leitzcloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
LC by vBoxx GmbH
German-operated (LC by vBoxx GmbH) Leitz-branded business cloud on the group's own hardware: primary site near Frankfurt, backup site in the Netherlands since May 2026, AVV through the customer portal.
leitzcloud is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under File sharing.
Assessment notes
leitzcloud is operated by LC by vBoxx GmbH (Friedrich-Ebert-Anlage 36, 60325 Frankfurt am Main; Registergericht Frankfurt am Main HRB 117087, USt DE326895475), the German operating company of the Dutch vBoxx group, on the group's own hardware: the primary site is maincubes FRA01 in Offenbach am Main, near Frankfurt, and since May 2026 the georedundant backup site is Greenhouse Datacenters in Naaldwijk, Netherlands. Both are EU sites, there is no US provider in the chain, and the published sub-processor list names only vBoxx B.V. (infrastructure monitoring and support) and maincubes (rack space): EU-owned, EU-hosted, no CLOUD Act exposure. Held at 4/5 because the AVV is issued through the customer portal rather than published at a public URL. ISO/IEC 27001 is recorded at infrastructure level: the TÜV NORD certificate in force is issued to the sister company vBoxx B.V., and the appendix listing the other covered entities is not published.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About leitzcloud
leitzcloud is a business cloud-storage and file-collaboration product operated by LC by vBoxx GmbH, a German company registered in Frankfurt am Main (HRB 117087), part of the Dutch vBoxx group and marketed under licence from the Leitz office-supplies brand as "leitzcloud by vBoxx". It targets SMB, mid-market, enterprise, freelance, non-profit, public-sector, and startup customers across DACH and Benelux, pairing secure storage, sync, and sharing with real-time online document editing (Word, Excel, presentations), role-based corporate-governance controls, and guest access. The product UI is available in five languages: German, English, French, Dutch, and Brazilian Portuguese. A rebuilt version of the platform, adding e-signing, chat and meetings, is in invite-only beta at cloud.leitzcloud.eu; in the Netherlands the same platform is sold as vBoxxCloud by vBoxx B.V.
Hosting is EU-only and runs on the group's own hardware rather than rented hyperscaler capacity. The primary site is maincubes FRA01 in Offenbach am Main, near Frankfurt. Since May 2026 the georedundant backup site is Greenhouse Datacenters in Naaldwijk, Netherlands, which replaced the earlier second German location. The vendor's own pages have not all caught up: the imprint names both sites and then says data is processed and stored exclusively in Germany, and some product pages still describe two German locations. The published sub-processor list, in the trust centre of the new beta site, names vBoxx B.V. (The Hague) for infrastructure monitoring, maintenance and support and maincubes one GmbH for rack space; Greenhouse Datacenters is named as the backup site elsewhere but is missing from that list. With a German operating company, a Dutch parent and no US provider in the chain, the posture is EU-owned, EU-hosted, with no CLOUD Act exposure. ISO/IEC 27001 is certified by TÜV NORD for the group: the certificate in force (CERT-001474-TN, valid to January 2029) is issued to vBoxx B.V., and its predecessor listed LC by vBoxx GmbH as a covered entity, but the appendix of the current certificate is not published, so the directory records ISO 27001 at infrastructure level until it is.
On documentation: the AVV (Art. 28 GDPR, with technical and organisational measures) is requested in the customer portal and supplied for signature; it is not published at a public URL, which is the remaining gap against vendors that post their DPA openly. Pricing is EUR 9.90 per user per month plus EUR 4.40 per 250 GB on monthly billing, or EUR 8.80 and EUR 3.30 on annual billing, ex VAT, with no permanent free tier. Best fit: German and DACH SMBs and public-sector adjacencies that want EU-only hosting on the operator's own hardware with a German primary site, and Dutch or Benelux businesses through the vBoxx group. leitzcloud is the file-storage component of a suite that also includes LC-Connect (mail, calendar, meetings) and LC-Pass (password manager).
Sub-processor map · 3
-
Greenhouse Datacenters B.V. EUNetherlands
Georedundant backup site in Naaldwijk since May 2026. Named on the imprint and data-centre pages, NOT on the vendor's sub-processor table.
-
maincubes one GmbH EUGermany
Rack space for the dedicated servers at the primary site, maincubes FRA 01 (Goethering 29, Offenbach am Main). Colocation landlord; the hardware is the group's own. Listed by the vendor.
-
vBoxx B.V. EUNetherlands
Monitoring, maintenance and technical support of the infrastructure and solutions (Den Haag). Group company of LC by vBoxx GmbH; listed by the vendor.
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Greenhouse Datacenters B.V. | Netherlands | Georedundant backup site in Naaldwijk since May 2026. Named on the imprint and data-centre pages, NOT on the vendor's sub-processor table. | EU |
| maincubes one GmbH | Germany | Rack space for the dedicated servers at the primary site, maincubes FRA 01 (Goethering 29, Offenbach am Main). Colocation landlord; the hardware is the group's own. Listed by the vendor. | EU |
| vBoxx B.V. | Netherlands | Monitoring, maintenance and technical support of the infrastructure and solutions (Den Haag). Group company of LC by vBoxx GmbH; listed by the vendor. | EU |
Source: the vendor’s published sub-processor list, read 2 Oct 2026.
Frameworks & certifications · none listed
Held by the provider that operates the hosting, not by leitzcloud itself.
Capability matrix
Table 2Capabilities of leitzcloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |