OnlyOffice
VERIFIEDRiga-based Latvian office suite (Ascensio System SIA), AGPLv3 self-hostable + DocSpace cloud; complex post-2023 Singapore+UK+Russian-origin ownership chain.
Why this score?
ONLYOFFICE has a complex ownership chain procurement-grade buyers must understand: operating entity is Ascensio System SIA in Riga, Latvia (so Latvian + EU jurisdiction at the contracting layer); founder and CEO Lev Bannov is a Russian national with Russian + Turkish dual citizenship who has been residing in Istanbul since 2023; the company was originally a 2009 subsidiary of Russian-based New Communication Technologies until an August 2023 ownership restructure transferred control to Ascensio System Limited (UK), in turn owned by OnlyOffice Capital Group Pte. Ltd. (Singapore), with Bannov as the ultimate beneficial owner across the group. AGPLv3-licensed and self-hostable, so EU buyers can fully escape the ownership chain by running their own instance. Score 3/5 reflects the operating-entity EU jurisdiction plus the structural sovereignty complications; self-host on EU infrastructure (Hetzner / OVHcloud / Scaleway) yields effective 5/5 / none posture and is the procurement-grade recommended path.
- SCORE
- 3.0/5
- CLOUD ACT
- CLOUD ACT EXPOSURE
How exposed customer data is to US authorities under the CLOUD Act.
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- OWNERSHIP
- OWNERSHIP
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
US-owned US-headquartered, or has a US parent company.
-
Other This listing Swiss, UK or another non-EU jurisdiction.
-
- SUB-PROCS
- — not disclosed
JUMP TO
About OnlyOffice
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
Open ↗Terms of Servicewww.onlyoffice.com/legal…
Alternatives in this category
UK solo-dev MIT-licensed self-hosted wiki + documentation platform (Dan Brown, 2015); no SaaS, no vendor counterparty risk.
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Munich-based AGPLv3 open-source enterprise social network + intranet (HumHub GmbH & Co. KG, 2015), 4,500+ organisations, self-hostable on EU infra.
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
AGPLv3 open-source Node.js wiki by Nicolas Giard (Canada, 2016); 100M+ downloads; multiple DB backends; 40+ languages; self-host only.
- EU / adequacy operator
- EU / adequacy hosting
- No US CLOUD Act exposure
- Third-party certification
- Open-source clients
- Public DPA
- Sub-processors disclosed
How exposed customer data is to US authorities under the CLOUD Act.
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.