Orbifs
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Norwegian-run virtual project drive (Archi Systems AS, EEA) for large CAD/BIM/point-cloud files, hosted on EU-owned OVHcloud in France with single-writer file locking and immutable versions.
Orbifs is a European service hosted in France, with at most minor, transient US exposure under the CLOUD Act. It is listed under File sharing.
Assessment notes
Archi Systems AS (Oslo, Norway, EEA, GDPR-bound; org. no. 916 683 332) runs Orbifs, a virtual project drive for very large CAD/BIM/point-cloud/media files, entirely on OVHcloud (EU-owned, French) with file bytes in Paris, metadata in Frankfurt and off-region backups in Paris, a public DPA, a public and deliberately short EU-based sub-processor list, and its own EEA mail server so no third party handles support correspondence; EEA-incorporated and EU-hosted at rest, which is why CLOUD Act exposure is minor rather than none: there is no end-to-end encryption (object storage uses provider-managed AES-256 SSE, BYOK still being finalised) and the only US-parented sub-processors are ancillary (Stripe Payments Europe (IE) for billing and optional Google/Microsoft Ireland sign-in), none of which touch project file content at rest; held at 4/5 (not 5) by those US-parented ancillary processors and the absence of any third-party certification, with only a self-published CSA STAR Level 1 (CAIQ) self-assessment and ISO 27001 / SOC 2 stated as in progress.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
European This listing Swiss/EEA-owned, with no significant US ownership; treated as European.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
- Sub-processors
- 4 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Orbifs
Orbifs is a virtual project drive for large professional files (CAD, BIM, point-cloud and media) built and operated by Archi Systems AS, a company incorporated in Oslo, Norway (org. no. 916 683 332, registered 2016, originally an architectural-services firm) and therefore within the EEA and bound by the GDPR. Files appear as ordinary files in Windows Explorer and macOS Finder and open on demand: there are no full local copies, no VPN, and no sync conflicts, because the drive streams object bytes from the cloud as they are needed. Concurrency is handled with single-writer file locking (one writer at a time on a CAD/BIM file) and every change is kept as an immutable version, implemented with S3 versioning plus Object Lock (write-once-read-many), SHA-256 content addressing and FastCDC content-defined chunking, so stored bytes cannot be overwritten or deleted before their lock expires. The desktop clients cover Windows and macOS.
For an EU-sovereignty audit the hosting story is the strong part. Orbifs runs on OVHcloud, a European-owned (French) provider, with file content (object bytes) in Paris, file metadata in Frankfurt, and off-region backups in Paris with point-in-time recovery: "hosted in Europe, end to end." Connections are TLS-terminated at the edge (Caddy) and object storage uses server-side AES-256 encryption; keys are currently managed by the storage provider, with a customer-managed-key (BYOK) option still being finalised, and there is no end-to-end / zero-knowledge encryption today. The sub-processor list is deliberately short and EU-based: OVHcloud (FR) for hosting, Stripe Payments Europe (IE) for billing, and optional Google Ireland / Microsoft Ireland sign-in for tenants who choose SSO, all EU subsidiaries of US-headquartered parents, but ancillary and never in the path of project file content at rest; support and transactional email run on Archi Systems' own EEA mail server, so no third party handles correspondence. This is why the directory records minor rather than none CLOUD Act exposure: the at-rest data sits on an EU-owned provider, but the lack of E2E plus the US-parented billing/optional-sign-in processors keep it just short of a clean none. On certifications the vendor is candid: a CSA STAR Level 1 (CAIQ) self-assessment is published, while ISO/IEC 27001 and SOC 2 are stated as in progress and Cyber Essentials / ENS as candidate; no third-party certification is claimed yet, so the directory lists none.
Pricing is paid with no free tier; annual billing is the headline price and all figures exclude VAT (monthly billing carries a ~15–20% premium): Studio at €69/month (1 TB, 5 seats), Practice at €249/month (5 TB, 20 seats), Business at €699/month (15 TB, 50 seats), and Enterprise from €1,990/month (50 TB+, with a dedicated region available). SSO/SAML and audit-log export are included on the Business plan and above. Best fit: architecture, engineering, construction and media teams that move very large CAD, BIM, point-cloud and video files and want a mounted, EU-hosted project drive with file locking and immutable history as a replacement for a NAS+VPN setup or a US cloud drive (Dropbox, OneDrive, SharePoint, Google Drive), with the caveat that this is a young, single-product vendor whose certifications and BYOK custody model are still maturing.
Sub-processor map · 4
-
Google Ireland Ltd. USIreland
Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Alphabet/Google)
-
Microsoft Ireland Operations Ltd. USIreland
Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Microsoft)
-
Stripe Payments Europe, Ltd. USIreland
Billing and payment processing; ancillary (EU subsidiary of US-headquartered Stripe)
-
OVHcloud (OVH SAS) EUFrance
Hosting, object storage, backups and logs; file content (Paris), metadata (Frankfurt), off-region backups (Paris)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Google Ireland Ltd. | Ireland | Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Alphabet/Google) | US |
| Microsoft Ireland Operations Ltd. | Ireland | Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Microsoft) | US |
| Stripe Payments Europe, Ltd. | Ireland | Billing and payment processing; ancillary (EU subsidiary of US-headquartered Stripe) | US |
| OVHcloud (OVH SAS) | France | Hosting, object storage, backups and logs; file content (Paris), metadata (Frankfurt), off-region backups (Paris) | EU |
Source: the vendor’s published sub-processor list, read 23 Jun 2026.
Frameworks & certifications · none listed
Capability matrix
Table 2Capabilities of Orbifs
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Switzerland · €4/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €10/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Switzerland · €4/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Proton Drive
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4/mo |
Tresorit
Switzerland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€10/mo |
kDrive (Infomaniak)
Switzerland
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€4/mo |