Nextcloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German open-source content-collaboration platform (Nextcloud GmbH, Stuttgart, 2016); fully self-hostable + managed Nextcloud One hosted in DE.
Nextcloud is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under File sharing.
Assessment notes
Nextcloud GmbH (Stuttgart, founded June 2016 by Frank Karlitschek and Niels Mache with ~12 open-source founders, privately held, founder-CEO still in place) is the reference EU-sovereignty content-collaboration platform: 400,000+ deployments, tens of millions of users, fully open source (AGPL-3.0) and self-hostable by default with explicit 'keep your data on servers you own' positioning; reference customers include Deutsche Telekom, Amnesty International, German federal agencies, BWI (Bundeswehr IT), and EU public administrations; EU-owned, open-source under AGPL-3.0, no CLOUD Act exposure because the customer typically operates the infrastructure itself.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Nextcloud
Nextcloud is the directory's flagship self-hostable content-collaboration platform, operated by Nextcloud GmbH at Hauptmannsreute 44a, 70192 Stuttgart, Germany. Founded in June 2016 by Frank Karlitschek (founder and CEO; previously creator of ownCloud) together with Niels Mache and approximately a dozen open-source entrepreneurs, the company is privately held and founder-led with no external venture capital. Nextcloud reports 400,000+ deployments and tens of millions of users at thousands of organisations, and ships as an integrated suite: Files (Dropbox-class storage), Talk (Slack/Zoom-class messaging and video), Groupware (mail/calendar/contacts), Office (with Collabora / OnlyOffice integrations), Assistant (sovereign AI), and Flow (no-code automation), positioning itself as "the better Microsoft 365 for private clouds."
The compliance story is structurally different from every other vendor in this category. Nextcloud is open source under AGPL-3.0 and designed to be self-hosted by default, which means the customer becomes the data controller and operator of their own instance: there is no Nextcloud-managed cloud sitting between customer data and the customer (except for Nextcloud One, an optional managed offering for organisations under 100 users that is hosted in Germany with 24/7 support). The privacy policy makes this explicit: "Nextcloud software is designed to ensure no user data is transferred to us." For procurement-grade EU buyers this gives complete control over hosting region, encryption keys, and sub-processor footprint: running Nextcloud on Hetzner / OVHcloud / Scaleway / STACKIT or on the customer's own data centre delivers EU-owned, EU-hosted, no CLOUD Act exposure by construction. The reference customer list reflects this positioning: Deutsche Telekom, Amnesty International, German federal agencies, BWI (the Bundeswehr's IT subsidiary), and a long list of European universities. In 2026 Nextcloud partnered with IONOS to launch Euro-Office as an open-source Microsoft Office alternative (stable release summer 2026) and pledged €250M of digital-sovereignty investment by 2030.
Pricing reflects the self-host-first model. The Community Edition is free under AGPL-3.0; commercial Enterprise subscriptions start at €71.29 per user per year (Standard, 100-user tier) ≈ €6/user/month, scaling to €105 (Premium, with consulting and clustering support) and €205 (Ultimate, with AI Assistant, Flow, and 24/7 support) at 100-user volumes. Nextcloud One is the managed German-hosted tier for <100 users. Best fit: every EU procurement-grade buyer in the directory; particularly compelling for public-sector procurement, regulated industries, and any organisation that wants a Microsoft 365 alternative under its own control. Together with Hetzner/OVHcloud/STACKIT (hosting), this is the canonical EU-sovereign-cloud productivity stack.
Sub-processor map · none disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Nextcloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |