Cloud Storage & File Sharing
DRACOON
EU origin, foreign-owned Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by DRACOON GmbH · www.dracoon.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
DRACOON at a glance
- Vendor
- DRACOON GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates DRACOON 3/5, the mean of 6 judges. DRACOON is an enterprise file-sharing cloud from DRACOON GmbH of Regensburg. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
DRACOON is an enterprise file-sharing cloud from DRACOON GmbH of Regensburg. Its strongest showing is encryption and security, where scores cluster at 7-8: client-side encryption holds keys only on the user's device and the operator cannot decrypt even with the user's consent, with BSI C5 Type 2 and a YesWeHack bug bounty stated. Sharing and collaboration and portability and integrations follow, the latter resting on a documented JSON/REST API exposing the complete feature set, over 130 connection options and an on-premises option. Sovereignty is the weakest substantive cluster at 4-5: we found no public information on storage locations for files and metadata or on a published data processing agreement for the file chain — the privacy policy names only website subprocessors such as HubSpot and Facebook in the USA — and the pages carry the US acquirer Kiteworks' branding and support address. Sync and access scored 5-6, with no public information on a Linux client, delta sync or file size limits. Scores sit within a single point on every criterion, with no split flagged; each tier price reads 'auf Nachfrage'.
Speaks for it
- Client-side encryption generates and holds keys only on the client, so the operator cannot decrypt even with the user's consent
- A documented JSON/REST API exposes the complete feature set, with SDKs, a developer community, over 130 connection options and cloud or on-premises deployment
- Share and file-request links carry password, expiry, download caps and a second password by SMS, alongside read-only or write data rooms
- Group and role-based rights, one-click revocation of a leaver's authorisations and automatic alerts on abnormal data drains are documented
- Previous versions remain fully recoverable from the recycle bin after a ransomware attack
Held against it
- We found no public information on storage locations for files, metadata and backups, or on a published data processing agreement for the file chain
- The captured pages carry Kiteworks branding with a kiteworks.com support address, and the parent company is US-based
- We found no public information on organisational key recovery, the length of version history, or the scope of the BSI C5 certification
- We found no public information on SCIM provisioning, remote wipe, legal hold or an exportable audit log
- Every tier price appears only as 'auf Nachfrage', and Basic and Pro start at 50 licences, Premium at 100
Best for
- You handle confidential client files — patient letters, tax records — and need encryption the operator cannot decrypt even with the user's consent
- You are retiring an FTP or file server and want the complete feature set available through a documented JSON/REST API, with an on-premises option
- You exchange large files with external partners who install nothing, using share and upload links with passwords, expiry and size caps
- Your collaboration runs on Microsoft Outlook and Teams, where attachments convert to secure share links
Avoid if
- You are a team of fewer than 50 people, since Basic and Pro start at 50 licences and Premium at 100
- Your sign-off requires storage locations and a data processing agreement for the file chain in writing before any file moves
- Your procurement requires a fully European-facing chain, since the pages carry US-owned Kiteworks branding, a kiteworks.com support address and US website subprocessors
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 3 of 5 |
| Sharing & external collaboration | 3 of 5 |
| Encryption, key custody & recovery | 3.5 of 5 |
| Administration, audit & governance | 3 of 5 |
| Export, API & self-hosting | 3.5 of 5 |
| European sovereignty | 2 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
The desktop client for Windows and Mac mounts as a drive in Explorer and Finder with files-on-demand, cloud-only offload, and data rooms, folders and files kept offline that resync automatically, plus free iOS and Android apps, a browser-independent web app, and WebDAV. That covers my shop-floor and office access needs. We found no public information on a Linux client, block-level or delta sync, full-text search, previews, or file size limits, which is what keeps this short of the higher levels. 5 9 10 3 11
The Data Protection Officer
Clients for Windows and Mac mount DRACOON as a drive in Explorer and Finder, selective sync keeps files on demand only, and selected data rooms, folders and files can be held offline with automatic resynchronisation — mobile apps, a web app and WebDAV complete the picture. We found no public information on a Linux client, block-level sync, camera upload, previews of common formats or stated file size limits, so I cannot place it higher for staff moving large salary and imaging files. 5 9 10 3
The Architecture Practice Partner
DRACOON mounts as a drive in Windows Explorer and the Mac Finder so our CAD software can save straight to it, keeps files on demand in the cloud until they are opened, and holds marked data rooms, folders and files permanently offline on PC and Mac with automatic sync when the connection returns; mobile apps for iOS and Android and WebDAV access are documented. We found no public information on delta or block-level sync for multi-gigabyte models, a Linux client, file size limits, or offline plan folders on the phone for the building site. 5 9 10 11
The Tax Adviser
Windows and Mac clients mount the cloud as a drive, store files on demand to save local disk space, and sync offline edits automatically once a connection returns, with a web app, iOS and Android apps, and WebDAV alongside; offline data rooms and a document scanner are also described. We found no public information on a Linux client, camera upload, previews, search, or file size limits. 5 9 10 11
The Agency Producer
The Windows and Mac client mounts DRACOON as a drive in Explorer and Finder, keeps files on demand to save disk space, syncs offline edits automatically when the connection returns, and free iOS/Android apps, a WebApp, WebDAV and large-file sending round it out for us. We found no public information on a Linux client, block-level sync, full-text search or stated file size limits, which matters when a single shoot fills a terabyte. 5 9 10 11 14
The Skeptic
Windows and Mac clients that mount as a drive, download on demand, park unused files in the cloud only, and keep selected rooms offline are documented, along with free iOS and Android apps, a web app and WebDAV. We found no public information on a Linux client, full-text search, file size limits or delta sync for large files, so this is a two-desktop story, not a whole-organisation one. 5 9 10 11
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Share links come with password, expiry, an additional SMS password and download limits, file request links carry size and count caps, and encrypted data rooms give read-only or write rights per room, with Outlook and Teams add-ins replacing attachments with links and co-editing named for Microsoft Teams. For my engineering drawings going to customers this is a solid middle ground. We found no public information on watermarking, guest accounts with their own permissions, an access log per share, or administrator-enforced link policies beyond a general claim of full control over access rights, shares and security policies. 3 11 5 1 9
The Data Protection Officer
Share links carry password, expiry date, download caps and an additional SMS password sent on a separate channel, file-request links have their own limits, data rooms grant read-only or write rights, and the Outlook add-in converts attachments into secure links while Teams supports opening, sharing and co-editing. We found no public information on watermarking, guest accounts with their own permissions, a per-share access log, or file locking and comments — the controls I would want before sharing patient letters externally. 3 11 9 5
The Architecture Practice Partner
Share links come with password, expiry, download limits, a second password by SMS and download notification, file requests cap upload size and file count, and in encrypted data rooms a room admin grants read-only or write access, so our structural engineers can pick up a folder without an account; co-editing in Microsoft Teams and an Outlook add-in that turns attachments into shares are documented. We found no public information on watermarking, file locking, comments or an access log per share. 3 5 9 11
The Tax Adviser
Every control my practice needs for clients who install nothing is documented: file request links with password, expiry, SMS second factor and maximum upload size, share links with download limits and download notification, read-only data rooms with granular per-room permissions, notifications on uploads, plus Outlook and Teams add-ins with co-editing named for Microsoft Teams. Watermarking, guest accounts, a per-share access log, file locking and comments are not described on the captured pages. 3 5 11
The Agency Producer
Download links come with password, expiry, download limits and even a second password by SMS, upload links let customers send us footage with size and count caps, and data rooms with read-only or write rights plus Outlook and Teams add-ins cover most of our review workflow. We found no public information on comments on the file itself, watermarking or a per-share access log, so it stops short of a full data-room feel. 3 5 9 11
The Skeptic
Encrypted data rooms with room administrators, share and upload links carrying password, expiry, download limits and an SMS second channel, notifications, and Outlook and Teams add-ins with co-editing in Teams are all documented. We found no public information on watermarking, guest accounts, a per-share access log, file locking or comments, and administrator link policies appear only as a general claim of control over shares and security policies. 1 3 5 9 11
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
Client-side encryption is described in real depth: keys are generated and held exclusively on the client, no unencrypted files, keys or crypto passwords ever reach the server, and even the operator cannot decrypt, which directly answers my ransomware-and-prying-eyes question. Ransomware recovery is documented through previous versions landing in the recycle bin and being fully restorable, virus protection powered by WithSecure on Premium, multi-factor authentication, identity provider integration, BSI C5 Typ 2, and a bug bounty on YesWeHack. Version history length, organisational key recovery and the scope of the certification are not described, so it stops short of security I could fully verify myself. 13 9 3 5 8 1
The Data Protection Officer
The encryption pages are unusually explicit: keys are generated and held only on the client, no unencrypted file, key or crypto password ever reaches the server, and decryption is impossible for the operator even with the user's consent — with versioning and a recycle bin described as ransomware recovery, multi-factor authentication, BSI C5 Type 2 and a YesWeHack bug bounty. What I could not find in writing is what happens when a user loses the personal decryption password, and whether the end-to-end encryption survives a share link or office editing — for my clients that gap decides the score. 12 13 3 5 8 1
The Architecture Practice Partner
Client-side encryption is described in detail — all keys are generated on the client, never reach the server, and neither the operator nor third parties can decrypt — with a technical whitepaper explaining the scheme, plus multi-factor authentication, SSO via identity provider, file versioning whose recycle bin restores the previous version after a ransomware attack, virus protection in Premium, a bug bounty on YesWeHack and BSI C5 Typ 2. We found no public information on the scope of that certification, on ISO 27001 or SOC 2, or on what happens when a user loses their encryption password. 1 3 5 8 9 12 13
The Tax Adviser
Client-side encryption is documented in unusual detail: keys are generated only on the user's device, neither unencrypted files nor keys ever reach the server, and the operator cannot decrypt even with the user's consent — the provider professional secrecy under §203 StGB demands. BSI C5 Typ 2, multi-factor authentication, file versioning, recycle-bin recovery after ransomware and a bug bounty on YesWeHack are stated. We found no public information on the version-history length, organisational key recovery, or an independent audit or penetration test report. 1 3 5 8 12 13
The Agency Producer
Keys are generated and held only on the user's client, so the operator cannot decrypt anything even with the user's consent, a technical whitepaper describes the scheme, previous versions survive a ransomware attack via the recycle bin, and BSI C5 Typ 2 plus a public bug bounty on YesWeHack back it up. The length of version history and an external audit report of the cryptography are not stated on the captured pages. 1 3 5 8 9 13
The Skeptic
Client-side encryption is documented in real detail — keys generated and held only on the client, no server-side decryption even with the operator's consent — alongside BSI C5 Type 2, multi-factor authentication, file versioning, a ransomware restore via the recycle bin and a bug bounty on YesWeHack. But the certification's scope is not published, and we found no public information on an independent audit report, organisational key recovery, the length of version history, or whether the encryption survives sharing and browser editing — and the vendor itself argues server hacks trigger no GDPR notification, a claim that puts the entire burden on key custody being exactly as described. 1 3 5 8 13
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
I see group-based user and rights administration, role-based access, file classification, real-time reporting with automatic alerts when larger amounts of data are drained, Hybrid Syslog and SIEM connection, and one-click deletion of all authorisations when an employee leaves, which is the deprovisioning behaviour I need. Identity provider integration is documented through an OneLogin case. We found no public information on remote wipe of a lost laptop, provisioning through Entra ID or SCIM by name, quotas, legal hold, or an explicit statement that team folders belong to the company rather than the user, and those gaps matter for my file-server retirement. 5 11 1 9 3 14
The Data Protection Officer
Group administration, role-based rights, single sign-on via identity providers with a SIEM connection, file classification, deletion deadlines and one-click revocation of a leaver's authorisations are documented, and the reporting tool raises automatic alerts when larger amounts of data are drained. We found no public information on provisioning through a directory or SCIM, retention with legal hold, an exportable audit log or remote wipe of devices, which a hospital group will ask for before sign-off. 1 5 11 9
The Architecture Practice Partner
Group-based user and rights management with role-based access, granular permissions per data room, file classification, deletion periods, one-click revocation of all authorisations when an employee leaves, real-time reporting with automatic alerts when large amounts of data are drained, and SIEM connection including a Hybrid Syslog in Premium are documented. We found no public information on quotas, remote wipe of a lost laptop, legal hold or SCIM provisioning. 1 3 5 11 14
The Tax Adviser
Group management, role-based rights, single sign-on via identity provider, SIEM connection, file classification, deletion deadlines, real-time usage reporting with automatic alerts on abnormal data drains, and one-click revocation of a leaver's authorisations are all documented. We found no public information on directory or SCIM provisioning, an exportable audit log of logins, shares and file actions, legal hold, remote wipe or device restrictions. 1 5 9 11
The Agency Producer
Group and role-based rights, real-time usage reporting with automatic alerts when large amounts of data are drained, SIEM connection, file classification and one-click revocation of a leaver's rights are all documented, which fits how we add freelancers per project and remove them after. We found no public information on SCIM provisioning, an exportable audit log of logins and shares, remote wipe or legal hold. 1 5 9 11
The Skeptic
Role-based rights, group management, real-time reporting with anomaly alerts on data drains, file classification, deletion deadlines, one-click revocation of a leaver's authorisations and a SIEM/syslog connection in the top tier are documented. We found no public information on directory or SCIM provisioning, an exportable audit log, legal hold, remote wipe or device restrictions, which is where a regulated buyer's sign-off would stop. 1 3 5 11
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
A JSON/REST API with the complete feature set usable by every customer, SDKs, extensive API documentation, a developer community, over 130 connection options, a Zapier app reaching more than 2,000 B2B applications, SharePoint extension, DATEV DMS, and both cloud and on-premises deployment with a whitepaper comparing them. It is explicitly positioned as a replacement for outdated FTP and file servers, which is my exact project. We found no public information on webhooks, a documented bulk export including folder structure and versions, or what happens to the data on termination. 15 16 9 14 5 3
