Nextcloud Hub (Groupware & Office)

The Small Firm Owner

The client is respectable, with S/MIME and OpenPGP, shared folders via IMAP ACLs, delegated sending, automatic phishing detection and XOAUTH2 for Outlook and Gmail, but the pages say nothing about custom domains, DNS, DKIM, DMARC or delivery reputation because the sending infrastructure is not part of the product. For a firm that wants mail on its own domain that simply arrives, this is a front end for somebody else's mail setup. 1 2 13 14 15

Report an error

The IT Administrator

The client side is documented reasonably well — shared mailboxes via IMAP ACLs, S/MIME and OpenPGP via Mailvelope, automatic phishing detection and XOAUTH2 for Outlook interoperability — which lifts it just above the no-mailbox level. For my three hundred mailboxes this is a front end, not a mailbox platform, and the mail-server question stays open. 2 13 14 15

Report an error

The Public Sector IT Lead

Everything this criterion weighs — custom domains and DNS, aliases, filtering, DKIM or DMARC, mailbox limits, outbound reputation — sits with whichever mail server I pair the client with, and we found no public information on those for a Nextcloud deployment. As a client it is respectable: shared mailboxes via IMAP ACLs, S/MIME and OpenPGP, automatic phishing detection and unified multi-account inbox are all documented. 1 2 12 13 14

Report an error

The IT Service Provider

The client itself is decent — mailbox sharing via IMAP ACLs, S/MIME and OpenPGP through Mailvelope, delegation, automatic phishing detection, multi-account inboxes — and the data-processing page shows Dovecot Pro and Stalwart licenses being provisioned for Enterprise customers, but I found no public information on domain and DNS set-up, DKIM, DMARC or outbound deliverability. For my clients this is a front-end to a mail platform I would still have to run or source myself. 2 13 14 12 1

Report an error

The Data Protection Officer

The vendor's own pages state that the mail application is a client for existing IMAP and SMTP infrastructure rather than a mail server, so mailboxes, domains, DNS set-up and deliverability remain with the mail server our practices would run themselves. As a client it documents multiple accounts with a unified inbox, shared folders and delegation through IMAP ACLs, S/MIME and OpenPGP encryption usable with outside doctors, and automatic phishing detection. We found no public information on aliases, DKIM or DMARC handling, or sending limits from the product side. 2 13 14

Report an error

The Skeptic

The groupware pages say it plainly: Nextcloud Mail is "a client for IMAP-infrastructure; Nextcloud does not include a mail server," and shared mailboxes "you would have to set up... on your mail server." The client itself is respectable — S/MIME, OpenPGP via Mailvelope, mailbox sharing through IMAP ACLs, multiple accounts, automatic phishing detection — but every deliverability question I ask, from custom-domain DNS to DKIM, DMARC, spam filtering, send limits and outbound reputation, lands on a server the vendor neither ships nor documents here; the only server pairing visible is Dovecot Pro and Stalwart turning up as licensed products in the data processing list. 2 12 13 14

Report an error

The Small Firm Owner

This is the suite's strength: shared calendars with delegated event handling, room booking straight from the meeting dialogue, holiday calendars, browser co-editing with Microsoft file formats, file storage, Talk video meetings and chat, tasks with deadlines in the calendar, and apps for desktop, iOS and Android. Phone sync runs over CalDAV and CardDAV with third-party clients such as DAVx5, and the resource-booking picture is mixed — the captured pages both announce resource booking and report the creation interface as missing. Strong for the office, though not the Outlook-native calendar story my staff already know. 1 2 3 4 15 16

Report an error

The IT Administrator

Calendar, contacts, collaborative document editing in the browser with Microsoft format fidelity, file storage, Talk video meetings and desktop and mobile apps are all documented in one bundle, alongside delegated event creation, holiday calendars and room browsing and booking during a time slot. The captured pages give different pictures of room and resource set-up — the vendor page describes booking while community threads report the interface to create rooms and resources as missing — and we found no public information on Outlook calendar and contacts synchronisation. Offline editing, accessibility features and PDF editing are stated, so this covers most of an office suite short of documented feature parity per client. 1 2 3 15 16

Report an error

The Public Sector IT Lead

This is the strongest part of the offering for a Microsoft exit: co-editing of documents and spreadsheets in the browser with high-fidelity DOCX, XLSX and PPTX rendering and ODF support, Talk video meetings in the bundle, file storage with sharing, delegation of mail and calendar, holiday calendars, and desktop and mobile apps. The captured pages give different accounts of room and resource booking — a release announcement that it was introduced, a user who could not find resource calendars in that release, and a note that the calendar user interface to create rooms is missing — and calendar federation across organisations is documented as read-only only, so I would not yet plan cross-authority scheduling on it. 1 2 3 4 16

Report an error

The IT Service Provider

This is the strong side: room booking with availability display, delegated event handling, read-write CalDAV and CardDAV, in-browser co-editing with high-fidelity rendering of DOCX, XLSX and PPTX, file storage with sharing, Talk video meetings, and desktop, iOS and Android clients. A community thread reports the interface for creating rooms and resources trailing the feature's announcement, and I found no public information on an approval workflow for resource bookings or on feature parity across web, desktop and mobile. Accessibility support against standards such as EN 301 549 and WCAG 2.2 is listed on the compliance page. 1 2 3 16 4

Report an error

The Data Protection Officer

Shared calendars with delegated access, room booking with availability display, CalDAV and CardDAV access, an LDAP-backed company directory, tasks whose deadlines appear in the calendar, browser co-editing of Microsoft formats, Talk video meetings and clients for every desktop and mobile platform are documented, with accessibility stated against WCAG 2.2. Community threads from earlier releases describe resource-creation screens that lagged the announced booking feature, so I would verify room booking on the version we deploy. 1 2 3 4 7

Report an error

The Skeptic

The bundle is real: collaborative editing of DOCX, XLSX and PPTX alongside ODF in the browser, Talk video meetings and chat, files with sharing, tasks whose deadlines appear in the calendar, CalDAV and CardDAV served so DAVx5 and Thunderbird sync, apps for desktop, iOS and Android, and accessibility held out against EN 301 549 and WCAG 2.2. I hold it below the top because room booking is stated without any approval flow and the forum threads show the resource-booking interface arriving piecemeal, Outlook calendar and contacts sync is not documented, and calendar federation is read-only. 1 2 3 4 15 16 22

Report an error

The Small Firm Owner

Strong fundamentals: enforceable two-factor with WebAuthn and FIDO2, brute-force protection on by default, server-side and end-to-end encryption with HSM support, S/MIME and OpenPGP in Mail, an audit log with user, IP and timestamp, a HackerOne bug bounty, and a certification list including ISO/IEC 27001, BSI IT-Grundschutz and ANSSI CSPN. But the certifications come as a list without scope or auditor — CSPN is scoped to Nextcloud Files and the compliance documents cover Enterprise only — and we found no public information on GoBD-compliant mail archiving, legal hold, eDiscovery or a transparency report on authority requests. For an audit-sensitive tax practice that archiving gap is the worry. 2 4 6 7 18

Report an error

The IT Administrator

Enforceable two-factor with WebAuthn and FIDO2, server-side encryption with HSM support, end-to-end encryption of files, S/MIME and PGP in Mail, brute-force and suspicious-login protection, retention rules and an optional full audit trail are all documented, with ISO/IEC 27001, BSI IT-Grundschutz and ANSSI CSPN listed. The compliance pages note that certification and guarantees cover the Enterprise deployment only, with the hosting party responsible. We found no public information on GoBD-compliant archiving, legal hold, a transparency report on authority requests or a named auditor. 2 4 6 7

Report an error

The Public Sector IT Lead

Server-side and end-to-end encryption with HSM and recovery keys, S/MIME and OpenPGP in Mail, enforced two-factor across TOTP, FIDO2 and WebAuthn, retention and versioning, a full audit log, a HackerOne programme with a documented disclosure process, and ISO/IEC 27001 plus BSI IT-Grundschutz named alongside an ANSSI CSPN certification for Nextcloud Files. Two things hold it back for a regulated buyer: the compliance documents cover Enterprise only, with the hosting party — that is, my district — responsible for certification, and we found no public information on GoBD-compliant mail archiving, eDiscovery or a transparency report on authority requests. The captured pages also give different accounts of end-to-end encryption behaviour for subfolders, reported as configuration- and client-version dependent. 2 4 6 7 12 18

Report an error

The IT Service Provider

Two-factor authentication can be enforced across TOTP, WebAuthn and FIDO2, files and Talk calls support end-to-end encryption, Mail handles S/MIME and PGP, and the compliance page lists ISO/IEC 27001, BSI IT-Grundschutz and an ANSSI CSPN certificate with the scope expressly limited to the Enterprise edition. Retention rules, audit logging and machine-learning suspicious-login detection are documented, plus a HackerOne responsible-disclosure process. I found no public information on GoBD-compliant archiving, legal hold, eDiscovery or a transparency report on authority requests, and a 2019 community report about E2EE subfolders syncing as plaintext is recorded alongside replies that could not reproduce it. 4 7 2 14 18 6

Report an error

The Data Protection Officer

S/MIME and OpenPGP in the mail client, end-to-end encrypted folders with hardware key storage, server-side encryption with HSM support, enforceable multi-factor authentication and audit-ready logging are documented, and ISO 27001 and BSI IT-Grundschutz are listed for Enterprise deployments; the vendor also states its compliance documents cover Enterprise only. We found no public information on GoBD-compliant audit-proof mail archiving, legal hold or a transparency report on authority requests, and a 2019 community disclosure reports end-to-end encrypted subfolders stored in plaintext on the server, which another user could not reproduce. 2 4 7 14 18

Report an error

The Skeptic

Enforceable two-factor with WebAuthn and FIDO2, server-side AES-256, per-folder end-to-end encryption, S/MIME and PGP in Mail, brute-force and suspicious-login detection, an optional audit log with user, IP and timestamp, retention rules, and a certification list naming ISO/IEC 27001 and BSI IT-Grundschutz. But the vendor's own compliance page confines those documents to Enterprise and puts certification responsibility on "the hosting party," and I found no public information on GoBD-compliant mail archiving, legal hold, or a transparency report on authority requests; the 2019 community report of end-to-end-encrypted subfolders landing on the server as plaintext, even if another user could not replicate it, is exactly what a tax audit would ask about. 2 4 6 7 18

Report an error

The Small Firm Owner

For running the thing: LDAP and Active Directory integration, a documented SSO/SAML app, provisioning, remote wipe that works even on devices outside MDM, the occ command line plus REST and WebDAV APIs, admin-defined access rules, and support reaction times published per plan from two business days down to one hour. A branded, scalable offering for service providers points at a partner model. We found no public information on SCIM provisioning, delegated administration or exportable audit logs. 1 4 5 8 9 19

Report an error

The IT Administrator

Single sign-on through a documented SAML application, Active Directory and LDAP integration, remote wipe that works even on unmanaged devices, group administrators, guest accounts and provisioning are all on the vendor pages, together with the occ command-line tool and REST and WebDAV APIs. Reaction times per tier from two business days down to one hour, phone support in the top tier, and branded service-provider offerings give me a realistic operating picture. We found no public information on SCIM provisioning or explicitly exportable audit logs, which is what keeps this below the top level for my provisioning scripts. 1 4 5 8 9 19

Report an error

The Public Sector IT Lead

Single sign-on via a documented SAML app, LDAP and Active Directory integration with provisioning, group admins, enforced two-factor, remote wipe that works even on unmanaged devices, an audit log file, a command-line console and documented APIs, plus a service-provider programme and stated reaction times per tier from two business days down to one hour. We found no public information on SCIM provisioning or OpenID Connect, and mobile device policy management beyond the wipe capability is not described, which for eleven hundred staffed accounts is a real gap against directory-driven provisioning. 4 5 8 9 17 19

Report an error

The IT Service Provider

There is real material for a six-person shop like mine: LDAP and Active Directory integration, an SAML single sign-on app with admin documentation, remote wipe that works without device management, audit logging, the occ command line plus REST and WebDAV APIs, and support reaction times published per tier from two business days down to one hour. The enterprise pages also pitch fully branded cloud storage for service providers. I found no public information on SCIM provisioning, exportable audit logs, or a multi-tenant partner console for running forty clients from one place. 4 19 17 8 9 5

Report an error

The Data Protection Officer

Directory integration with LDAP and Active Directory, a documented SAML single sign-on app, group admins, guest accounts, provisioning, and remote wipe that works even on unmanaged devices are documented, alongside a command-line tool and REST and WebDAV APIs, with support reaction times published per tier. We found no public information on SCIM provisioning, exportable audit logs, or partner accounts managing several customer organisations. 4 8 9 19

Report an error

The Skeptic

SAML single sign-on has its own admin documentation, LDAP and Active Directory integration with provisioning, remote wipe that works even on devices outside management, the occ command line plus OCS and WebDAV APIs, and reaction times published per plan from two business days down to 1 hour, with a branded service-provider offering for partners. I found no public information on SCIM provisioning, admin roles, password policies or delegated administration, which keeps it below what a team running several customer organisations would want proven. 4 5 8 9 17 19

Report an error

The Small Firm Owner

The exit story is the best part: fully open source under copyleft licensing, self-hosted, and the vendor states it offers no hosting and has no access to data on customer instances — at contract end everything already sits on our own servers. Getting data in and out rests on CalDAV export, manual vCard import and a per-user migration app, and the community pages give different experiences for an imported Exchange calendar — one user reports it works perfectly, another that it never appears in the CalDAV export. Mail itself never migrates, which cuts both ways: nothing to lose, because nothing is stored here. 1 2 4 12 21 22

Report an error

The IT Administrator

The whole platform is open source and self-hosted, CalDAV and CardDAV give standard access, a user migration application handles export and import, and migration support is listed in every subscription tier with a footnote that it is subject to limitations. The Exchange calendar import I would depend on appears only as a community report, and we found no public information on a documented tool that moves a whole organisation with calendars and permissions, on free/busy coexistence during a move, or on mail migration at all, since the mail app only fronts an existing IMAP server. My Exchange retirement would remain two projects, not one. 1 4 9 15 21 22

Report an error

The Public Sector IT Lead

The exit story is the best I have seen: a hundred percent copyleft, fully open-source code base that we self-host, ODF and CalDAV and CardDAV as native paths, a user migration app for export and import of data and users, and migration support listed in every subscription tier. What is documented is per-user migration between Nextcloud servers and a community-reported Exchange calendar import, not a documented whole-organisation move from Exchange or Microsoft 365 with free/busy coexistence, and the migration support line carries a footnote that it is subject to limitations to discuss with sales. Because the mail itself lives on a separate server, the mail portion of my migration is simply not this vendor's problem. 1 3 4 9 15 21

Report an error

The IT Service Provider

Full copyleft open source with a self-hosted, even air-gapped deployment is the best exit insurance I could ask for, and a User migration app moves users' data out and in while migration support is listed in every subscription tier, though footnoted as subject to limitations to discuss with sales. CalDAV, CardDAV, vcf and ics keep the standard doors open, ODF is a supported format, and a community thread confirms importing an on-premise Exchange calendar. I found no public information on a tool that moves a whole organisation with calendars and permissions, on free/busy coexistence during a move, or on a data return period after cancellation — the last matters less when the data never leaves my own servers. 1 21 9 15 22 3

Report an error

The Data Protection Officer

The code base is fully open source and copyleft, deployment is self-hosted down to an air-gapped option, and mail stays on our own mail server since the application only reads it, which answers most of the exit question by architecture. A user-migration app, migration support in every plan marked subject to limitations, CalDAV and CardDAV access and ODF support are documented. We found no public information on whole-organisation export by an administrator, and a community thread reports an imported Exchange calendar not appearing in the CalDAV export. 1 4 9 21 22

Report an error

The Skeptic

This is where I relax: "100% copyleft licensing, no open core tricks," self-hosting down to air-gapped setups, mail that already lives on your own IMAP server, CalDAV and CardDAV as native protocols, ODF supported next to the Microsoft formats, and a user-migration app that moves files, tasks and users to another server — though the captured pages show it as an app you install rather than an admin-driven move of a whole organisation with permissions. Migration support is listed in every plan but carries the footnote "subject to limitations, discuss with your sales representative." 1 2 4 9 15 21 22

Report an error

The Small Firm Owner

Nextcloud GmbH is registered at the Munich court with a Stuttgart address, the privacy pages name the German entity as controller, and the product is designed to run on our own servers — the vendor states it offers no hosting and has no access to data on customer installations. A data processing agreement is published, scoped to Enterprise customers, with subprocessors listed and located, among them Hetzner and Zammad in Germany, Odoo in the EU, Stalwart in the UK, Thinkfree in Korea and a US email-delivery processor under the Data Privacy Framework. Certifications are listed rather than published with scope, but if we host it in Lower Saxony the chain is largely ours. 2 7 10 11 12

Report an error

The IT Administrator

The software is fully open source and runs on our own servers, with an air-gapped setup explicitly possible, and the vendor states its employees never gain access to customer data because it offers no hosting at all. The contracting entity is Nextcloud GmbH in Stuttgart with a Munich commercial register entry, a data processing agreement is published for Enterprise customers, and subprocessors are named with their locations and transfer mechanisms. What keeps this from the top mark is update-server telemetry unless deactivated and non-EU firms such as a United States mail-delivery service and a Korean office-suite provider inside the Enterprise support chain. 1 8 9 10 11 12

Report an error

The Public Sector IT Lead

Nextcloud GmbH is registered at the Munich district court under HRB 227086 with its seat in Stuttgart, and the product is documented as self-hosted on infrastructure I choose — including a fully air-gapped setup — with the vendor stating it has no access to customer data by design, offers no hosting, and transfers no user data from server or apps, with webpush and unified-push alternatives to avoid even the push proxy. The vendor's own operational subprocessors are listed with locations and transfer mechanisms, and a data processing agreement is published for Enterprise customers. What keeps this from the top is that the certifications are named rather than published with scope and auditor, and the compliance documentation is explicitly Enterprise-only. 1 2 7 10 11 12

Report an error

The IT Service Provider

The published data-processing page lists subprocessors with locations and transfer mechanisms, from Hetzner, Open-Xchange and Zammad in Germany to named non-EU processors under adequacy decisions, and ISO 27001 is stated with an Enterprise-only scope. The privacy policy discloses optional telemetry such as the updater and the push proxy together with alternatives, which is why I stop just short of the top mark. 10 12 1 2 7 11

Report an error

The Data Protection Officer

The contracting entity is Nextcloud GmbH of Stuttgart with a commercial register entry at the Munich court, a data processing agreement is published for Enterprise customers, and the sub-processor list names each processor with its country and the applicable transfer mechanism — the two documents I read first. Because the vendor states it offers no hosting and has no access to customer instances, mailboxes and referral letters sit on our own servers, with an air-gapped deployment documented and ISO 27001 and BSI IT-Grundschutz listed. An updater and a push proxy send technical data to the vendor's servers unless alternatives are configured, and certification documents are scoped to Enterprise deployments. 1 2 7 9 10 11 12

Report an error

The Skeptic

Nextcloud GmbH of Stuttgart, registered at AG München under HRB 227086, hosts nothing itself — "we do not offer hosting" — and the software runs on your own servers, even fully air-gapped, with the vendor stating it has no access to data processed in customer installations and that no user data is transferred to it by server or apps. A data processing agreement is published (Enterprise scope), the subprocessor list is public with locations, and ISO 27001 and BSI IT-Grundschutz are stated; the company's own operations do touch a United States email-delivery service and a United Kingdom licenser, but those handle names and email addresses of customers, not data inside your instance. 1 2 7 10 11 12

Report an error

The Small Firm Owner

The tiers are public and plainly worded — Standard starting at 100 users for 71.29€/user/year, Premium from 104.99€, Ultimate from 204.75€, stated as net of VAT with inclusions and reaction times per plan — but subscriptions start at 100 users, so my twelve-person firm sits below the floor before we begin. Storage per user, contract term, monthly versus annual billing and the price of the Outlook add-in are not stated, Enterprise is quote-only, and migration support carries a footnote that it is subject to limitations to discuss with a sales representative. No introductory discount is mentioned anywhere, which I appreciate — the price appears to be the price in year two. 3 5 9

Report an error

The IT Administrator

Three tiers are public with per-user yearly prices at one hundred and two hundred users — Standard starting at 71.29€/user/year, Premium at 104.99€/user/year, Ultimate at 204.75€/user/year — plus the one-hundred-user minimum, prices in Euro net excluding VAT, and a comparison showing what each tier includes. Storage per user, the price of the Outlook add-in and the cost behind the migration-support footnote are not stated, and custom functionality routes to a quote. I can budget the subscription but not compute the full annual cost for my three hundred users from these pages alone. 3 5 9

Report an error

The Public Sector IT Lead

Three tiers are publicly priced per user per year — Standard starting at 100 users for 71.29€, Premium for 104.99€, Ultimate for 204.75€, with 200-user prices of 53.17€, 81.99€ and 183.75€ — and the pages state prices are net, excluding VAT, with subscriptions available from 100 users. For an administration of my size the published ladder stops at 200 users, with further tiers and framework agreements only via quote, and we found no public information on storage per user, add-on prices, or a monthly versus annual comparison; the migration support and other footnote items are subject to limitations agreed with sales. 3 5 9

Report an error

The IT Service Provider

Three tiers are public with exact figures — Standard from 71.29€/user/year, Premium from 104.99€/user/year, Ultimate from 204.75€/user/year, each net of VAT and starting at 100 users — alongside a comparison table of what each tier includes and per-tier reaction times. But I found no public information on storage per user, add-on prices such as the Outlook add-in, monthly versus annual billing or contract terms, Enterprise is quote-only, and migration support is footnoted as subject to limitations. With a 100-user floor I cannot compute an annual cost for a five-person architect's office from these pages at all. 9 3 5

Report an error

The Data Protection Officer

Annual per-user prices are public for all three tiers with a second price point at 200 users, a minimum of 100 users, and net pricing excluding VAT stated, and the tier table shows support reaction times and which features such as the Assistant are included where. We found no public information on storage per user, contract term or monthly billing, and add-ons such as custom functionality are quoted only on request. 3 5 9

Report an error

The Skeptic

The tiers are public with honest figures — Standard "Starting at 100 users for 71.29€/user/year," Premium at 104.99€, Ultimate at 204.75€, lower per-user prices from 200 users, and prices stated as "net/excl. VAT". But storage per user is nowhere priced, there is no monthly-versus-annual comparison, phone support is "Optional" without a figure, and both the enterprise plan and "custom functionality" are quote requests — with several inclusions footnoted as "subject to limitations." 9

Report an error