Joplin
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Open-source E2EE note-taking app by French developer Laurent Cozic (2016); Joplin Cloud hosted in France; €2.99/mo; self-sync to any EU storage.
Joplin is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under Docs & wikis.
Assessment notes
Joplin is an open-source, end-to-end encrypted note-taking application created by French developer Laurent Cozic (copyright 2016-2026). Joplin Cloud is hosted in France, protected by EU privacy laws, with E2EE meaning even the operator cannot read user notes. Signals: EU developer (France), EU-hosted cloud (France), end-to-end encrypted, no CLOUD Act exposure, MIT open-source codebase. Gaps: no publicly accessible DPA (typical gap for a micro-ISV solo project); no formal sub-processors list.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Joplin
Joplin is a fully open-source, cross-platform note-taking and task-management application created in 2016 by Laurent Cozic, a French developer. The application runs on Windows, macOS, Linux, Android, iOS, and as a terminal app, with notes saved in Markdown to an open format on the user's chosen storage backend. Joplin Cloud, the optional managed sync service, is hosted in France under EU privacy laws and charged from €2.99/month (Basic) through €5.99/month (Pro) and €7.99/user/month (Teams). All Joplin Cloud tiers support end-to-end encryption (the same E2EE available for self-sync scenarios) meaning Laurent Cozic's servers cannot read user notes even when syncing through Joplin Cloud.
The product positions itself as a privacy-first Evernote / Obsidian / Roam Research alternative. The core differentiators for EU-sovereignty buyers are the French operator (EU member state, GDPR-default), the E2EE architecture on the cloud tier, and the fully open-source codebase (MIT-licensed; GitHub: laurent22/joplin). Synchronisation works with Joplin Cloud (France-hosted), Dropbox, OneDrive, Nextcloud, WebDAV, or any S3-compatible storage, giving EU buyers the flexibility to sync through purely EU infrastructure (e.g. Hetzner S3 / OVHcloud Object Storage / Infomaniak kDrive) if preferred.
For EU-sovereignty procurement Joplin is the cleanest note-taking listing in the docs-and-wikis category by operator origin: French developer, France-hosted cloud, E2EE, MIT open source. The remaining gap is the absence of a formal DPA document (typical for a micro-ISV solo project) and the lack of an explicit sub-processors page. In practice the E2EE architecture means this gap is structurally less significant than for non-encrypted services. Best fit: individual privacy-conscious knowledge workers, journalists, researchers, and freelancers wanting a self-hostable open-source Obsidian / Evernote alternative with EU data residency; teams using the Teams tier with shared notebook access.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Joplin
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
n/aData Processing Addendum (DPA)— not assessed
-
missingSub-processors list— missing
-
OpenTerms of Servicejoplinapp.org/privacy…
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |