OnlyOffice
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Riga-based Latvian office suite (Ascensio System SIA), AGPLv3 self-hostable + DocSpace cloud; complex post-2023 Singapore+UK+Russian-origin ownership chain.
OnlyOffice offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Docs & wikis.
Assessment notes
ONLYOFFICE has a complex ownership chain procurement-grade buyers must understand: operating entity is Ascensio System SIA in Riga, Latvia (so Latvian + EU jurisdiction at the contracting layer); founder and CEO Lev Bannov is a Russian national with Russian + Turkish dual citizenship who has been residing in Istanbul since 2023; the company was originally a 2009 subsidiary of Russian-based New Communication Technologies until an August 2023 ownership restructure transferred control to Ascensio System Limited (UK), in turn owned by OnlyOffice Capital Group Pte. Ltd. (Singapore), with Bannov as the ultimate beneficial owner across the group. AGPLv3-licensed and self-hostable, so EU buyers can fully escape the ownership chain by running their own instance. The operating entity is EU-incorporated (Latvia) but the ownership chain spans UK–Singapore–Russian-Turkish UBO; no public DPA or sub-processors list is available. Self-host on EU infrastructure (Hetzner / OVHcloud / Scaleway) is the procurement-grade recommended path. It neutralises the ownership-chain complexity by keeping all data flows under the customer's chosen EU jurisdiction.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About OnlyOffice
ONLYOFFICE is a Microsoft 365 / Google Docs alternative office suite (documents, spreadsheets, presentations, PDF editing, fillable forms, real-time co-authoring) operated by Ascensio System SIA, headquartered in Riga, Latvia and founded in 2009 by Lev Bannov. The product ships as a fully open-source AGPLv3 codebase plus a managed DocSpace cloud, with desktop apps (Windows, Linux, macOS), mobile apps (iOS, Android), and 40+ third-party connectors for embedding into platforms like Nextcloud, ownCloud, Confluence, and many others. Real-world EU adoption is significant: the city of Lyon, France publicly migrated to OnlyOffice in 2025 as part of its sovereign-IT strategy.
For an EU-sovereignty audit ONLYOFFICE is the most structurally complex listing in the docs-and-wikis category. The operating-and-contracting entity is Ascensio System SIA in Riga, Latvia, an EU member state company. But the corporate ownership chain has multiple non-EU layers that procurement teams must understand before signing material multi-year deals: Ascensio System SIA was originally established in 2009 as a subsidiary of the Russian-based New Communication Technologies; in August 2023 the ownership restructure transferred control to Ascensio System Limited (UK), which is in turn owned by OnlyOffice Capital Group Pte. Ltd. (Singapore); the founder and ultimate beneficial owner Lev Bannov holds Russian and Turkish dual citizenship and has resided in Istanbul, Turkey since 2023. The August 2023 restructure was specifically designed to distance the operating entity from Russian ownership and align with EU procurement norms, but the structure is still non-trivial: EU-operating, UK-holding, Singapore-master-holding, Russian-Turkish UBO.
AGPLv3 open-source means the entire codebase is auditable and self-hostable: this is the procurement-grade escape hatch. Running the open-source ONLYOFFICE Community / Document Server on EU infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT) keeps everything inside the customer's chosen jurisdiction and effectively neutralises the ownership-chain complexity for the deployment data flows. The managed DocSpace cloud is a different proposition and does not run on Ascensio's own Latvian infrastructure: it runs on AWS, with the customer choosing one of three server regions, EU (Frankfurt), US West (Oregon) or Asia Pacific (Singapore). Managed-tier documents therefore sit at rest with a US-owned hyperscaler and a US region is selectable, which is why CLOUD Act exposure is recorded as Material for the cloud while self-hosting stays clear of it. Pricing: open-source self-host free; DocSpace Cloud is quoted in USD only, with a free Startup tier and Business at USD 30 list per admin per month. Best fit: EU public-sector and government buyers (Lyon model) that self-host on EU infrastructure under AGPLv3, organisations needing Microsoft Office format compatibility with sovereign-deployment options, and any procurement-grade buyer comfortable with the complex but EU-operating ownership chain (or who self-hosts to neutralise it).
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of OnlyOffice
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.onlyoffice.com/legalterms…
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |