Skip to content
Independently verified · Quarterly re-audit
EU VETTED

BookStack

VERIFIED
Docs & wikis · United Kingdom
Founded 2015 · bookstackapp.com ↗

UK solo-dev MIT-licensed self-hosted wiki + documentation platform (Dan Brown, 2015); no SaaS, no vendor counterparty risk.

In short

BookStack, in the Docs & wikis category, is a European service with United Kingdom as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

BookStack is a fully MIT-licensed open-source self-hosted wiki and documentation platform created by UK-based developer Dan Brown in 2015 (first commit 12 July 2015, initially under the working name 'Oxbow') with no commercial entity controlling the project, no SaaS operated by the maintainer team, and no telemetry or vendor-counterparty risk. Built on PHP/Laravel + MySQL, supports 10+ UI languages, includes LDAP / SAML / OIDC SSO, role-based permissions, WYSIWYG editing, PDF/Markdown export. Pure self-host on customer-chosen EU infrastructure (Hetzner / OVHcloud / Scaleway / IONOS) delivers no CLOUD Act exposure and no vendor counterparty: gold-standard for procurement-grade self-host.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About BookStack

BookStack is a fully open-source, self-hosted wiki and documentation platform created in 2015 by Dan Brown, a UK-based full-stack web developer. The project was initially started under the working name "Oxbow" (first commit 12 July 2015) and has grown over the past decade into a category-defining "open-source Confluence alternative", particularly popular with IT teams, technical documentation sites, internal knowledge bases, and home-lab self-hosters. The codebase is fully MIT-licensed and source-available on Codeberg (mirror on GitHub), meaning buyers can fork, modify, redistribute, and use commercially with no licence restrictions or copyleft obligations.

Technical stack: PHP with the Laravel framework + MySQL, standard LAMP-style deployment that runs on any Hetzner / OVHcloud / Scaleway / IONOS VPS with minimal resource requirements. Content organisation is structured into Books → Chapters → Pages with WYSIWYG and Markdown editing, full-text search, role-based access controls, LDAP / SAML / OIDC SSO, multi-language UI for 10+ locales, PDF and Markdown export, image management, and a clean RESTful API. The project explicitly does not operate a managed SaaS: third-party sponsor companies (Stellar Hosted, Cloudabove) offer BookStack hosting commercially but are explicitly not vetted or supported by Dan Brown's project team, so the "official" BookStack experience is self-host.

For procurement-grade EU buyers BookStack is structurally one of the cleanest listings in this directory: no commercial entity to acquire or pressure, no VC investors, no parent company, fully MIT-licensed source code that can be forked at will, no managed cloud to worry about region selection on. Best fit: IT teams building internal knowledge bases, technical documentation projects, EU public-sector buyers who want MIT-licensed self-host as the procurement-grade default, home-lab and engineering-team self-hosters, organisations that want to escape Confluence's licensing complexity. The only minor caveats are the solo-developer maintenance model (some procurement teams require formal vendor SLA which BookStack doesn't offer directly; third-party hosting sponsors fill that gap) and the UK-post-Brexit other ownership tier (which is moot if you self-host since you control the deployment jurisdiction).

SUB-PROCESSORS

Sub-processor map · not disclosed

Self-hosted: no vendor sub-processor chain. This software has no vendor-operated service; when self-hosted, data stays on infrastructure the operator controls and there is no vendor processing chain to disclose.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-18).
FEATURES

Capability matrix

Self-hostable Yes
Real-time collaboration No
Databases / tables No
Public publishing Yes
Version history Yes
Granular permissions Yes
Offline mode No
AI assist No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option Yes
PRICING

Pricing & tiers

FREE
from €0/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

DPA accessibility is not scored for this listing. Self-hosted or local software, vendors that are not data processors, and products carrying a SecNumCloud, EUCS or BSI C5 certification are not assessed on DPA accessibility. See How we assess.
  • Data Processing Addendum (DPA)
    — not assessed
    n/a
  • Sub-processors list
    — not applicable
    n/a
ALTERNATIVES

Alternatives in this category

Anytype
Germany · Founded 2019
EU-SOVEREIGN

Berlin-based local-first peer-to-peer E2E-encrypted knowledge OS (Anytype, 2019); Any Source Available License; data lives on user device.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE
Collabora Online
United Kingdom · Founded 2012
EU-BASED

Cambridge-based LibreOffice Online (MPL-2.0/LGPL) by Collabora Productivity Ltd: free CODE dev edition + €3/user/mo Business; self-hostable on EU infra.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR
CryptPad
France · Founded 2014
EU-SOVEREIGN

Paris-based E2E-encrypted open-source collaboration suite (CryptPad by XWiki SAS), NLnet/NGI-EU-funded; zero-knowledge architecture.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE