Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Orbifs

VERIFIED
File sharing · Norway
Founded 2016 · orbifs.eu ↗

Norwegian-run virtual project drive (Archi Systems AS, EEA) for large CAD/BIM/point-cloud files, hosted on EU-owned OVHcloud in France with single-writer file locking and immutable versions.

In short

Orbifs, in the File sharing category, is a European service with France as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

Archi Systems AS (Oslo, Norway, EEA, GDPR-bound; org. no. 916 683 332) runs Orbifs, a virtual project drive for very large CAD/BIM/point-cloud/media files, entirely on OVHcloud (EU-owned, French) with file bytes in Paris, metadata in Frankfurt and off-region backups in Paris, a public DPA, a public and deliberately short EU-based sub-processor list, and its own EEA mail server so no third party handles support correspondence; EEA-incorporated and EU-hosted at rest, which is why CLOUD Act exposure is minor rather than none: there is no end-to-end encryption (object storage uses provider-managed AES-256 SSE, BYOK still being finalised) and the only US-parented sub-processors are ancillary (Stripe Payments Europe (IE) for billing and optional Google/Microsoft Ireland sign-in), none of which touch project file content at rest; held at 4/5 (not 5) by those US-parented ancillary processors and the absence of any third-party certification, with only a self-published CSA STAR Level 1 (CAIQ) self-assessment and ISO 27001 / SOC 2 stated as in progress.

CLOUD ACT
OWNERSHIP
SUB-PROCS
4 · 3 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Orbifs

Orbifs is a virtual project drive for large professional files (CAD, BIM, point-cloud and media) built and operated by Archi Systems AS, a company incorporated in Oslo, Norway (org. no. 916 683 332, registered 2016, originally an architectural-services firm) and therefore within the EEA and bound by the GDPR. Files appear as ordinary files in Windows Explorer and macOS Finder and open on demand: there are no full local copies, no VPN, and no sync conflicts, because the drive streams object bytes from the cloud as they are needed. Concurrency is handled with single-writer file locking (one writer at a time on a CAD/BIM file) and every change is kept as an immutable version, implemented with S3 versioning plus Object Lock (write-once-read-many), SHA-256 content addressing and FastCDC content-defined chunking, so stored bytes cannot be overwritten or deleted before their lock expires. The desktop clients cover Windows and macOS.

For an EU-sovereignty audit the hosting story is the strong part. Orbifs runs on OVHcloud, a European-owned (French) provider, with file content (object bytes) in Paris, file metadata in Frankfurt, and off-region backups in Paris with point-in-time recovery: "hosted in Europe, end to end." Connections are TLS-terminated at the edge (Caddy) and object storage uses server-side AES-256 encryption; keys are currently managed by the storage provider, with a customer-managed-key (BYOK) option still being finalised, and there is no end-to-end / zero-knowledge encryption today. The sub-processor list is deliberately short and EU-based: OVHcloud (FR) for hosting, Stripe Payments Europe (IE) for billing, and optional Google Ireland / Microsoft Ireland sign-in for tenants who choose SSO, all EU subsidiaries of US-headquartered parents, but ancillary and never in the path of project file content at rest; support and transactional email run on Archi Systems' own EEA mail server, so no third party handles correspondence. This is why the directory records minor rather than none CLOUD Act exposure: the at-rest data sits on an EU-owned provider, but the lack of E2E plus the US-parented billing/optional-sign-in processors keep it just short of a clean none. On certifications the vendor is candid: a CSA STAR Level 1 (CAIQ) self-assessment is published, while ISO/IEC 27001 and SOC 2 are stated as in progress and Cyber Essentials / ENS as candidate; no third-party certification is claimed yet, so the directory lists none.

Pricing is paid with no free tier; annual billing is the headline price and all figures exclude VAT (monthly billing carries a ~15–20% premium): Studio at €69/month (1 TB, 5 seats), Practice at €249/month (5 TB, 20 seats), Business at €699/month (15 TB, 50 seats), and Enterprise from €1,990/month (50 TB+, with a dedicated region available). SSO/SAML and audit-log export are included on the Business plan and above. Best fit: architecture, engineering, construction and media teams that move very large CAD, BIM, point-cloud and video files and want a mounted, EU-hosted project drive with file locking and immutable history as a replacement for a NAS+VPN setup or a US cloud drive (Dropbox, OneDrive, SharePoint, Google Drive), with the caveat that this is a young, single-product vendor whose certifications and BYOK custody model are still maturing.

SUB-PROCESSORS

Sub-processor map · 4

Source ↗
  • Google Ireland Ltd. US
    Ireland

    Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Alphabet/Google)

  • Microsoft Ireland Operations Ltd. US
    Ireland

    Optional sign-in authentication (SSO); ancillary, only if tenant enables it (EU subsidiary of US-headquartered Microsoft)

  • Stripe Payments Europe, Ltd. US
    Ireland

    Billing and payment processing; ancillary (EU subsidiary of US-headquartered Stripe)

  • OVHcloud (OVH SAS) EU
    France

    Hosting, object storage, backups and logs; file content (Paris), metadata (Frankfurt), off-region backups (Paris)

3 of 4 sub-processors are US-incorporated. Limited CLOUD Act exposure via these ancillary sub-processors.
CERTIFICATIONS

Frameworks & certifications · none listed

We checked the vendor's website and standard certification body registries. No active certifications found at the time of last audit (2026-06-23).
FEATURES

Capability matrix

Free storage 0 GB
Paid storage (from) 1 TB
Max file size Unlimited
Photo sync No
File versioning Yes
Link sharing No
Platforms Windows macOS
INTEGRATION & ACCESS
REST API No
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
from €69/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

  • Data Processing Addendum (DPA)
    orbifs.eu/legal…
    Open ↗
  • Sub-processors list
    orbifs.eu/legal…
    Open ↗
  • Terms of Service
    orbifs.eu/legal…
    Open ↗
ALTERNATIVES

Alternatives in this category

Proton Drive
Switzerland · Founded 2014
EU-SOVEREIGN

Swiss zero-knowledge encrypted cloud (Proton AG, non-profit-foundation-controlled), 11,496 owned servers, ISO 27001 + SOC 2, 5 GB free.

Public DPA Sub-processors Open source
FROM
€4/mo
CLOUD ACT
NONE
Tresorit
Switzerland · Founded 2011
EU-HOSTED

Swiss-Post-owned (state-anchored) E2E encrypted enterprise cloud storage (Tresorit AG, Zurich), Swiss + EU DC options, ISO 27001.

Public DPA Sub-processors Open source
FROM
€10/mo
CLOUD ACT
MATERIAL
kDrive (Infomaniak)
Switzerland · Founded 1994
EU-SOVEREIGN

Swiss kDrive cloud (Infomaniak, Geneva, since 1994), own Swiss DCs, ISO 27001 + B Corp 2025, district-heating heat recycling.

Public DPA Sub-processors Open source
FROM
€4/mo
CLOUD ACT
NONE