Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Joplin

VERIFIED
Docs & wikis · France
Founded 2016 · joplinapp.org ↗

Open-source E2EE note-taking app by French developer Laurent Cozic (2016); Joplin Cloud hosted in France; €2.99/mo; self-sync to any EU storage.

In short

Joplin, in the Docs & wikis category, is an EU-owned service with France as its hosting location and no identified CLOUD Act exposure.

Assessment notes

Joplin is an open-source, end-to-end encrypted note-taking application created by French developer Laurent Cozic (copyright 2016-2026). Joplin Cloud is hosted in France, protected by EU privacy laws, with E2EE meaning even the operator cannot read user notes. Signals: EU developer (France), EU-hosted cloud (France), end-to-end encrypted, no CLOUD Act exposure, MIT open-source codebase. Gaps: no publicly accessible DPA (typical gap for a micro-ISV solo project); no formal sub-processors list.

CLOUD ACT
OWNERSHIP
SUB-PROCS
not disclosed
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Joplin

Joplin is a fully open-source, cross-platform note-taking and task-management application created in 2016 by Laurent Cozic, a French developer. The application runs on Windows, macOS, Linux, Android, iOS, and as a terminal app, with notes saved in Markdown to an open format on the user's chosen storage backend. Joplin Cloud, the optional managed sync service, is hosted in France under EU privacy laws and charged from €2.99/month (Basic) through €5.99/month (Pro) and €7.99/user/month (Teams). All Joplin Cloud tiers support end-to-end encryption (the same E2EE available for self-sync scenarios) meaning Laurent Cozic's servers cannot read user notes even when syncing through Joplin Cloud.

The product positions itself as a privacy-first Evernote / Obsidian / Roam Research alternative. The core differentiators for EU-sovereignty buyers are the French operator (EU member state, GDPR-default), the E2EE architecture on the cloud tier, and the fully open-source codebase (MIT-licensed; GitHub: laurent22/joplin). Synchronisation works with Joplin Cloud (France-hosted), Dropbox, OneDrive, Nextcloud, WebDAV, or any S3-compatible storage, giving EU buyers the flexibility to sync through purely EU infrastructure (e.g. Hetzner S3 / OVHcloud Object Storage / Infomaniak kDrive) if preferred.

For EU-sovereignty procurement Joplin is the cleanest note-taking listing in the docs-and-wikis category by operator origin: French developer, France-hosted cloud, E2EE, MIT open source. The remaining gap is the absence of a formal DPA document (typical for a micro-ISV solo project) and the lack of an explicit sub-processors page. In practice the E2EE architecture means this gap is structurally less significant than for non-encrypted services. Best fit: individual privacy-conscious knowledge workers, journalists, researchers, and freelancers wanting a self-hostable open-source Obsidian / Evernote alternative with EU data residency; teams using the Teams tier with shared notebook access.

SUB-PROCESSORS

Sub-processor map · not disclosed

Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-05-21).
FEATURES

Capability matrix

Self-hostable Yes
Real-time collaboration No
Databases / tables No
Public publishing Yes
Version history Yes
Offline mode Yes
AI assist No
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) No
COMPLIANCE & GOVERNANCE
Audit log No
Self-host / on-prem option Yes
PRICING

Pricing & tiers

FREEMIUM
from €3/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

DPA accessibility is not scored for this listing. Self-hosted or local software, vendors that are not data processors, and products carrying a SecNumCloud, EUCS or BSI C5 certification are not assessed on DPA accessibility. See How we assess.
Vendor does not publish a sub-processors list. Schrems II compliance and CLOUD Act exposure cannot be independently verified without it.
  • Data Processing Addendum (DPA)
    — not assessed
    n/a
  • Sub-processors list
    — missing
    missing
  • Terms of Service
    joplinapp.org/privacy…
    Open ↗
ALTERNATIVES

Alternatives in this category

Anytype
Germany · Founded 2019
EU-SOVEREIGN

Berlin-based local-first peer-to-peer E2E-encrypted knowledge OS (Anytype, 2019); Any Source Available License; data lives on user device.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE
BookStack
United Kingdom · Founded 2015
EU-BASED

UK solo-dev MIT-licensed self-hosted wiki + documentation platform (Dan Brown, 2015); no SaaS, no vendor counterparty risk.

Public DPA Sub-processors Open source
FROM
€0/mo
CLOUD ACT
NONE
Collabora Online
United Kingdom · Founded 2012
EU-BASED

Cambridge-based LibreOffice Online (MPL-2.0/LGPL) by Collabora Productivity Ltd: free CODE dev edition + €3/user/mo Business; self-hostable on EU infra.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
MINOR