Nextcloud

Nextcloud's privacy policy states personal data is stored "on our servers in the European Union" as a rule, and Nextcloud GmbH is headquartered in Stuttgart and Berlin, Germany. Because the software is self-hosted by design, the actual storage location for any given deployment is chosen by whoever runs the server, not fixed by the vendor — but Nextcloud GmbH's own hosted offerings, including Nextcloud One, are hosted in Germany.

Nextcloud offers end-to-end encryption as an opt-in option: users can select specific folders on desktop or mobile clients for E2EE, and those folders are unreadable by the server even if it is compromised. Nextcloud Talk also supports end-to-end encrypted calls, with browser support added in the Hub 26 Winter release. It is not the default for new accounts, but it is a working option.

Nextcloud's privacy policy contains no provision for selling personal data, and data sharing is limited to processors needed to run the service (e.g., payment providers, hosting providers) and is bound by contract. The site's own analytics run on a self-hosted Matomo instance with IP addresses anonymized, and tracking cookies are only activated with explicit consent via the cookie banner. The independent 2026 SURF and Privacy Company assessment of Nextcloud Enterprise corroborates this externally, finding the software has "not programmed the applications to automatically send Telemetry Data to the company" and that Nextcloud "cannot access any data processed in the customer environment, not even for support purposes."

Nextcloud's AI Assistant is optional and configurable rather than switched on by default, and administrators choose which model providers to use, including fully local, self-hosted large language models. Nextcloud states that its on-premises AI setup "guarantees data stays local and is not leaked to third parties through training of new AI models." The company also publishes an Ethical AI Rating framework that scores third-party AI tools on the same criteria it applies to itself.

The Nextcloud server repository is licensed AGPL-3.0, and Nextcloud states plainly that everything server-side runs under AGPL with desktop and mobile clients under GPL — no proprietary pieces. The paid Enterprise tier ships the identical open-source codebase; what it adds is a hardened release channel, SLA-backed support, and security backports, not unlocked or hidden functionality.

Germany's Federal Office for Information Security (BSI) commissioned an independent code security review of Nextcloud Server, published in July 2024, that combined source code, dynamic, and interface analyses. The vulnerabilities it found were disclosed to Nextcloud's team and fixed before the results were made public. Separately, a July 2026 Data Protection Impact Assessment of Nextcloud Enterprise by SURF and Privacy Company found "no known high data protection risks" and 15 low or already-solved risks. Both are independent, publicly documented reviews inside the three-year recency window, alongside an ongoing HackerOne bug bounty program for the wider codebase.

The nextcloud/server repository publishes a CONTRIBUTING.md file and a community Code of Conduct that covers all project spaces. It explicitly states that no Contributor License Agreement is required, meaning contributors retain rights to their own code. Multiple ways to contribute beyond code (translation, design, testing, and support) are documented and publicly available.

The core AGPL server remains free to self-host indefinitely. Nextcloud GmbH's commercial line is subscription-based: Enterprise support tiers are billed per user, per year (from roughly €69 to €205/user/year at 100+ users). The smaller Nextcloud One and Hub team plans quote per-user-per- month rates with an annual billing discount. Annual, recurring per-user billing is the primary paid structure across these tiers.

The free, self-hosted Community edition uses the same AGPL codebase as the paid tiers, with no artificial feature cap and no data monetization. Storage and user limits depend only on the hardware it runs on. This differs from a crippled "free tier" of a SaaS product: anyone can run the full product for free forever.

Enterprise support tiers (Standard, Premium, Ultimate) and the Nextcloud One and Hub team plans are listed with specific published prices rather than opaque "contact sales" figures at every level. No evidence of hidden fees, forced upgrades, or a difficult cancellation flow was found for either the hosted or the enterprise-support products.

Nextcloud's published Enterprise and Nextcloud One prices are flat in euros worldwide, with only volume discounts and per-industry negotiated quotes. No adjustment for local purchasing power in lower-income regions was found. The free self-hosted edition sidesteps this, but the paid products use flat global pricing.

Nextcloud Files are stored as ordinary files on the server's filesystem and are directly accessible via WebDAV, so there is no lock-in step required to access them in an open format. Beyond that, Nextcloud ships a built-in "Export my data" GDPR tool that, from the web interface, packages a user's full account data, as well as Contacts and Calendar exports, in standard vCard and iCalendar formats.

Nextcloud is a client-server product that always needs a server component, so it is not "fully local." However, that server can be the user's own hardware, a home NAS, or any VPS the user chooses, running the identical AGPL code used by Nextcloud GmbH's hosted plans. Full self-hosting has been the software's core distribution model since launch, not a limited mode.

The Nextcloud desktop client works like Dropbox or OneDrive. It keeps a local copy of synced files and folders so previously synced content remains accessible without an internet connection. Offline changes queue and sync automatically once the connection returns. Live features such as collaborative document editing and Talk calls still require an internet connection.

Nextcloud ships official clients for Windows, macOS, Linux, Android, and iOS, as well as a web interface. The Android client is distributed through F-Droid alongside Google Play.

Nextcloud's own documentation states the product aims to be "compliant with the Web Content Accessibility Guidelines 2.1 on AA level, with the high contrast theme even on AAA level." Also, it follows Germany's BITV 2.0 accessibility regulation. This is a specific, publicly documented target with concrete features (contrast themes, keyboard navigation, screen-reader support), not a vague commitment.

Nextcloud GmbH is a private German company (a GmbH), founded in 2016 by Frank Karlitschek and Niels Mache. The company states it has grown organically and has been profitable since its first year. Funding trackers (Tracxn, Crunchbase) show no institutional VC rounds since its founding — it is employee-funded rather than backed by outside investors or a Big Tech parent.

No acquisition, merger, or outside funding round has occurred in the past three years; Nextcloud GmbH remains under the same founder-led, employee-owned structure it has held since 2016. Independent funding tracker Tracxn records no institutional VC round in the company's history, corroborating the absence of any recent ownership change. Its recently announced plan to invest over €250 million into European digital-sovereignty infrastructure by 2030 is Nextcloud's own spending commitment, not an outside investment into the company.

Nextcloud GmbH publishes several corporate-level policies — an Anti-Corruption Code of Ethics and a Human Rights Policy — but both read as internal governance and workplace commitments rather than a public standard restricting harmful uses of the product itself. Its clearest public policy is the Ethical AI Rating framework, which sets specific rules for how AI features handle user data and applies them to its own Assistant as well as third-party integrations. Advertising is not part of Nextcloud's business model, so there is no ad policy for publishing; between the strong AI/data standard and the absence of any product-level harmful-use policy, this covers data and AI but not the other two areas the rubric asks for.

In 2024, Nextcloud became the first cloud software platform to earn Germany's Blauer Engel ("Blue Angel") ecolabel, an independent certification from the German Federal Environmental Agency that evaluates resource and energy efficiency. This is a specific, third-party-verified environmental credential, not a self-reported sustainability blog post.

Nextcloud launched in June 2016 and has been in continuous, active development for ten years, with regular seasonal "Hub" releases (Nextcloud Hub 26 Spring shipped in June 2026, server version 34.0.2) and ongoing maintenance updates for older supported branches.

The main server repository has more than 36,000 GitHub stars and an active pace of releases and maintenance updates, backed by public community forums at help.nextcloud.com and a large catalog of third-party apps. Nextcloud is used by the European Commission, multiple national governments, and cities across Europe, giving it an unusually broad and engaged institutional user base for open-source collaboration software.