Oodrive
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
French SecNumCloud-qualified secure file sharing, collaboration and e-signature, hosted entirely in France beyond CLOUD Act reach.
Oodrive is an EU-owned service hosted in France, with no identified CLOUD Act exposure. It is listed under File sharing.
Assessment notes
SecNumCloud 3.2-qualified end-to-end (infrastructure to software) plus HDS 2.0 and ISO 27001/27701, with data hosted exclusively in France under French jurisdiction and explicitly outside CLOUD Act/FISA reach.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Oodrive
Oodrive is a French trusted-cloud vendor (founded 2000, based in Paris) offering secure file sharing, data collaboration, backup and electronic signature through its Oodrive Work suite (sharing, storage, co-editing, chat, the Oodrive Meet video tool) and Oodrive Sign e-signature solution. It positions itself as Europe's leading sovereign collaboration platform and a direct alternative to Dropbox, Box, Google Drive and DocuSign for organisations handling sensitive data and critical infrastructure.
Its core differentiator is data sovereignty: solutions are hosted exclusively in France across two sites on hardware owned by Oodrive, under French jurisdiction and explicitly described as outside the reach of extraterritorial laws such as the US CLOUD Act and FISA. Oodrive was the first provider to receive the ANSSI Security Visa via SecNumCloud (2019) and holds SecNumCloud 3.2 qualification for its Oodrive Work and Oodrive Meet collaborative suite, renewed by ANSSI in February 2025 for three years. It also holds HDS 2.0 (health-data hosting), ISO 27001 and ISO 27701 certifications.
Pricing is enterprise and quote-based; there is no public free tier. Oodrive targets regulated sectors (public sector, finance, healthcare, defence) where SecNumCloud qualification is a procurement requirement rather than a marketing badge.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Oodrive
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicewww.oodrive.com/legals…
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |