Doqubox
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Aer Software Solutions B.V.
Dutch client-document exchange tool (Aer Software Solutions B.V.) for requesting, receiving and sending confidential files, with browser-side encryption and 7-day default retention, hosted on Hetzner in Nuremberg. Not general cloud storage.
Doqubox is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under File sharing.
Assessment notes
Doqubox is a client-document exchange service run by Aer Software Solutions B.V. (KvK 27332530, registered 2009, business address Koepelplein 1E, Haarlem), Dutch and privately held. The application, database, object storage, backups and outbound mail all run on Hetzner Online GmbH in Nuremberg, Germany (confirmed from the server's IP range and the object-storage endpoint), with no CDN or US proxy in front. The other named providers are Dutch (Bird B.V. for SMS verification codes, Mollie B.V. for Doqubox's own billing); the one US-parented name, Google Ireland, covers consent-gated analytics on the public website only and never sees customer documents. The DPA, sub-processor list, retention policy and security page are all public without a login, and the DPA gives customers 14 days' email notice of sub-processor changes with a right to object. EU-owned, EU-hosted, no CLOUD Act exposure, so 5/5 under the rubric. The vendor holds no certification of its own and says so; Hetzner's ISO 27001 and BSI C5 attestation cover the infrastructure only. Files and their metadata, including filenames and file types, are end-to-end encrypted in the browser; account, verification, billing and log data are outside that encryption.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 4 · 1 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Doqubox
Doqubox is a narrower tool than the cloud drives in this category. It is built for one job: getting confidential documents from and to external clients without email attachments. It is a product of Aer Software Solutions B.V., a Dutch software company (KvK 27332530, registered March 2009, statutory seat Amsterdam, business address in Haarlem). There are three flows. A permanent upload address can sit on a website or in an email signature; a document request sends one client a checklist of the files needed; and secure sending delivers files through an expiring link that can be revoked, with optional SMS verification of the recipient. Clients use a browser link and need no account. Account users sign in with passkeys. Documents are meant to pass through, not stay: incoming uploads and outgoing transfers expire after a limited, fixed period shown in the account settings, seven days by default, and the storage quotas are sized for that. Teams that need a shared drive, sync clients or version history should look at the general-purpose storage entries instead.
On jurisdiction the setup is simple and checkable. The application, database, object storage, backups and outbound mail run on Hetzner Online GmbH in Nuremberg, Germany; the server answers from Hetzner's Nuremberg cloud range and the app's content-security policy points uploads at Hetzner's Nuremberg object storage, with no CDN or US proxy in between. The published list adds Bird B.V. (Netherlands) as a sub-processor for SMS verification codes, and names Mollie B.V. (Netherlands, payments) and Google Ireland (website analytics, loaded only after consent and only on the public marketing pages) as providers for Doqubox's own billing and website, outside the DPA. Sub-processor changes come with 14 days' email notice and a right to object. The DPA, sub-processor list, retention policy and security page are all public. Files and their metadata, including original filenames and file types, are encrypted in the sender's browser and decrypted in the recipient's, across uploads, document requests and outgoing transfers, so the platform stores ciphertext under random object names. The app code uses the browser's own cryptography (AES-GCM with ECDH key agreement). Account, verification, billing and log data, and the delivery data for email and SMS, sit outside that encryption, as the security page and the privacy policy both say. Doqubox holds no certification of its own and states that plainly; Hetzner's ISO 27001 certificate and BSI C5 attestation cover the infrastructure, not the vendor.
Pricing is published and monthly. Essential is free for one user with a secure upload portal, 100 MB of storage and 500 MB of transfer per month. Professional costs EUR 4.95 per month and adds document requests, secure sending and your own logo (300 MB storage, 1 GB transfer). Business costs EUR 16.95 per month for five users, with SMS verification, a custom domain and sender address (1 GB storage, 3 GB transfer, 10 SMS); extra users are EUR 3.95 and extra transfer EUR 1 per GB. Best fit: accountants, financial advisers, estate agents and healthcare practices that want a branded, EU-hosted intake and delivery route for client documents.
Sub-processor map · 4
-
Google Ireland Limited USIreland
Ancillary, not a sub-processor under the DPA: Doqubox's own public-website analytics, loaded only after consent; no customer documents or exchange metadata (EU subsidiary of US-headquartered Alphabet).
-
Bird B.V. EUNetherlands
SMS one-time codes for recipient verification (phone numbers and SMS metadata only). Engaged when a sender enables SMS verification (Business plan). The vendor says processing may occur outside the EEA under transfer safeguards.
-
Hetzner Online GmbH EUGermany
Application hosting, databases, object storage, backups and outbound email. Holds the end-to-end encrypted files and their metadata, plus account data, exchange records, logs and email delivery metadata; document storage in Nuremberg. Always engaged.
-
Mollie B.V. EUNetherlands
Not a sub-processor under the DPA: Doqubox's own billing, payments, mandates and invoices (payment identifiers and billing details only, no document content).
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Google Ireland Limited | Ireland | Ancillary, not a sub-processor under the DPA: Doqubox's own public-website analytics, loaded only after consent; no customer documents or exchange metadata (EU subsidiary of US-headquartered Alphabet). | US |
| Bird B.V. | Netherlands | SMS one-time codes for recipient verification (phone numbers and SMS metadata only). Engaged when a sender enables SMS verification (Business plan). The vendor says processing may occur outside the EEA under transfer safeguards. | EU |
| Hetzner Online GmbH | Germany | Application hosting, databases, object storage, backups and outbound email. Holds the end-to-end encrypted files and their metadata, plus account data, exchange records, logs and email delivery metadata; document storage in Nuremberg. Always engaged. | EU |
| Mollie B.V. | Netherlands | Not a sub-processor under the DPA: Doqubox's own billing, payments, mandates and invoices (payment identifiers and billing details only, no document content). | EU |
Source: the vendor’s published sub-processor list, read 7 Oct 2026.
Frameworks & certifications · none listed
Held by the provider that operates the hosting, not by Doqubox itself.
Capability matrix
Table 2Capabilities of Doqubox
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |