Outline
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked This listing Operated by a US-incorporated entity, directly subject to US jurisdiction.
US-incorporated open-source-style wiki (Outline, NYC) under BSL licence; self-hostable for EU sovereignty, but hosted cloud is US.
Outline is operated by a US-incorporated entity and remains directly subject to the CLOUD Act. It is listed under Docs & wikis.
Assessment notes
Outline is US-incorporated as General Outline, Inc. (New York City; founder Tom Moor) despite the open-source-style positioning. Source code is published under the Business Source License (BSL) which permits self-hosting but explicitly forbids competing hosted services; older versions (v0.62.0 and earlier) revert to Apache 2.0 four years after publication (March 2026 onwards). Hosted cloud is US-region; the company itself is us_owned with direct CLOUD Act exposure. Signals: self-hostable codebase (BSL / Apache-2.0 on older versions); EU-hosted self-deploy achieves no CLOUD Act exposure. Gaps: US ownership, US-hosted managed cloud, direct CLOUD Act exposure, no public DPA or sub-processors list. The hosted cloud should not be the first choice for EU buyers: procurement-grade alternatives in this category include HumHub (DE, AGPLv3), Nuclino (DE), Cryptpad (FR), OnlyOffice (LV), or BookStack (UK MIT).
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned This listing The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: No
-
No US CLOUD Act exposure: No
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: Yes
-
Third-party certification: No
Exposure depends on how you run this product.
Vendor-operated: the sub-processors below apply.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct This listing The operator itself is US-incorporated.
Deploy on your own EU infrastructure and you control hosting and every sub-processor.
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Jump to
About Outline
Outline is a US-incorporated open-source-style knowledge-base and wiki product, operated by General Outline, Inc. in New York City and originally founded by Tom Moor. The product positions itself as a fast, beautiful, real-time-collaborative knowledge base for teams, feature-comparable to Notion and Confluence but with a leaner UX and an open-source codebase on GitHub (outline/outline). The product targets fast-growing software teams, has built a strong following in the developer-tools community, and supports 20+ languages with RTL support, dark mode, Slack and Figma integrations.
For an EU-sovereignty audit Outline is the canonical "open-source license ≠ EU-controlled" case alongside Cal.com. The licence is the Business Source License (BSL): open-source in spirit but with a competitor-hosting prohibition that excludes Outline from the OSI-approved open-source definition. The BSL contract specifies that the codebase reverts to Apache 2.0 four years after publication date, so v0.62.0 (and earlier) became Apache 2.0 in March 2026. This means buyers can fully self-host the licence-converted Apache 2.0 versions on EU infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT) with no licence-restriction concerns and no CLOUD Act exposure for that path. The hosted Outline cloud, by contrast, is operated from the US by General Outline, Inc., which is us_owned and subject to US extraterritorial law by default: direct CLOUD Act exposure.
The self-host path on EU infrastructure is procurement-grade-friendly, but the managed cloud should not be the first choice for EU buyers when category alternatives like HumHub (DE, AGPLv3, German GmbH), Nuclino (DE), Cryptpad (FR, E2E-encrypted), OnlyOffice (LV), BookStack (UK, MIT-licensed self-host), or Wiki.js (open source self-host) offer structurally cleaner EU-controlled ownership. Best fit: EU developer teams who specifically want Outline's UX and are willing to self-host on EU infrastructure under the converted Apache 2.0 versions.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Outline
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |