Business Email & Office Suites
ONLYOFFICE Workspace
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Ascensio System SIA · www.onlyoffice.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
ONLYOFFICE Workspace at a glance
- Vendor
- Ascensio System SIA
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates ONLYOFFICE Workspace 3/5, the mean of 6 judges. ONLYOFFICE Workspace, from Ascensio System SIA of Riga, reads as a document suite first and a mail platform second. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
ONLYOFFICE Workspace, from Ascensio System SIA of Riga, reads as a document suite first and a mail platform second. Its strongest area is migration and portability, scored 7-8: core products open source under AGPL v3 since 2014, free self-hosted downloads for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server, native Microsoft Office, OpenDocument and PDF handling, and deletion stated within 60 days of a request. Its weakest is mail and deliverability, 3-4, where the judges found no public information on spam and malware filtering, SPF, DKIM or DMARC, aliases or shared mailboxes, so none could judge whether mail lands. Calendar and office scored 6-7, administration and identity 6 throughout. The split is security and compliance, 4-6: documented TLS, AES-256 at rest and two-factor by default weighed against the vendor's own statement that it is not ISO-certified as a standalone product and no public information on GoBD-compliant archiving or legal hold. Sovereignty split 6-7 between the Singapore-registered parent and the documented self-hosted edition. Weighted verdicts ranged 5.3 to 6.4.
Speaks for it
- Core products are open source under AGPL v3 and Apache 2.0, with free self-hosted downloads for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server.
- Real-time co-editing of documents, spreadsheets, presentations and PDFs with version history, plus desktop apps for Windows, Linux and macOS and mobile apps for iOS and Android.
- SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity rules, IP restrictions and exportable audit logs.
- The self-hosted edition keeps documents, user data, metadata and audit logs on your own servers, with the vendor stating it has no access to your data.
- Deletion of data is stated within 60 days of a request, or immediately when the portal itself is deleted.
Held against it
- We found no public information on spam and malware filtering, SPF, DKIM or DMARC, aliases, shared mailboxes or mailbox size limits, so deliverability cannot be judged from these pages.
- The vendor itself states ONLYOFFICE is not ISO-certified as a standalone product, and end-to-end encryption for Private Rooms is announced only as coming soon.
- We found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery.
- We found no public information on Active Directory or LDAP synchronisation, SCIM provisioning, or mobile device policies with remote wipe.
- Every paid tier — Enterprise, Enterprise Plus and Enterprise Premium — is listed as a lifetime licence per server priced on request.
Best for
- You need co-editing of Microsoft Office, OpenDocument and PDF files with desktop apps for Windows, Linux and macOS and mobile apps for iOS and Android.
- You want to self-host the whole stack: free installers exist for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server, and the vendor states it has no access to your data.
- Your exit plan matters: core code is public under AGPL v3 and deletion is stated within 60 days of a request, or immediately on portal deletion.
- You manage identity through SAML 2.0 single sign-on with Shibboleth, OneLogin or AD FS and administer users from a central control panel.
Avoid if
- You need an ISO-certified standalone product — the vendor itself states ONLYOFFICE is not currently ISO-certified as a standalone product.
- You need end-to-end encryption today — the captured pages announce it for Private Rooms only as coming soon.
- You must review a published data processing agreement before signing — the captured pages state it is available on request.
The scores
| Criterion | Panel median |
|---|---|
| Mail, domains & deliverability | 1.5 of 5 |
| Calendar, contacts & office apps | 3.5 of 5 |
| Security, encryption & compliance archiving | 2.5 of 5 |
| Administration, identity & partner management | 3 of 5 |
| Migration, open standards & exit | 3.5 of 5 |
| European sovereignty | 3 of 5 |
Mail, domains & deliverability
Show reasoningHide reasoning
How this is scored
How well the mailbox itself works: custom domains and their DNS set-up, aliases, catch-all, shared and functional mailboxes, distribution lists, mailbox and attachment size limits, IMAP, POP3, SMTP and Exchange ActiveSync or MAPI for Outlook, web and mobile apps, spam and malware filtering, SPF, DKIM, DMARC and MTA-STS, out-of-office and server-side rules, send limits, and the delivery reputation of the sending infrastructure. A self-hosted groupware is judged on the mail server it ships; a suite whose mail app is only a client for another server scores at the level of that client.
0 — No mailbox at all; a product that only sends transactional mail or only reads another provider's mail without a server of its own or a documented one to pair it with.
3 — Mailboxes on a custom domain with IMAP and SMTP and a webmail; aliases, shared mailboxes, filtering and DKIM or DMARC are basic or not described.
5 — Several custom domains with a documented DNS set-up, aliases and distribution lists, shared or functional mailboxes, IMAP and SMTP plus mobile apps, spam and malware filtering, SPF and DKIM signing, mailbox size per plan stated, server-side rules and out-of-office replies.
8 — Exchange ActiveSync or native Outlook (MAPI) support, DMARC reporting and MTA-STS or DANE, catch-all and plus addressing, delegated access and send-as, quarantine an admin can review, send and attachment limits stated, and the deliverability of the outbound infrastructure documented.
10 — A mail platform a large organisation runs on: every protocol above with feature parity stated per client, inbound and outbound gateways configurable, journaling, DANE and MTA-STS enforced, delivery monitoring and bounce analysis for admins, and mail flow documented end to end.
The Small Firm Owner
The mail module ships a mail server on the firm's own domain with IMAP sync, folders, automatic sorting filters and a backup of the mail server database, plus aggregation of outside accounts. We found no public information on aliases, a shared mailbox like our kanzlei@ address, spam and malware filtering, or SPF/DKIM signing, so I cannot judge whether client mail reliably arrives. 2 1
The IT Administrator
The workspace ships a mail server on your own domain with per-user mailboxes, IMAP sync and a webmail offering folders, automatic filters and signatures; that is where the documentation stops. For my Exchange replacement I found no public information on ActiveSync or native Outlook connectivity, shared mailboxes, aliases, spam and malware filtering or SPF/DKIM/DMARC, so nothing above the basic level is evidenced. 2 7
The Public Sector IT Lead
The captured pages show a mail server with mailboxes on the organisation's own domain, IMAP synchronisation, folders, filters, signatures and backup and restore of the mail server database, plus aggregation of external accounts. We found no public information on SMTP access, aliases, shared or functional mailboxes, distribution lists, spam and malware filtering, SPF, DKIM or DMARC, mailbox size limits, send limits or Outlook connectivity — for eleven hundred staff that is a thin mailbox picture. 2
The IT Service Provider
The mail module is a real mail server, not just a client: mailboxes on the customer's own domain with IMAP sync, folders, filters and signatures, plus backup and restore of the mail server database. But the captured pages say nothing about DNS set-up, aliases, shared mailboxes, spam and malware filtering or SPF, DKIM and DMARC — exactly what I configure first for every client and what decides whether mail lands in the inbox. We found no public information on send limits, mailbox sizes or the delivery reputation of the outbound infrastructure. 2 7 16
The Data Protection Officer
The captured mail page documents a mail server on the practice's own domain with team mailboxes, IMAP synchronisation, folder management, automatic filters, signatures, aggregation of external accounts, and backup and restore of the mail server database. We found no public information on the DNS set-up for domains, aliases, distribution lists, shared mailboxes, spam and malware filtering, SPF, DKIM or DMARC, or mailbox and attachment size limits. Trusted mail domain settings appear as a security option, which is not deliverability documentation. 2 6 10
The Skeptic
The mail module is a real mail server on your own domain — mailboxes for the team, IMAP synchronisation, folders, filters, signatures and a backup and restore of the mail-server database — so it clears the bar of a mailbox rather than a mere client. We found no public information on SMTP or ActiveSync for external clients, aliases, catch-all, shared mailboxes, mailbox and attachment limits, spam and malware filtering, SPF, DKIM or DMARC; no buyer can judge deliverability from these pages. 1 2
Calendar, contacts & office apps
Show reasoningHide reasoning
How this is scored
What the office plans and writes with: shared and team calendars, free/busy lookup, meeting invitations across providers, room and resource booking, shared address books and a company directory, CalDAV and CardDAV or ActiveSync for phones, Outlook calendar sync, tasks, online office documents with co-editing, file storage that comes with the suite, video meetings and chat inside the bundle, and the desktop and mobile apps.
0 — Mail only, with no calendar or contacts of any kind.
3 — A personal calendar and address book in the webmail; sharing, resources, sync protocols and office apps are basic or not described.
5 — Shared calendars and address books, meeting invitations with free/busy lookup, CalDAV and CardDAV or ActiveSync sync to phones and desktop clients, a company-wide address book, tasks, and either online office documents or a documented integration with an office suite.
8 — Room and resource booking with approval, delegated calendar access, Outlook calendar and contacts sync documented, co-editing of documents and spreadsheets in the browser, file storage with sharing, video meetings in the bundle, and apps for desktop, iOS and Android.
10 — A full office suite that replaces Microsoft 365 for a whole organisation: every function above with Microsoft file formats edited without loss, scheduling across organisations, resource planning, offline editing, an accessible interface stated against a standard, and feature parity across web, desktop and mobile documented.
The Small Firm Owner
Shared calendars with per-person access, invitations in and out, CalDAV sync and to-dos are documented, and the office side is genuinely strong: browser co-editing of documents, spreadsheets and PDFs with Microsoft, OpenDocument and OOXML compatibility, file storage with sharing, and apps for Windows, macOS, Linux, iOS and Android. We found no public information on room or resource booking for our meeting room, free/busy lookup, a company-wide address book or Outlook calendar sync. 3 6 8
The IT Administrator
Shared calendars with per-person access, invitations to and from third-party calendars, CalDAV sync, to-dos and reminders are documented, and the office side is genuinely strong: real-time co-editing in the browser, compatibility with Microsoft Office, OpenDocument and PDF, desktop editors for Windows, Linux and macOS with offline work, and iOS and Android apps. We found no public information on room and resource booking, free/busy lookup or Outlook calendar sync, which is exactly what our meeting-room operation would miss. 3 6 8 12
The Public Sector IT Lead
Personal and shared calendars with invitations, reminders, to-dos and CalDAV sync are documented, and the office side is the strongest part of the product: browser co-editing of text documents, spreadsheets, presentations and PDF forms with stated compatibility for Microsoft Office, OpenDocument and PDF formats, desktop editors with offline work for Windows, Linux and macOS, and mobile apps for iOS and Android. We found no public information on free/busy lookup, room and resource booking, CardDAV, Outlook calendar and contacts sync, or video meetings beyond the Talk app being named in the bundle. 3 6 7 8
The IT Service Provider
The office side is genuinely strong: co-editing of documents, spreadsheets, presentations and PDFs in the browser with version history, stated high compatibility with Microsoft Office formats, and free apps for Windows, Linux, macOS, iOS and Android, with Talk included in the bundle. The calendar offers personal and shared calendars, invitations, recurring events, to-dos, reminders and CalDAV sync. What keeps my hotel-group clients on Exchange is still missing: we found no public information on room and resource booking, free/busy lookup, Outlook calendar sync or video meetings. 3 6 7 16
The Data Protection Officer
Calendars are personal and shared with per-person access, invitations go out to and arrive from third-party calendars, and CalDAV synchronisation and iCal feeds are documented; the office side is strong, with browser co-editing of text documents, spreadsheets and presentations compatible with Microsoft Office, OpenDocument and PDF, version history, and apps for Windows, Linux, macOS, iOS and Android. We found no public information on room and resource booking, free/busy lookup, CardDAV, or video meetings in the bundle. That places document work well above the middle while leaving calendar depth for a nine-practice group unproven. 3 6 16 7
The Skeptic
Shared calendars with per-person access, invitations exchanged with third-party calendars, CalDAV sync, iCal feeds, to-dos and reminders are documented, and the office side is the strongest part of the bundle: real-time co-editing of text documents, spreadsheets, presentations and PDFs with version history, plus desktop apps for Windows, Linux and macOS and mobile apps for iOS and Android. We found no public information on room and resource booking with approval, delegated calendar access, CardDAV, a company-wide address book or video meetings in the bundle, so I stop short of the upper anchors despite the excellent editors. 3 6 1 13
Security, encryption & compliance archiving
Show reasoningHide reasoning
How this is scored
How mail and documents are protected and kept: TLS enforced in transit, encryption at rest, end-to-end encryption or S/MIME and PGP, who at the provider can read a mailbox, two-factor authentication and passkeys, phishing, malware and account-takeover protection, audit-proof archiving that meets GoBD, retention policies and legal hold, eDiscovery, backups and restore of deleted mail, a transparency report on authority requests, and certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No security information of any kind; no encryption, two-factor sign-in or archiving stated.
3 — Encrypted connections and a password login; encryption at rest, two-factor sign-in, archiving and certifications are basic or not described.
5 — TLS in transit and encryption at rest stated, two-factor authentication, spam, phishing and malware protection, restore of deleted mail for a stated period, archiving offered (built in or as an add-on), and a certification such as ISO 27001 stated for the data centres or the service.
8 — End-to-end encryption, S/MIME or PGP supported, GoBD-compliant archiving documented, retention policies and legal hold, enforced two-factor or passkeys for all users, a transparency report on authority requests, and certifications such as ISO 27001 or BSI C5 published with their scope and auditor.
10 — Security that holds up in an audit of a regulated organisation: zero-access or customer-held keys where the provider cannot read mail, eDiscovery, tamper-proof archive with documented verification, every certification published with its report or attestation available, independent security audits or open-source code reviewed, and incident disclosure documented.
The Small Firm Owner
Encryption at rest is stated with its algorithm (AES-256-CBC with HMAC-SHA256), TLS in transit, two-factor enabled by default, exportable audit reports, version restore, a public bug bounty on HackerOne and open-source code under AGPL v3. For a tax office the gaps hurt: the vendor states it is not ISO-certified as a standalone product, end-to-end encryption for Private Rooms is only announced as coming soon, and we found no public information on GoBD-compliant archiving, retention policies or a transparency report on authority requests. 13 10 5
The IT Administrator
AES-256 encryption at rest, HTTPS/TLS in transit, JWT-protected editing sessions, two-factor authentication enabled by default and exportable audit reports are stated, plus a public bug bounty on HackerOne. But the captured pages themselves say ONLYOFFICE is not ISO-certified as a standalone product, and I found no public information on GoBD-compliant archiving, retention policies with legal hold, eDiscovery or a restore window for deleted mail — the audit side of my job has nothing to stand on. 13 10 5
The Public Sector IT Lead
The documented protections are concrete: TLS in transit, AES-256-CBC encryption at rest with HMAC-SHA256 integrity verification for documents, two-factor authentication enabled by default with TOTP apps, IP restrictions, login attempt limits, exportable audit reports, JWT-protected editing sessions and a public bug bounty on HackerOne. But the vendor itself states the product is not currently ISO-certified as a standalone product, end-to-end encryption for Private Rooms is stated as coming soon, and we found no public information on GoBD-compliant archiving, retention policies and legal hold, eDiscovery, S/MIME or PGP for mail, or a transparency report on authority requests. 5 10 13
The IT Service Provider
TLS in transit, AES-256 encryption at rest with integrity verification, two-factor authentication enabled by default, JWT-protected editing sessions, exportable audit reports and a public bug bounty on HackerOne are all stated. But the vendor itself states ONLYOFFICE is not ISO-certified as a standalone product, the "certified data centres" come without a named certificate or scope, end-to-end encryption for Private Rooms is only announced as coming soon, and we found no public information on GoBD-compliant archiving, retention policies or legal hold, which my Austrian clients need for their tax records. 13 5 10
The Data Protection Officer
Two-factor authentication is enabled by default with TOTP apps, documents are encrypted at rest with AES-256-CBC and HMAC-SHA256 integrity, traffic runs over HTTPS/TLS, editing sessions are JWT-protected, audit reports can be exported, the code is open source, and a public bug bounty runs on HackerOne. But end-to-end encryption for Private Rooms is announced only as 'coming soon', the vendor itself states it is not ISO-certified as a standalone product, and we found no public information on S/MIME or PGP for mail, GoBD-compliant archiving, retention policies and legal hold, or a transparency report on authority requests. For a referral letter under professional secrecy, those gaps decide the level. 13 5 10 16
The Skeptic
Documented and real: TLS in transit, AES-256 encryption at rest with HMAC-SHA256 integrity verification, two-factor sign-in enabled by default, exportable audit reports, a public bug bounty on HackerOne and an AGPL-licensed code base anyone can read. The vendor itself states ONLYOFFICE is not ISO-certified as a standalone product, end-to-end encryption of Private Rooms is announced only as coming soon, and we found no public information on audit-proof archiving, retention policies, legal hold, eDiscovery or a transparency report — an archive that survives a tax audit is not something these pages show. 13 5 10 16
Administration, identity & partner management
Show reasoningHide reasoning
How this is scored
How an IT team or an IT service provider runs it: an admin console for users, groups, mailboxes and domains, admin roles, single sign-on (SAML or OpenID Connect), sync with Active Directory, Entra ID or LDAP, SCIM provisioning, mobile device policies and remote wipe, audit logs of admin and user actions, usage reports, a documented API for provisioning, multi-tenant or reseller accounts for partners managing several customers, and the support channels and response times per plan.
0 — No administration; one login per mailbox and nothing managed centrally.
3 — A web console to add mailboxes and aliases; roles, single sign-on, directory sync and audit logs are basic or not described.
5 — An admin console for users, groups, mailboxes and domains, admin roles, two-factor sign-in enforceable by the admin, password policies, a documented API or command line for provisioning, an activity or audit log, and business support by phone or ticket stated per plan.
8 — Single sign-on (SAML or OpenID Connect), Active Directory, Entra ID or LDAP sync, SCIM provisioning, mobile device policies with remote wipe, audit logs exportable, delegated administration, partner or reseller accounts that manage several customer organisations, and support response times stated.
10 — Administration that scales across many organisations: every setting reachable by API with parity stated, granular role scopes, policies by group, logs streamed to a SIEM, white-label partner offerings with separate billing, and an SLA with service credits published.
The Small Firm Owner
There is a Control Panel for users and security settings, SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity rules, IP restrictions, login attempt limits, exportable audit logs, a reseller network and support response times named per tier (48, 24 and 12 hours during business hours). We found no public information on directory synchronisation, SCIM provisioning or mobile device policies with remote wipe. 13 7 1
The IT Administrator
Single sign-on via SAML 2.0 including AD FS, password complexity rules, IP restrictions, login attempt limits and login history are documented, alongside a control panel for users and security settings, white labelling, a reseller network and support tiers with stated response hours of 48, 24 and 12 during business hours. The documented automation interface addresses office documents rather than provisioning, and we found no public information on Active Directory or LDAP synchronisation, SCIM or mobile device policies with remote wipe — without those I cannot hook up our directory or wipe a lost phone. 13 6 1 7 14
The Public Sector IT Lead
A Control Panel for users and security settings, SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity and IP restriction policies, exportable audit logs, white labelling and published support response times of 48, 24 and 12 hours by tier are documented. We found no public information on Active Directory, Entra ID or LDAP synchronisation, SCIM provisioning, mobile device policies with remote wipe, or partner accounts that manage several customer organisations — the reseller list is a directory of partners, not a documented multi-tenant model. 1 6 7 13
The IT Service Provider
There is a Control Panel with white-labelling, user and security management, SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity rules, IP restrictions, login history, exportable audit logs, and support tiers with stated response times of 48, 24 and 12 hours during business hours; installation, configuration and migration are listed as included services. But we found no public information on Active Directory synchronisation, SCIM provisioning, mobile device policies with remote wipe, or a partner console managing several customer organisations from one login — a reseller network is described, multi-tenant management is not. 6 1 13 7 5
The Data Protection Officer
A Control Panel manages users and security settings, single sign-on via SAML 2.0 with Shibboleth, OneLogin and AD FS is documented, alongside password complexity rules, IP-based restrictions, login attempt limits, session expiry, exportable audit logs, white labelling and a reseller network with a partner contact. Support response times are stated per tier at 48, 24 and 12 hours during business hours, and migration is among the included Enterprise services. We found no public information on Active Directory or LDAP synchronisation, SCIM provisioning, or mobile device policies with remote wipe. 13 7 6 1
The Skeptic
A control panel for users and security settings, SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity rules, IP restrictions, login attempt limits and exportable audit logs are documented, and support tiers promise a reply in 48, 24 or 12 business hours alongside a reseller network and white labelling. We found no public information on SCIM provisioning, directory synchronisation with Active Directory or LDAP, or mobile device policies with remote wipe; the automation API that is documented drives document workflows, not user administration. 13 6 1 7 12
Migration, open standards & exit
Show reasoningHide reasoning
How this is scored
How the organisation gets in and out: migration from Exchange, Microsoft 365, Google Workspace or another IMAP provider with a documented tool or service, mail, calendars and contacts carried over, coexistence during a move, standard protocols (IMAP, CalDAV, CardDAV, JMAP, open document formats) rather than proprietary ones, export of a mailbox and of the whole organisation in standard formats (mbox, EML, PST, ICS, vCard), open-source code or a self-hosted edition, what happens to data when the contract ends, and how domains and DNS are handed back.
0 — No way to bring mail in or take it out; a proprietary store with no IMAP access or export.
3 — IMAP access to mail; a migration path, calendar and contacts export and the end-of-contract handling are basic or not described.
5 — A documented migration from Exchange, Microsoft 365 or Google (a tool, an import or a service), mail, calendars and contacts imported, IMAP, CalDAV and CardDAV or ActiveSync access, export of mail, calendars and contacts in standard formats, and the deletion of data after the contract ends stated.
8 — A migration service or tool that moves whole organisations with calendars and permissions, coexistence with free/busy during the move, open document formats supported natively, export of the whole organisation by the admin, an open-source code base or a self-hosted edition, and a data return period after cancellation stated.
10 — An exit that costs nothing but time: every record exportable in open formats with the method documented, a self-hosted open-source edition with feature parity stated, migration in and out documented with the same tools, and a contractual data return and deletion with confirmation.
The Small Firm Owner
The route in and out is unusually open: the whole workspace is open source under AGPL v3 with free self-hosted downloads for Windows Server, Linux and Docker, mail via IMAP, calendars via CalDAV and iCal import, OpenDocument and Microsoft formats, configurable backups to storage of our choosing, and deletion 60 days after a delete request or immediately on portal deletion. Migration is named as an included support service, though we found no public information on a documented tool for moving a whole organisation from Exchange or Microsoft 365 with calendars and permissions. 16 7 10 2
The IT Administrator
Exit and standards are the strong side: the core is open source under AGPL v3, self-hosted installers exist for Debian, Ubuntu, CentOS, Docker and Windows Server, OpenDocument and OOXML are native, backups are configurable to external providers, and a 60-day deletion timeline with immediate portal deletion is stated. Migration into the platform is thin for us — it appears once in the included enterprise support services, but I found no public information on a documented Exchange or Microsoft 365 tool that moves calendars and permissions together. 16 17 10 7 8
The Public Sector IT Lead
This is what fits our exit requirement: the code base has been open under AGPL v3 since 2014, self-hosted editions for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server are publicly downloadable free of charge, and documents are handled natively in Microsoft Office, OpenDocument and PDF formats, with data portability via backup options and deletion within sixty days of a request stated. Migration appears once in the list of included support services, but we found no public information on a documented Exchange or Microsoft 365 migration tool, coexistence during a move, or export formats for whole-organisation mail, calendar and contacts data. 7 10 13 16 17
The IT Service Provider
Everything is open source under AGPL v3 since 2014, downloadable as Docker images and Debian, Ubuntu, CentOS and Windows Server installs — I can host the whole stack on my own Austrian servers, and the vendor states it has no access to self-hosted documents, user data and audit logs. Microsoft and OpenDocument formats are handled natively, backups go to the provider of my choice with configurable frequency and retention, and deletion timelines are published (immediate on portal deletion, otherwise 60 days). The gap is the way in: migration is named among the included support services, but we found no public information on a migration tool, on what it moves from Exchange, Microsoft 365 or Google, on coexistence, or on mailbox export formats. 16 17 10 7
The Data Protection Officer
The core products are open source under AGPL v3 with the code public on GitHub since 2014, and free self-hosted editions ship for Debian/Ubuntu, CentOS/RHEL, Docker and Windows Server, with OpenDocument and Microsoft Office formats supported natively. Data portability is implemented through backup options to storage of the customer's choosing, and deletion is documented — complete within 60 days of a request, or immediately when the portal itself is deleted. Migration is listed as an included Enterprise service, though we found no public information on a documented tool for moving mailboxes, calendars and permissions from Exchange or Microsoft 365. 16 4 10 7 8
The Skeptic
The exit here is better than most: core products under AGPL v3 and Apache 2.0 since 2014, self-hosted downloads for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server, compatibility with Microsoft Office, OpenDocument and PDF, IMAP synchronisation and aggregation of existing accounts, migration named among the included support services, and deletion of portal data immediately or within 60 days of a request. We found no public information on exporting a whole organisation's mail in standard formats, on coexistence during a move, or on a data-return period in portable form before deletion. 16 17 2 7 10 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where mailboxes, calendars, contacts, documents and backups are stored and processed, who at the provider or its subprocessors can access them, and who the subprocessors are (data centres, spam filtering, support, payment, AI features). Independently sourced by the sovereignty pipeline. An EU data region offered by a non-EU parent is part of the chain, not the whole of it. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (spam filtering, support, backups, AI features) run through non-EU providers or a non-EU parent without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated — or a self-hosted edition documented that keeps every mailbox on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Small Firm Owner
The contracting entity is Ascensio System SIA in Riga with an EU (Germany) region on Amazon AWS and subprocessors listed with their locations (2checkout in the US, Netherlands and Romania; Google in the US), but the parent OnlyOffice Capital Group Pte. Ltd. is registered in Singapore with no stated safeguard and the data processing agreement is available only on request. Offsetting that, a documented self-hosted open-source edition keeps documents, user data, metadata and audit logs on our own servers, with the vendor stating it has no access to the data. 12 7 10 13
The IT Administrator
The contracting entity is Ascensio System SIA in Riga, cloud portals can be set to the EU Germany region on Amazon AWS, and the privacy policy names subprocessors with locations (payment via 2checkout in the US, Netherlands and Romania, Google for login and analytics, monday.com); a documented self-hosted edition keeps documents, user data, metadata and audit logs on your own servers with no vendor access. The data processing agreement is available only on request rather than published, the parent OnlyOffice Capital Group is registered in Singapore, and no certification scope is stated for the service itself. 12 7 10 13
The Public Sector IT Lead
The contracting entity is Ascensio System SIA in Riga, Latvia, and the cloud offers an EU region in Germany on Amazon AWS with subprocessors named and located — but the parent OnlyOffice Capital Group Pte. Ltd. is registered in Singapore, the pages locate the founder and CEO in Istanbul, Google in the US handles login and analytics, 2checkout processes payments from the US, Netherlands and Romania, and the data processing agreement is available only on request rather than published. The documented self-hosted edition, where the vendor states it has no access to documents, user data, metadata and audit logs, is the path that keeps everything on our own servers, and that is what makes this viable for us rather than the cloud chain. 5 7 10 12 13
The IT Service Provider
The contracting entity is Ascensio System SIA in Riga, Latvia, and a cloud portal can be set to an EU (Germany) region on Amazon AWS — but the parent OnlyOffice Capital Group Pte. Ltd. is registered in Singapore, payment runs through 2checkout with US locations, and Google Analytics and Google login sit in the chain, with no stated safeguard for the non-EU parent. The data processing agreement is available on request rather than published, and no certification is held for the product itself. For clients who insist on EU servers, the documented self-hosted edition, where the vendor states it has no access, is the strongest answer. 7 12 10 13 5
The Data Protection Officer
The contracting entity is Ascensio System SIA in Riga, Latvia, but the parent is OnlyOffice Capital Group Pte. Ltd. registered in Singapore and the founder and CEO sits in Istanbul; cloud files are stored on Amazon AWS with an EU (Germany) region the portal administrator selects. Named subprocessors include 2checkout for payments (US, Netherlands, Romania), Google for social login and Google Analytics, and monday.com, while the data processing agreement is available only on request and we found no published list naming every server or a certification with its scope. The documented self-hosted edition — 'ONLYOFFICE has no access to your data' — is what lets a medical practice hold the whole chain on its own servers, and that is what keeps the level up. 12 7 10 13
The Skeptic
The contracting entity is Ascensio System SIA of Riga, the cloud runs on Amazon AWS with a selectable EU (Germany) region, and the privacy policy names third parties with their locations — 2checkout in the US, Netherlands and Romania, Google in the US. The parent, however, is OnlyOffice Capital Group Pte. Ltd. of Singapore, whose beneficiaries are registered at ACRA, the data processing agreement is available only on request, and no certification of the service is published. The strongest sovereign card is the documented self-hosted edition, which keeps documents, user data, metadata and audit logs on your own servers with no vendor access. 10 12 7 5 13
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or mailbox per tier, storage per user, what shared mailboxes, aliases and extra domains cost, which features (archiving, office apps, SSO, advanced security, more storage) cost extra, the first-year discount and the regular price after it, minimum users and term, monthly versus annual billing, and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price per user exists, but how cost scales with storage, users, add-ons or after the first year is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (archiving, extra storage, shared mailboxes, SSO, the price after the introductory period) is unpriced or "on request".
8 — Every tier priced publicly per user with storage, add-ons priced, the regular price after any introductory discount stated, minimum users and term stated, monthly and annual billing compared, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, storage and add-ons, with every support, migration and archive fee and the cancellation and data-return terms published.
The Small Firm Owner
Every paid tier — Enterprise, Enterprise Plus and Enterprise Premium — is priced "Auf Anfrage" per server with a lifetime licence, so I cannot compute what twelve seats would cost in the first year or the second. Public price points are limited to the free community edition, the free cloud startup plan, a 30-day trial and support tiers named without prices. 7 1
The IT Administrator
The paid tiers — Enterprise, Enterprise Plus and Enterprise Premium — all read "Auf Anfrage" (on request) per server with a "Lebenslang gültige Lizenz"; publicly priced are only the free community edition, the free cloud startup plan, a 30-day trial and one year of updates and support. I cannot compute an annual cost for three hundred users from these pages, and there is no public information on storage add-ons, minimum users, term options or VAT treatment. 7 1
The Public Sector IT Lead
Every paid edition — Enterprise, Enterprise Plus and Enterprise Premium — is listed only as quote on request, billed per server with a lifetime licence, including one year of updates and support and a thirty-day trial; the only public prices are the free community edition and the free desktop and mobile apps. We found no public information on per-user prices, storage costs, term lengths and minimum users, monthly versus annual billing, or VAT treatment, so no annual cost for my administration is computable from the public pages. 7 16
The IT Service Provider
The community edition and the cloud startup plan are free, and the Enterprise tiers are lifetime licences billed per server with prices given as "Auf Anfrage" (on request), a 30-day trial and one year of updates and support included. No per-user price, storage price or add-on price appears in the captured pages, so I cannot compute an annual cost for a client before asking for a quote — for a six-person firm quoting forty clients, every proposal waits on a sales round-trip. 7 16 1
The Data Protection Officer
All three Enterprise editions of Workspace are priced 'Auf Anfrage' per server with a 'Lebenslang gültige Lizenz', so a practice group cannot compute an annual cost from the public pages, and the support tiers state response times but no fees. A free Community edition, a free cloud Startup plan and a 30-day Enterprise trial are public, and one year of updates and support is included. That is a description of the licensing model, not a price list. 7 1 16
The Skeptic
The captured pricing page lists Enterprise, Enterprise Plus and Enterprise Premium as a lifetime licence per server at a price of 'Auf Anfrage' — on request — and the only public prices are zero: the free self-hosted community edition, free desktop and mobile apps and a free Startup cloud plan. We found no public information on per-user prices, storage tiers, add-on costs, minimum terms or VAT treatment, so no buyer can compute the real annual cost of the supported product from these pages. 7 1 4
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about ONLYOFFICE Workspace
Is ONLYOFFICE Workspace European?
Yes. whats-best.ai classifies ONLYOFFICE Workspace as EU-Made.
Where does ONLYOFFICE Workspace store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does ONLYOFFICE Workspace have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to ONLYOFFICE Workspace?
As of 6 Nov 2026, the panel rates grommunio (3.5/5), Infomaniak kSuite (3.5/5) and Nextcloud Hub (Groupware & Office) (3.5/5) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is grommunio (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: ONLYOFFICE Workspace alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Open source, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 22 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 18 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (Workspace) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 2 Features page (mail) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 3 Features page (calendar) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 4 Features page (self-hosted editions) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 5 Security / trust page www.onlyoffice.com Checked 5 Nov 2026 Details →
- 6 Documentation (help centre) helpcenter.onlyoffice.com Checked 5 Nov 2026 Details →
- 7 Pricing page www.onlyoffice.com Checked 5 Nov 2026 Details →
- 8 About page (operating company) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 9 Terms of service (names the operating company) www.onlyoffice.com Checked 5 Nov 2026 Details →
- 10 Privacy policy www.onlyoffice.com Checked 5 Nov 2026 Details →
- 11 Calendar, contacts & office apps — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 12 Calendar, contacts & office apps — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 13 Security, encryption & compliance archiving — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 14 Administration, identity & partner management — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 15 Administration, identity & partner management — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 16 Migration, open standards & exit — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →
- 17 Migration, open standards & exit — found from sitemap www.onlyoffice.com Checked 5 Nov 2026 Details →