Skip to content
CLOUD Act flagged on every listing
EU VETTED

Doqubox

VERIFIED

Aer Software Solutions B.V.

File sharing · Netherlands
Founded 2009 · doqubox.com ↗

Dutch client-document exchange tool (Aer Software Solutions B.V.) for requesting, receiving and sending confidential files, with browser-side encryption and 7-day default retention, hosted on Hetzner in Nuremberg. Not general cloud storage.

In short

Doqubox, in the File sharing category, is an EU-owned service with Germany as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Doqubox is a client-document exchange service run by Aer Software Solutions B.V. (KvK 27332530, registered 2009, business address Koepelplein 1E, Haarlem), Dutch and privately held. The application, database, object storage, backups and outbound mail all run on Hetzner Online GmbH in Nuremberg, Germany (confirmed from the server's IP range and the object-storage endpoint), with no CDN or US proxy in front. The other named processors are Dutch (Bird B.V. for SMS verification codes, Mollie B.V. for payments); the one US-parented name, Google Ireland, covers consent-gated analytics on the public website only and never sees customer documents. The DPA, sub-processor list, retention policy and security page are all public without a login. EU-owned, EU-hosted, no CLOUD Act exposure, so 5/5 under the rubric. The vendor holds no certification of its own and says so; Hetzner's ISO 27001 and BSI C5 attestation cover the infrastructure only. Encryption claims are worded more strongly on the homepage than in the privacy policy, which says not every workflow is fully end-to-end encrypted.

CLOUD ACT
Ownership
Sub-procs
4 · 1 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
Jump to

About Doqubox

Doqubox is a narrower tool than the cloud drives in this category. It is built for one job: getting confidential documents from and to external clients without email attachments. It is a product of Aer Software Solutions B.V., a Dutch software company (KvK 27332530, registered March 2009, statutory seat Amsterdam, business address in Haarlem). There are three flows. A permanent upload address can sit on a website or in an email signature; a document request sends one client a checklist of the files needed; and secure sending delivers files through an expiring link that can be revoked, with optional SMS verification of the recipient. Clients use a browser link and need no account. Account users sign in with passkeys. Documents are meant to pass through, not stay: the default retention for incoming uploads and outgoing transfers is seven days, and the storage quotas are sized for that. Teams that need a shared drive, sync clients or version history should look at the general-purpose storage entries instead.

On jurisdiction the setup is simple and checkable. The application, database, object storage, backups and outbound mail run on Hetzner Online GmbH in Nuremberg, Germany; the server answers from Hetzner's Nuremberg cloud range and the app's content-security policy points uploads at Hetzner's Nuremberg object storage, with no CDN or US proxy in between. The published sub-processor list adds Bird B.V. (Netherlands) for SMS verification codes and Mollie B.V. (Netherlands) for payments. Google Ireland is listed for website analytics, which load only after consent and only on the public marketing pages. The DPA, sub-processor list, retention policy and security page are all public. Files are encrypted in the sender's browser with a key created by the recipient, so the platform stores ciphertext; the app code uses the browser's own cryptography (AES-GCM with ECDH key agreement). The privacy policy is more careful than the homepage, though: it says not every workflow is fully end-to-end encrypted, without naming the exceptions, and request details, recipient data and logs are necessarily processed server-side. Doqubox holds no certification of its own and states that plainly; Hetzner's ISO 27001 certificate and BSI C5 attestation cover the infrastructure, not the vendor.

Pricing is published and monthly. Essential is free for one user with a secure upload portal, 100 MB of storage and 500 MB of transfer per month. Professional costs EUR 4.95 per month and adds document requests, secure sending and your own logo (300 MB storage, 1 GB transfer). Business costs EUR 16.95 per month for five users, with SMS verification, a custom domain and sender address (1 GB storage, 3 GB transfer, 10 SMS); extra users are EUR 3.95 and extra transfer EUR 1 per GB. Best fit: accountants, financial advisers, estate agents and healthcare practices that want a branded, EU-hosted intake and delivery route for client documents.

Sub-processor map · 4

Source ↗
  • Google Ireland Limited US
    Ireland

    Ancillary: website analytics on public marketing pages, loaded only after consent; no customer documents or exchange metadata (EU subsidiary of US-headquartered Alphabet).

  • Bird B.V. EU
    Netherlands

    SMS one-time codes for recipient verification (phone number and SMS metadata only). Engaged when a sender enables SMS verification (Business plan).

  • Hetzner Online GmbH EU
    Germany

    Application hosting, database, object storage, backups and outbound SMTP. Holds all customer file content (client-side encrypted in supported flows), account data and exchange metadata, in Nuremberg. Always engaged.

  • Mollie B.V. EU
    Netherlands

    Subscription payments, recurring-payment mandates and invoices (billing identifiers only, no document content).

1 of 4 sub-processors are US-incorporated. These are ancillary processors that do not hold protected customer data, so they do not change the assessment. CLOUD Act exposure is rated none.

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-10-02).
Certifications of the infrastructure it runs on

Held by the provider that operates the hosting, not by Doqubox itself.

ISO/IEC 27001 BSI C5

Capability matrix

Free storage 0.1 GB
Paid storage (from) 0.3 GB
Photo sync No
File versioning No
Link sharing Yes
Platforms Web
INTEGRATION & ACCESS
REST API No
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No

Pricing & tiers

FREEMIUM
from €4.95/mo
View pricing page ↗

Public documents

  • Data Processing Addendum (DPA)
    doqubox.com/dpa…
    Open ↗
  • Sub-processors list
    doqubox.com/subprocessors…
    Open ↗
  • Terms of Service
    doqubox.com/terms-of-service…
    Open ↗

Alternatives in this category

Proton Drive
Switzerland · Founded 2014
EU-SOVEREIGN

Swiss zero-knowledge encrypted cloud (Proton AG, non-profit-foundation-controlled), 11,496 owned servers, ISO 27001 + SOC 2, 5 GB free.

Public DPA Sub-processors Open source
FROM
€4/mo
CLOUD ACT
NONE
Tresorit
Switzerland · Founded 2011
EU-HOSTED

Swiss-Post-owned (state-anchored) E2E encrypted enterprise cloud storage (Tresorit AG, Zurich), Swiss + EU DC options, ISO 27001.

Public DPA Sub-processors Open source
FROM
€10/mo
CLOUD ACT
MATERIAL
kDrive (Infomaniak)
Switzerland · Founded 1994
EU-SOVEREIGN

Swiss kDrive cloud (Infomaniak, Geneva, since 1994), own Swiss DCs, ISO 27001 + B Corp 2025, district-heating heat recycling.

Public DPA Sub-processors Open source
FROM
€4/mo
billed annually
CLOUD ACT
NONE

Featured in these guides