Collabora Online
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Cambridge-based LibreOffice Online (MPL-2.0/LGPL) by Collabora Productivity Ltd: free CODE dev edition + €3/user/mo Business; self-hostable on EU infra.
Collabora Online is a European service hosted in the United Kingdom, with at most minor, transient US exposure under the CLOUD Act. It is listed under Docs & wikis.
Assessment notes
Collabora Productivity Ltd is a UK-incorporated company (Cambridge, registered as a division of Collabora Ltd). Post-Brexit other ownership signal. Product is MPL-2.0 / LGPL-licensed LibreOffice Online (CODE free edition; Business €3/user/month). Collabora operates no hosted service of its own: every edition on the subscriptions page is on-premise, and managed hosting is supplied by third-party partners (Nextcloud, Univention, OpenCloud, Strato DE, Arawa FR, Adfinis CH and 230+ others). The UK and Canada servers and the US sub-processors (Google Workspace, invoicing) named in the privacy notice are Collabora's own corporate systems, not a customer-data path. No ISO 27001 or EU-specific certifications found. Signals: MPL-2.0 / LGPL open source, self-hostable on EU infrastructure with no CLOUD Act exposure. Gaps: UK (non-EU) incorporation, no vendor-operated hosting to buy at all (the hosting jurisdiction is whichever partner or self-host the customer picks), no public DPA download link, no EU certifications.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Collabora Online
Collabora Online is the commercial edition of LibreOffice Online (the browser-based version of the ubiquitous open-source office suite) developed and supported by Collabora Productivity Ltd, a Cambridge, UK company founded around 2012 as a division of Collabora Ltd (the embedded Linux and open source consulting firm). The product delivers Writer, Calc, Impress, Draw, and Impress editing in the browser with real-time co-authoring and full compatibility with Microsoft Office formats (.docx, .xlsx, .pptx) and the Open Document Format (ODF). It integrates natively with Nextcloud, ownCloud, Seafile, Pydio, EGroupware, and other self-hosted platforms that need an in-browser document editor.
Two product tiers exist: the CODE (Collabora Online Development Edition) is a freely downloadable rolling-release development build suitable for testing, home use, and small teams; the Business subscription, on premise like every other edition on the subscriptions page, starts at €3 per user per month for up to 99 users and includes Long Term Support (LTS) releases, signed security updates, SLA-backed support, and enterprise deployment tools for large-scale Kubernetes rollouts. Educational institutions and non-profits receive custom pricing.
For EU-sovereignty procurement Collabora Online sits in an interesting middle position. The core product is open source (MPL-2.0 / LGPL) and fully self-hostable: running the open-source server on EU infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT) delivers no CLOUD Act exposure and is the procurement-grade recommended path for EU public sector. There is no hosted service to buy from Collabora Productivity Ltd (Cambridge, UK, other post-Brexit) at all: every edition on the subscriptions page is labelled on premise, and managed hosting is supplied by third-party partners such as Nextcloud, Univention, OpenCloud, Strato in Germany, Arawa in France and Adfinis in Switzerland, so the hosting jurisdiction is whichever partner or self-host route the customer picks. The UK and Canada servers and the US sub-processors named in the privacy notice (Google Workspace for internal tooling, US invoicing) are Collabora's own corporate systems rather than a customer-data path. No ISO 27001 or EU-specific certifications captured at audit. 230+ partner integrators globally are available for deployment support. Best fit: EU organisations already running Nextcloud or ownCloud wanting an integrated in-browser office editor; EU public sector buyers needing a libre-software alternative to Microsoft 365 Online; development and home-lab use cases via the free CODE edition.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Collabora Online
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.collaboraonline.com/privacy-notice…
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
France · €5/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
CryptPad
France
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€5/mo |