-grade default, home-lab and engineering-team self-hosters, organisations that want to escape Confluence's licensing complexity. The only minor caveats are the solo-developer maintenance model (some procurement teams require formal vendor SLA which BookStack doesn't offer directly; third-party hosting sponsors fill that gap) and the UK-post-Brexit other ownership tier (which is moot if you self-host since you control the deployment jurisdiction).
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of BookStack
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
n/aData Processing Addendum (DPA)— not assessed
-
n/aSub-processors list— not applicable
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
-
France · €5/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |
CryptPad
France
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€5/mo |