Wiki.js
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
AGPLv3 open-source Node.js wiki by Nicolas Giard (Canada, 2016); 100M+ downloads; multiple DB backends; 40+ languages; self-host only.
Wiki.js is a European service hosted in Canada, with at most minor, transient US exposure under the CLOUD Act. It is listed under Docs & wikis.
Assessment notes
Wiki.js is an AGPLv3 open-source Node.js wiki created by Nicolas Giard (Montréal, Canada, senior software developer at IETF Administration LLC) in 2016 and led primarily by him through community contributions. 100M+ downloads, 28k+ GitHub stars, 40+ UI languages, no managed cloud, pure self-host on customer-chosen infrastructure. Canada holds EU adequacy decision under Art. 45 GDPR. When deployed on EU infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT) there is no CLOUD Act exposure, no vendor counterparty, no commercial entity, and no cap-table risk.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other This listing A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: No
-
EU / adequacy operator: No
-
No US CLOUD Act exposure: Yes
-
Public DPA: Not assessed
-
Sub-processors disclosed: No
-
Open-source clients: Yes
-
Third-party certification: No
Jump to
About Wiki.js
Wiki.js is an AGPLv3-licensed open-source wiki and documentation platform created by Nicolas Giard, a Montréal-based senior software developer (currently at IETF Administration LLC), and first released in 2016. The codebase is written in JavaScript on Node.js with a modern UI, fast performance, and a modular architecture that supports multiple database backends (PostgreSQL, MySQL, MariaDB, MS SQL Server, SQLite), multiple storage backends (Git sync, AWS S3, Azure Blob, Google Cloud Storage, local/network), multiple authentication options (local, LDAP, SAML, Azure AD, social OAuth), and multiple search providers (built-in DB search, Algolia, Azure Search, Elasticsearch). The project reports more than 100M downloads and 28k+ GitHub stars; supported by sponsors including DigitalOcean, GitHub, Cloudflare, and Netlify.
For procurement-grade EU buyers Wiki.js is structurally clean for the self-host path. The licence is full AGPLv3 with the standard copyleft requirements (any network-distributed modification must publish source under AGPL) so it suits in-house documentation use cases without complications. Self-host on EU infrastructure (Hetzner, OVHcloud, Scaleway, IONOS, STACKIT, T Cloud Public, or any other EU-incorporated host) delivers no CLOUD Act exposure and no vendor counterparty. The maintainer is Canadian; Canada holds an EU adequacy decision under Art. 45 GDPR so cross-border transfers between EU and Canada need no SCCs, but for self-host deployments the maintainer-jurisdiction is irrelevant since the customer controls all data flows.
Pricing is free for the open-source codebase; commercial support is offered via the maintainer + community. Best fit: developer teams and engineering organisations building internal documentation, EU SMBs and public-sector buyers wanting a Node.js modern stack alternative to MediaWiki / DokuWiki, customers who need Git-versioned content with full self-host control, and any organisation that prefers Node.js to PHP (vs BookStack which is PHP/Laravel-based).
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Wiki.js
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
n/aData Processing Addendum (DPA)— not assessed
-
n/aSub-processors list— not applicable
Alternatives in this category
-
SwitzerlandEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: Yes Open source: Yes -
-
United Kingdom · €0/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Not assessed Sub-processors: No Open source: Yes -
-
United Kingdom · €3/moEU-BasedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: No Sub-processors: No Open source: Yes -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Anytype
Switzerland
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: Yes
Open source: Yes
|
— |
BookStack
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Not assessed
Sub-processors: No
Open source: Yes
|
€0/mo |
Collabora Online
United Kingdom
|
EU-Based | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: No
Sub-processors: No
Open source: Yes
|
€3/mo |