# ONLYOFFICE Workspace — Business Email & Office Suites

ONLYOFFICE Workspace by Ascensio System SIA holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Ascensio System SIA (https://www.onlyoffice.com/de/workspace)
- Category: [Business Email & Office Suites](https://whats-best.ai/software/business-email.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/business-email/onlyoffice-workspace
- Alternatives: https://whats-best.ai/software/business-email/onlyoffice-workspace/alternatives ([markdown](https://whats-best.ai/software/business-email/onlyoffice-workspace/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Ascensio System SIA
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

ONLYOFFICE Workspace, from Ascensio System SIA of Riga, reads as a document suite first and a mail platform second. Its strongest area is migration and portability, scored 7-8: core products open source under AGPL v3 since 2014, free self-hosted downloads for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server, native Microsoft Office, OpenDocument and PDF handling, and deletion stated within 60 days of a request. Its weakest is mail and deliverability, 3-4, where the judges found no public information on spam and malware filtering, SPF, DKIM or DMARC, aliases or shared mailboxes, so none could judge whether mail lands. Calendar and office scored 6-7, administration and identity 6 throughout. The split is security and compliance, 4-6: documented TLS, AES-256 at rest and two-factor by default weighed against the vendor's own statement that it is not ISO-certified as a standalone product and no public information on GoBD-compliant archiving or legal hold. Sovereignty split 6-7 between the Singapore-registered parent and the documented self-hosted edition. Weighted verdicts ranged 5.3 to 6.4.

**Speaks for it:**
- Core products are open source under AGPL v3 and Apache 2.0, with free self-hosted downloads for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server.
- Real-time co-editing of documents, spreadsheets, presentations and PDFs with version history, plus desktop apps for Windows, Linux and macOS and mobile apps for iOS and Android.
- SAML 2.0 single sign-on with Shibboleth, OneLogin and AD FS, password complexity rules, IP restrictions and exportable audit logs.
- The self-hosted edition keeps documents, user data, metadata and audit logs on your own servers, with the vendor stating it has no access to your data.
- Deletion of data is stated within 60 days of a request, or immediately when the portal itself is deleted.

**Held against it:**
- We found no public information on spam and malware filtering, SPF, DKIM or DMARC, aliases, shared mailboxes or mailbox size limits, so deliverability cannot be judged from these pages.
- The vendor itself states ONLYOFFICE is not ISO-certified as a standalone product, and end-to-end encryption for Private Rooms is announced only as coming soon.
- We found no public information on GoBD-compliant archiving, retention policies, legal hold or eDiscovery.
- We found no public information on Active Directory or LDAP synchronisation, SCIM provisioning, or mobile device policies with remote wipe.
- Every paid tier — Enterprise, Enterprise Plus and Enterprise Premium — is listed as a lifetime licence per server priced on request.

**Best for:**
- You need co-editing of Microsoft Office, OpenDocument and PDF files with desktop apps for Windows, Linux and macOS and mobile apps for iOS and Android.
- You want to self-host the whole stack: free installers exist for Debian, Ubuntu, CentOS, RHEL, Docker and Windows Server, and the vendor states it has no access to your data.
- Your exit plan matters: core code is public under AGPL v3 and deletion is stated within 60 days of a request, or immediately on portal deletion.
- You manage identity through SAML 2.0 single sign-on with Shibboleth, OneLogin or AD FS and administer users from a central control panel.

**Avoid if:**
- You need an ISO-certified standalone product — the vendor itself states ONLYOFFICE is not currently ISO-certified as a standalone product.
- You need end-to-end encryption today — the captured pages announce it for Private Rooms only as coming soon.
- You must review a published data processing agreement before signing — the captured pages state it is available on request.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Small Firm Owner | The IT Administrator | The Public Sector IT Lead | The IT Service Provider | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Mail, domains & deliverability | 1.5/5 | 1.5/5 | 1.5/5 | 1.5/5 | 2/5 | 1.5/5 |
| Calendar, contacts & office apps | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 |
| Security, encryption & compliance archiving | 2.5/5 | 2/5 | 2.5/5 | 2.5/5 | 3/5 | 2/5 |
| Administration, identity & partner management | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Migration, open standards & exit | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| European sovereignty | 3/5 | 3/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 |
| Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r |
| **Weighted verdict** | **2.5/5** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The Small Firm Owner** (v1.0): Runs a tax and accounting firm of twelve in Lower Saxony. Every member of staff lives in Outlook, the shared "kanzlei@" mailbox is the busiest address in the office, and the meeting room is booked by shouting across the corridor. Wants mail on the firm's own domain that arrives, a shared calendar and address book on every phone, a move from the old provider that does not lose a single client thread, and a per-user price that is still the price in the second year.
- **The IT Administrator** (v1.0): IT administrator at a machine builder in Baden-Württemberg with three hundred mailboxes, an on-premises Exchange that reaches end of support, and Active Directory as the source of every account. Wants Outlook to keep working without a plug-in nobody maintains, shared mailboxes and room booking, single sign-on and directory sync, mobile devices that can be wiped, an API for provisioning, and a migration that moves calendars and permissions, not only mail.
- **The Public Sector IT Lead** (v1.0): Head of IT at a district administration in Bavaria with eleven hundred staff, told by the council to leave Microsoft within three years. Has read what Schleswig-Holstein did and what it cost. Needs mail, calendars and documents that a whole administration can work in, open formats and open source where possible, BSI C5 or ISO 27001 on paper, a provider whose owners answer to European law only, and an exit plan before the contract is signed.
- **The IT Service Provider** (v1.0): Runs a six-person IT service company in Austria that looks after mail for forty client firms, from a two-person architect's office to a hotel group. Spends Mondays on mails that landed in spam and phones that stopped syncing. Wants one partner console for every client, DKIM and DMARC set up without a ticket, migrations it can run itself, support that answers within the hour, and margins it can calculate before it quotes.
- **The Data Protection Officer** (v1.0): Data protection officer for a group of nine medical practices in North Rhine-Westphalia, where a referral letter sent by mail is patient data under professional secrecy. Reads the subprocessor list and the transparency report before the feature page, asks who at the provider can open a mailbox and under which law, and wants encryption the practices can actually use with outside doctors, archiving that satisfies the tax office, and a data processing agreement that names every server.
- **The Skeptic** (v1.0): Has seen "hosted in Germany" from a provider whose spam filter and support desk sit in the United States, "Exchange-compatible" that meant IMAP with a calendar plug-in, and a first-year price of one euro that became seven. Asks which protocols Outlook really uses, whether the archive would survive a tax audit, what the certification actually covers — and how ten years of mail, calendars and contacts would leave.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Bug bounty: HackerOne · yes [S5]
- Bug bounty: yes · security@onlyoffice.com · HackerOne [S13]
- DPA available: yes [S5]
- Encryption: yes · yes [S7]
- Encryption: yes · yes · yes · yes · yes [S1]
- GDPR: yes [S7]
- GDPR: yes [S10]
- GDPR: yes [S13]
- GDPR conform: yes [S5]
- GDPR DPA: yes [S13]
- HIPAA: yes [S13]
- HIPAA support: yes [S5]
- ISO: Docs included in solutions operating within ISO-certified products and infrastructures · no [S13]
- ISO certification: no [S5]
- Nis2 dora: no · no [S5]
- Nis2 dora: NIS 2 · DORA · no [S13]
- Open source: yes [S5]
- Open source: Source code publicly available on GitHub [S13]
- Open source license: AGPL 3.0 · yes [S7]
- Security measures: password strength settings · physical access control · brute-force resistant staff passwords · cipher-encryption · video surveillance and activity logs · two-factor authentication enabled by default · TLS encryption · trusted email domain… [S10]
- Two factor default: yes [S10]

**Data**
- AI content privacy: only on explicit plugin request · no [S5]
- Erasure timeline: 60 [S10]
- Inactive deletion: 180 · 7 [S10]
- Portability: data portability via backup options [S10]
- Portal deletion: yes [S10]
- Rectification: rectification [S10]
- Restriction: restriction of processing via portal deactivation · yes [S10]
- Retention: while account active [S10]

**Hosting**
- Aws marketplace: yes [S1]
- Aws storage: Amazon AWS · portal administrator [S10]
- Cloud data centers: Cloud data stored in certified data centers [S13]
- Cloud datacenters: yes [S5]
- Region options: EU (Germany) · US West (Oregon) · Asia Pacific (Singapore) [S10]
- Self hosted: yes [S7]
- Self hosted: yes · no [S5]
- Self hosted: yes · no [S13]
- Self hosted: yes [S1]
- Third party storage: yes [S5]
- Third party storage: yes [S13]
- Workspace os: Windows Server · Linux [S7]

**Integrations**
- API docs: yes [S6]
- Connector count: 40 · Nextcloud · ownCloud · SharePoint · Confluence · WordPress · Drupal · Jira [S16]
- Connectors: ready-made connectors integrate Docs into document management, collaboration and communication platforms with co-editing in-system [S6]
- Converters: Konverter für Textdokumente, Tabellenkalkulationen, Präsentationen und PDF [S4]
- Converters: text documents · spreadsheets · presentations · PDFs [S17]
- Ical and caldav: event import · iCal feeds from Google, Apple iCal, Yahoo! · CalDAV sync [S3]
- Odoo: Odoo · yes [S14]
- Third party services: Third-party integrations for logging, signing, authentication, storage [S1]

**Legal**
- Copyright holder: 2026 · Ascensio System SIA [S6]
- Entity: Ascensio System SIA · yes [S10]
- Latvia entity: Ascensio System SIA · 20A-6 Ernesta Birznieka-Upish street, Riga, Latvia, EU, LV-1050 · Latvia [S12]
- Operating company: Ascensio System SIA [S9]
- Operating company: Riga · Ascensio System SIA · Lettland [S8]
- Ownership: Ascensio System SIA · OnlyOffice Capital Group Pte. Ltd. · Latvia · ACRA Singapore [S7]
- Revision date: 2025-07-02 [S10]
- Singapore entity: ONLYOFFICE Capital Group Pte. Ltd. · 68 Circular Road, #02-01, Singapore 049422 · Singapore [S12]
- Terms documents: Cloud Nutzungsbedingungen; Docs Enterprise Lizenzvereinbarung; Docs Developer Lizenzvereinbarung; Docs Community AGPL v3; KI-Tools Lizenzvereinbarung; Apps Community AGPL v3; Workspace Enterprise Lizenzvereinbarung; SLA Service-Level-Agree… [S9]

**Pricing**
- Enterprise model: quote_required · per_server · lifetime · no [S7]
- Enterprise plus model: quote_required · per_server · lifetime · no [S7]
- Enterprise premium model: quote_required · per_server · lifetime · no [S7]

**Product**
- Ad free: yes [S7]
- Admin customization: yes · yes · yes [S1]
- AI agents rbac: yes [S13]
- AI integration: yes · yes [S13]
- AI local models: Ollama · LM Studio [S5]
- AI models flexible: Anbindung externer, lokaler oder Open-Source-KI-Modelle [S5]
- AI privacy: no · yes [S13]
- AI providers: AI: connect cloud AI providers or run local models on own server; AI Tools and AI Chat for writing, translating, summarizing, analyzing [S6]
- Anonymous use: yes [S10]
- Apps included: Docs · Groups · Mail · Talk [S7]
- Apps repo: AGPL-3.0 · Apps · Apache-2.0 [S16]
- Apps workspace: ONLYOFFICE Apps workspace: Rooms, Files, Forms, AI Agents, plugins, connectors, flexible access permissions [S6]
- Audit logs: yes [S5]
- Audit trail: yes [S13]
- Auth policies: Authentifizierungsrichtlinien: Mail-Domänen, Passwortkomplexität, Cookie-Lebensdauer/Sitzungsablauf, IP-Beschränkungen, Anmeldeversuch-Begrenzung, Anmeldehistorie [S5]
- Auth policies: trusted_mail_domains · password_complexity · session_expiry · ip_restrictions · login_attempt_limits · login_history [S13]
- Automated backups: Dropbox · Box · Google Drive · OneDrive · AWS S3 · Google Cloud Storage · yes [S13]
- Automatic backups: Dropbox · Box · Google Drive · OneDrive · AWS S3 · Google Cloud Storage · yes [S5]
- Automation API capabilities: comments · tracked changes · form filling [S15]
- Automation API definition: Automation API via Connector class enables interacting with office documents from outside, using custom interface elements [S15]
- Automation API purpose: Automation API lets you interact with office documents from outside the editors via the Connector class [S14]
- Available modules: Dokumentenmanagement · E-Mail · CRM · Projekte · Kalender · Community [S2]
- Bug bounty: HackerOne · yes [S16]
- Calendar integration: yes · yes [S2]
- Capabilities: working with comments · working with review changes · filling out forms [S14]
- Clustering: consulting only for active/passive configuration · yes [S7]
- Community channels: Community Forum, Discord, GitHub Discussions, Blog [S16]
- Community description: Bundle of web apps for team management and collaboration [S17]
- Communityserver repo: Apache-2.0 · CommunityServer [S16]
- Connector class: Connector class enables external interaction with documents [S14]
- Contribution ways: Code · Security · Translation · Testing [S16]
- Cookie opt out: yes · yes [S10]
- Core product: ONLYOFFICE Docs ist das Kernprodukt, als SaaS oder On-Premises integrierbar [S8]
- CRM integration: contacts · events · opportunities · yes [S2]
- Data sale: no [S10]
- Desktop apps platforms: Windows · Linux · macOS · Android · iOS [S2]
- Desktop platforms: macOS · Linux · Windows · yes · yes · yes [S6]
- Desktop platforms download: Windows · Linux · macOS · Android · iOS [S16]
- Desktopeditors repo: AGPL-3.0 · DesktopEditors · Windows · Linux · macOS [S16]
- Digital signatures: yes [S5]
- Digital signatures: yes · yes [S13]
- Docs 10 features: 10.0 · 1000 · 50 · 35 [S16]
- Docs capabilities: ONLYOFFICE Docs: online editors for text documents, spreadsheets, presentations, PDFs and fillable forms, real-time co-editing with comments, review, version history, AI Tools, plugins, connectors [S6]
- Docs current version: Docs 10.0 mit KI-Tools und modularen Apps; AI-Agenten veröffentlicht 2025-12-01 [S8]
- Docs feature list: Word processing · Spreadsheet editing · Presentation creation · Form building & filling · PDF editing · eBook creation · Diagram viewing · Collaboration · Signature · Security & compliance [S17]
- Docs features: Word processing · Spreadsheet editing · Presentation creation · Form building & filling · PDF editing · eBook creation · Diagram viewing · Collaboration · Signature · Security & compliance [S12]
- Docs features: word_processing · spreadsheet_editing · presentations · forms · pdf_editing · ebook_creation · diagram_viewing · collaboration · signature · security_compliance [S7]
- Docs features: word processing · spreadsheets · presentations · forms · PDF editing · e-books · diagram viewing · collaboration · signature · security & compliance [S4]
- Docs version: 1000 · 10.0 · more than 50 · 35 [S4]
- Docs version: 10.0 [S6]
- Docs version: 10.0 · 50+ · 35 [S15]
- Docs version: 10.0 · 1000 · 50 · 35 [S2]
- Docs version announcement: 10.0 · 1000 · 50+ · 35 [S12]
- Docs version announcement: 10.0 · 1,000 · 50+ · 35 [S17]
- Document permissions: Granulare Berechtigungen pro Dokument: nur ansehen, nur kommentieren, Überprüfen mit Änderungsverfolgung, Bearbeiten, Formulare ausfüllen; Download/Druck/Kopieren pro Benutzer einschränkbar [S5]
- Document permissions: view · comment · review · edit · fill_forms · yes [S13]
- Documents integration: yes [S2]
- Documents module: Document management with sharing, permissions, editing of text/spreadsheet/presentation/PDF/forms, collaboration [S1]
- Documentserver repo: AGPL-3.0 · DocumentServer · yes [S16]

**Subprocessors**
- 2checkout: 2checkout · payment processing · US · Netherlands · Romania [S10]
- Google analytics: Google Analytics · analytics [S10]
- Google oauth: Google · social login · US [S10]
- Monday com: monday.com · product integration [S10]

**Support**
- Basic response hours: basic · business_hours · 48 [S7]
- Channels: Community · Hilfe-Center · Academy · Webinare · White Papers · Support-Kontaktformular · Demo bestellen [S8]
- Channels: Community · Help Center · Academy · Webinars · White papers · Support contact form · Order demo [S17]
- Community forum: yes [S13]
- Get help channels: forum · contact support · training courses · webinars [S6]
- Help resources: Community · Hilfe-Center · Academy · Webinare · White Papers · Support-Kontaktformular · Demo bestellen [S4]
- Included services: standard_installation · primary_configuration · migration · update_installation · consulting [S7]
- Partner email: partners@onlyoffice.com · partner inquiries [S12]
- Partner resellers: yes [S7]
- Plus response hours: plus · business_hours · 24 [S7]
- Premium response hours: premium · business_hours · 12 [S7]
- Press email: press@onlyoffice.com · press inquiries [S12]
- Sales email: sales@onlyoffice.com · sales questions [S12]

81 more facts on the canonical page: https://whats-best.ai/software/business-email/onlyoffice-workspace

## Questions

### Is ONLYOFFICE Workspace European?

Yes. whats-best.ai classifies ONLYOFFICE Workspace as EU-Made.

### Where does ONLYOFFICE Workspace store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does ONLYOFFICE Workspace have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to ONLYOFFICE Workspace?

As of 6 Nov 2026, the panel rates [grommunio (3.5/5)](https://whats-best.ai/software/business-email/grommunio), [Infomaniak kSuite (3.5/5)](https://whats-best.ai/software/business-email/infomaniak-ksuite) and [Nextcloud Hub (Groupware & Office) (3.5/5)](https://whats-best.ai/software/business-email/nextcloud-hub) highest among the other 14 Business Email & Office Suites products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [grommunio](https://whats-best.ai/software/business-email/grommunio) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [ONLYOFFICE Workspace alternatives](https://whats-best.ai/software/business-email/onlyoffice-workspace/alternatives).

## What this page leaves out

- 22 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 18 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage (Workspace): https://www.onlyoffice.com/de/workspace (checked 2026-11-05)
- [S2] Features page (mail): https://www.onlyoffice.com/de/mail (checked 2026-11-05)
- [S3] Features page (calendar): https://www.onlyoffice.com/calendar (checked 2026-11-05)
- [S4] Features page (self-hosted editions): https://www.onlyoffice.com/de/download-workspace (checked 2026-11-05)
- [S5] Security / trust page: https://www.onlyoffice.com/de/security (checked 2026-11-05)
- [S6] Documentation (help centre): https://helpcenter.onlyoffice.com/ (checked 2026-11-05)
- [S7] Pricing page: https://www.onlyoffice.com/de/workspace-prices (checked 2026-11-05)
- [S8] About page (operating company): https://www.onlyoffice.com/de/about (checked 2026-11-05)
- [S9] Terms of service (names the operating company): https://www.onlyoffice.com/de/legalterms (checked 2026-11-05)
- [S10] Privacy policy: https://www.onlyoffice.com/de/privacy (checked 2026-11-05)
- [S11] Calendar, contacts & office apps — found from sitemap: https://www.onlyoffice.com/de/calendar (checked 2026-11-05)
- [S12] Calendar, contacts & office apps — found from sitemap: https://www.onlyoffice.com/contacts (checked 2026-11-05)
- [S13] Security, encryption & compliance archiving — found from sitemap: https://www.onlyoffice.com/security (checked 2026-11-05)
- [S14] Administration, identity & partner management — found from sitemap: https://www.onlyoffice.com/automation-api (checked 2026-11-05)
- [S15] Administration, identity & partner management — found from sitemap: https://www.onlyoffice.com/de/automation-api (checked 2026-11-05)
- [S16] Migration, open standards & exit — found from sitemap: https://www.onlyoffice.com/open-source (checked 2026-11-05)
- [S17] Migration, open standards & exit — found from sitemap: https://www.onlyoffice.com/download-workspace (checked 2026-11-05)

---

Cite as: whats-best.ai, "ONLYOFFICE Workspace — Business Email & Office Suites", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/business-email/onlyoffice-workspace

Corrections: https://whats-best.ai/correct/1551?target=page