Nuclino
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Grünwald-based founder-owned lightweight team wiki (Nuclino GmbH, 2015), German data residency, ISO 27001/27018 + SOC 2 Type II, 12,000+ teams incl. NASA, MIT.
Nuclino offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Docs & wikis.
Assessment notes
Nuclino GmbH (Munich, Germany; founded 2015 by Björn Michelsen et al.) is a profitable, fully founder-owned lightweight team-knowledge-base (explicitly no venture capital, no PE, no parent) that hosts all customer data in Germany with SOC 2 Type II attestation and GDPR compliance. Customer base of 12,000+ teams including NASA, Ubisoft, MIT, Paddle, Vistaprint. Real-time collaborative editing, visual knowledge graph (the differentiator vs Notion), Sidekick AI assistant. Signals: EU-owned (German GmbH), EU-hosted (Germany) but material CLOUD Act exposure: primary hosting runs on AWS and Heroku (US hyperscalers) with FrontApp (US) for support, so customer documents sit with US-jurisdiction infrastructure providers; SOC 2 Type II certified, sub-processors publicly disclosed. Gap: no publicly accessible DPA. The privacy policy directs procurement buyers to contact@nuclino.com rather than offering a self-serve download.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 7 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Nuclino
Nuclino is a lightweight team-knowledge-base operated by Nuclino GmbH, registered at Nördliche Münchner Str. 47 in Grünwald just outside Munich, and founded in 2015 by Björn Michelsen (CEO, co-founder), and one of the cleanest ownership stories in the docs-and-wikis category. The company is profitable, fully founder-owned, no venture capital and no private equity on the cap table, no parent conglomerate, and explicitly positions this independence as a customer benefit ("we focus on customers instead of pleasing investors or chasing another funding round"). The product is differentiated from Notion / Confluence / Coda by its lightweight design philosophy (speed and simplicity over feature bloat) and its visual knowledge graph view that lets teams see their documentation as a connected network rather than a folder tree.
For procurement-grade EU buyers the ownership signal is clean and the certification set has widened since the May 2026 audit. The legal entity is Nuclino GmbH, entered at Amtsgericht München under HRB 227745 and now registered in Grünwald, GDPR-aligned, with all customer data hosted in Germany. The security page displays SOC 2 Type II, ISO/IEC 27001 and ISO/IEC 27018. What caps the score is the published sub-processor list: primary infrastructure is AWS EMEA SARL with Heroku alongside it and FrontApp for support, so customer documents sit with US-owned infrastructure providers and CLOUD Act exposure is recorded as Material. The customer base reaches 12,000+ teams across NASA, Ubisoft, MIT, Paddle, Psyon Games, Invoice Simple, Vistaprint, and many others: strong cross-sector enterprise reference set including US federal-civil + Hollywood AAA studio + university + B2B-SaaS adoption.
Pricing is freemium with a Free tier plus paid Starter and Business tiers; the amounts render client-side, so no entry-tier EUR figure could be captured at audit. The product line now includes the Sidekick AI assistant for AI-augmented note-taking and document workflows; Canvas as a new visual editor. Best fit: German and EU SMBs and mid-market teams wanting a Notion alternative with explicit German data residency, lightweight UX, and a knowledge-graph view; procurement-grade buyers prioritising bootstrapped + founder-owned + SOC 2-attested vendors over US-VC-funded competitors (Notion, Coda, Confluence). Together with HumHub (DE, AGPLv3) and BookStack (UK, MIT) Nuclino completes the directory's founder-owned, investor-free trio for the docs-and-wikis category.
Sub-processor map · 7
-
Amazon Web Services EMEA SARL USLuxembourg
Cloud infrastructure / hosting (primary)
-
FrontApp, Inc. USUnited States
Customer support system
-
Heroku, Inc. USUnited States
Cloud platform service
-
BunnyWay d.o.o. EUSlovenia
Content delivery network (Bunny.net)
-
Mailjet SAS EUFrance
Transactional email delivery
-
Paddle.com Market Ltd non-USUnited Kingdom
Payment processing / merchant of record
-
Stability AI Ltd. non-USUnited Kingdom
AI image generation service
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon Web Services EMEA SARL | Luxembourg | Cloud infrastructure / hosting (primary) | US |
| FrontApp, Inc. | United States | Customer support system | US |
| Heroku, Inc. | United States | Cloud platform service | US |
| BunnyWay d.o.o. | Slovenia | Content delivery network (Bunny.net) | EU |
| Mailjet SAS | France | Transactional email delivery | EU |
| Paddle.com Market Ltd | United Kingdom | Payment processing / merchant of record | non-US |
| Stability AI Ltd. | United Kingdom | AI image generation service | non-US |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Nuclino
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |