CryptPad
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Paris-based E2E-encrypted open-source collaboration suite (CryptPad by XWiki SAS), NLnet/NGI-EU-funded; zero-knowledge architecture.
CryptPad is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under Docs & wikis.
Assessment notes
CryptPad is the end-to-end encrypted open-source collaboration suite developed by XWiki SAS (Paris, France; making open-source software since 2004). Funded by NLnet PET, NGI TRUST, NGI DAPSI, NGI Zero Commons Fund (European Commission's Next Generation Internet programme) plus CryptPad.fr subscribers and Open Collective donations, making this one of the most clearly EU-publicly-funded sovereign-tech projects in the directory. Zero-knowledge encryption means even XWiki cannot read customer documents; full source on GitHub; self-hostable on EU infrastructure. Signals: EU-owned (French SAS), EU-hosted, EU public funding lineage, end-to-end encrypted (zero-knowledge), no CLOUD Act exposure, no US-VC, no US legal entity. Gap: no publicly accessible DPA. The DPA is reachable only inside a customer account for paid Organisation-Plan holders; no public sub-processors list.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About CryptPad
CryptPad is the canonical end-to-end-encrypted open-source collaboration suite, actively developed by a team at XWiki SAS, a Paris-based French company that has been building open-source software since 2004. The platform delivers a Google Docs / Notion / Microsoft Office Online alternative built around zero-knowledge encryption: documents are encrypted on the user's device before any data leaves it, and XWiki itself has no ability to read customer documents. The product surface covers rich text, code, slides, forms, kanban, calendar, polls, whiteboard, sheet, and team drives: a complete office-suite-grade feature set running entirely E2E.
Funding architecture is the structurally interesting story. CryptPad is funded by NLnet PET, NGI TRUST, NGI DAPSI, and the NGI Zero Commons Fund, the European Commission's Next Generation Internet (NGI) programme that channels EU public-research money into European-sovereign open-source infrastructure. Additional funding comes from CryptPad.fr subscribers and Open Collective donations. This combination (EU public funding + community subscriptions) gives CryptPad a structurally different cap table from any US-VC-funded competitor: no exit pressure, no dilution risk, no acquisition rumours, and explicit alignment with the European Commission's sovereign-tech agenda.
Pricing for CryptPad.fr (the managed cloud) is freemium with paid storage tiers; the entire codebase is open source on GitHub (cryptpad/cryptpad) and self-hostable for organisations wanting full control. Best fit: privacy-maximalist EU teams, journalists and activists, EU public-sector and education buyers (where NLnet / NGI funding lineage is itself a procurement signal), and any organisation that wants a full office suite where the vendor structurally cannot read the documents.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of CryptPad
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
n/aData Processing Addendum (DPA)— not assessed
-
missingSub-processors list— missing
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |