HumHub
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Munich-based AGPLv3 open-source enterprise social network + intranet (HumHub GmbH & Co. KG, 2015), 4,500+ organisations, self-hostable on EU infra.
HumHub is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Docs & wikis.
Assessment notes
HumHub GmbH & Co. KG (Munich, Germany; spun off as an independent company in early 2015 from the Munich-based web agency zeros+ones) is an AGPLv3 open-source enterprise social network and intranet platform with optional commercial licence, 4,500+ organisations on the platform across 30+ languages, both Community (free open source) and Professional (commercial) editions, and an 80+ module marketplace. Used by corporations, municipalities, charities, foundations, clubs, political parties, schools, and universities: strong cross-sector EU adoption pattern. Signals: EU-owned (German GmbH & Co. KG), EU-hosted, AGPLv3 open source, no PE / VC / parent on record, no CLOUD Act exposure on self-hosted deployments. Gap: no publicly accessible DPA download link and no formal sub-processors list for the hosted Professional Edition.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About HumHub
HumHub is a Munich-headquartered German open-source enterprise social-network and intranet platform operated by HumHub GmbH & Co. KG and originally spun off from the Munich web agency zeros+ones in early 2015 as an independent company. The codebase is built on the Yii PHP framework and licensed under GNU Affero General Public License v3 with an optional commercial licence for buyers who need exemption from the AGPL copyleft. The product reports 4,500+ organisations on the platform across 30+ UI languages: a customer base that spans corporations and SMEs, cities and municipalities, social and charitable institutions, foundations and clubs, political parties, and educational institutions (schools, universities).
Two product editions ship: Community Edition is fully open-source, free to self-host on any infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT, on-bare-metal); Professional Edition is commercially licensed with enterprise features, formal support, and managed SaaS hosting. The 80+ optional modules are distributed via the HumHub marketplace and cover use-cases like LDAP / SAML SSO, calendar, tasks, polls, custom pages, Mattermost-style chat, file storage, and dozens of integrations. The combination of a permissive baseline + paid-tier monetisation gives HumHub structural sustainability without requiring VC dilution: the company is HumHub GmbH & Co. KG with no PE / VC / parent on record.
For procurement-grade EU buyers HumHub sits at the top of the docs / wikis / knowledge category by ownership architecture: German GmbH & Co. KG legal structure, AGPLv3 source-availability, self-host as the recommended default for sovereignty, "Open Source Software made in Germany" branded positioning, and a cross-sector public-sector + non-profit customer base that signals procurement-friendliness. Pricing for the Professional Edition is enterprise / sales-engaged; specific EUR tier figures were not captured at audit. Best fit: German and EU corporates building internal intranets and social networks, EU public-sector and educational buyers needing AGPLv3 source-availability for forking flexibility, non-profits and clubs that benefit from the free Community Edition, and any procurement-grade buyer who wants a structurally clean German open-source vendor.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of HumHub
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |