Kolab Now
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Swiss open-source Kolab groupware SaaS (Apheleia IT AG, Bern; Kolab Systems since 2010, Kolab Now since 2013), board incl. FSF Europe founder Georg Greve.
Kolab Now is an EU-owned service hosted in Switzerland, with no identified CLOUD Act exposure. It is listed under Private email.
Assessment notes
Kolab Now is operated by Apheleia IT AG in Bern, Switzerland (formerly Kolab Systems, founded 2010 in Zürich; Kolab Now launched as public beta in January 2013 and as a paid GA service on 1 August 2013), built on the fully open-source Kolab groupware that Apheleia maintains, with a board of directors that includes Georg Greve (founding president of Free Software Foundation Europe), Michael Moser (co-founder of Adfinis, Switzerland''s leading open-source integrator) and Philipp Koch (co-founder of Swiss hosting company Nine.ch); exceptionally strong open-source-Swiss governance and pedigree, Swiss data centres, no US ties, no CLOUD Act exposure. Gap: Kolab Now does not publish a publicly accessible DPA (customers are directed to a DPO contact rather than a self-serve document); no public sub-processors list and no formal ISO 27001 attestation surfaced at audit.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
End-to-end encryption: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Kolab Now
Kolab Now is operated by Apheleia IT AG, a Swiss software-freedom company headquartered in Bern. The legal entity was originally founded as Kolab Systems in Zürich in 2010 and was later renamed Apheleia IT AG. The Kolab Now consumer/SMB SaaS launched as a public beta in January 2013 and became a paid generally-available service on 1 August 2013. The product is a managed hosting of the fully open-source Kolab groupware platform that the same company develops and maintains, covering email, calendars, contacts, tasks, files, and notes via standard open protocols (IMAP, SMTP, CalDAV, CardDAV) so that any standard mail/calendar client can connect.
The governance and pedigree are unusually strong for the privacy-email category. The Apheleia IT AG board includes Georg Greve (CEO; founding president of the Free Software Foundation Europe), CTO Jeroen van Meeuwen, Michael Moser (CCO; co-founder of Adfinis, Switzerland's leading open-source integrator), and Philipp Koch (co-founder of Swiss hosting company Nine.ch). That combination (a free-software figurehead plus a Swiss open-source integrator plus a Swiss hosting operator on the same board) is uncommon and translates into a structurally transparent posture: the product is open-source software run by people whose careers are documented free-software / open-infrastructure work.
For an EU-sovereignty audit Kolab Now is a clean Swiss pick. The legal entity is Swiss-incorporated, the data is hosted in Switzerland, Switzerland holds an EU adequacy decision under Art. 45 GDPR (so EU↔CH transfers need no SCCs), and there is no US parent and no US-VC participation. The only documentation gaps are: no public DPA or sub-processors URLs and no formal ISO 27001 attestation were surfaced at audit, a documentation gap rather than a structural concern.
Pricing is quoted in CHF, and the live price table is rendered client-side, so it could not be read at the last verification. The vendor knowledge base and the earlier site and blog copy disagree with each other on the two hosted individual tiers, and the knowledge-base page is itself stamped January 2020, so the live pricing page is the only figure a buyer should budget against. The on-site (self-host) Apheleia "Kolab on-site Email & Groupware" subscription starts at CHF 2.25 per user/month for fewer than 50 users. Best fit: privacy-conscious EU users who want Swiss-jurisdiction email/groupware on top of a transparent, fully-open-source software stack, and any procurement-grade buyer who specifically values FSF-Europe / Adfinis / Nine.ch governance over a brand-name marketing pitch.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Kolab Now
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicekolabnow.com/content…
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: Yes Sub-processors: Yes Open source: No -
-
Germany · €3/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: Yes Public DPA: No Sub-processors: Yes Open source: No -
-
Germany · €1/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
E2E: No Public DPA: Not assessed Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Mail
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tuta
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: Yes
Public DPA: No
Sub-processors: Yes
Open source: No
|
€3/mo |
Mailbox.org
Germany
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
E2E: No
Public DPA: Not assessed
Sub-processors: Yes
Open source: No
|
€1/mo |