The Data Protection Officer
The complete feature set is usable by every customer through a documented JSON/REST API with SDKs, a developer community, a Zapier app and over 130 connection options; WebDAV and S3 object storage are named, and an on-premises edition is discussed in a whitepaper on cloud versus on-premises. We found no public information on webhooks, a bulk export preserving folder structure and versions, or the deletion terms on termination, and the migration story is positioned around replacing FTP and file servers rather than a named migration tool. 15 16 9 5 14
The Architecture Practice Partner
A documented JSON/REST API with SDKs, a developer community and the complete feature set usable by every customer through it, WebDAV and S3/object storage access, an on-premises edition, Outlook, Teams and SharePoint integrations plus Zapier and over 130 connection options are documented. We found no public information on bulk export of all data with folder structure and versions, dedicated migration tools from named providers, webhooks, or deletion of data on termination. 5 9 14 15 16
The Tax Adviser
An open JSON/REST API with SDKs and extensive documentation, unlimited API calls on the Pro and Premium tiers, WebDAV, over 130 connection options, a Zapier app, S3 object storage and an on-premises deployment option are documented, and the complete feature set is stated to be usable via the API. We found no public information on bulk export preserving folder structure, migration tools from a named provider, webhooks, or the treatment of data when the contract ends. 5 9 14 16
The Agency Producer
A documented JSON/REST API with SDKs, a developer community, the full feature set exposed via the API, over 130 connection options including Zapier, Outlook, Teams and SharePoint, WebDAV and S3 storage, plus an on-premises edition described in a Cloud vs. OnPremises whitepaper give us real exits and connections to Slack-style tooling. We found no public information on webhooks, migration tools from named providers, or what happens to our data on cancellation. 5 9 14 15 16
The Skeptic
A JSON/REST API exposing the complete feature set, SDKs, an API documentation site with developer community, Zapier access to over 2,000 apps, WebDAV and consulting for custom integrations are documented, and an on-premises option is discussed in a cloud-versus-on-premises whitepaper. We found no public information on bulk export with folder structure and versions, migration tools from named providers, webhooks, or what happens to data on termination — the exit path, which matters most, is undocumented. 5 9 15 16
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
The contracting entity is DRACOON GmbH in Regensburg with a German register court, register number and VAT ID, the product is presented as Made in Germany, BSI C5 Typ 2 is claimed, and the privacy policy names subprocessors with their locations, including HubSpot and Facebook in the USA and Google and Microsoft in Ireland. We found no public information on where the files and metadata themselves are stored, on a published data processing agreement, or on the data centre chain behind the storage. The pages themselves carry Kiteworks branding with a kiteworks.com support address and the company was acquired by a US parent in 2023, so before signing I would want the storage locations and the full processor list for the product, not just the website. 7 8 9 1 5
The Data Protection Officer
The contracting entity is DRACOON GmbH in Regensburg with a German register number and VAT ID, the pages claim "Made in Germany", and BSI C5 Type 2 is stated — but I found no storage locations in writing for files, metadata and backups, no subprocessor list for the service chain and no published data processing agreement. The captured pages carry Kiteworks branding with a kiteworks.com support address, and the parent company is US-based, so the chain is not transparent enough for a single patient folder to move on this evidence alone. 7 9 8 1 5
The Architecture Practice Partner
The contracting entity is DRACOON GmbH in Regensburg with a German commercial register entry, the product is positioned 'Made in Germany', and the privacy policy names subprocessors with locations, including the US providers HubSpot and Facebook under the EU-US Data Privacy Framework. We found no public information on where the cloud files and their metadata are stored, on a published data processing agreement or on named data centres, and the support address runs on kiteworks.com. 5 7 8 9 16
The Tax Adviser
The contracting entity is DRACOON GmbH, Regensburg, with a German register number and VAT ID, the product is presented as Made in Germany, and BSI C5 Typ 2 is a German federal scheme; the privacy policy lists subprocessors with locations, though these cover the website (Facebook and HubSpot in the USA, Microsoft under the Data Privacy Framework, Google Ireland with IP anonymisation) rather than the file chain. The parent company is Kiteworks of the USA — the captured pages carry its branding and support addresses at kiteworks.com — and we found no public information on named data centres or a published data processing agreement. 1 5 7 8 9
The Agency Producer
The imprint names DRACOON GmbH in Regensburg with a German register number and the product is marketed as Made in Germany, but we found no public information on where files, metadata and backups are actually stored or on a published data processing agreement. The privacy policy runs website traffic through American providers such as HubSpot and Facebook, and the support address sits at kiteworks.com, which leaves the chain beyond the German entity open. 5 7 8 9
The Skeptic
The contracting entity is a German GmbH with a Regensburg register entry, "Made in Germany" and BSI C5, but the captured pages state no storage location, publish no data processing agreement and name no processing chain for files and metadata — only website tools like HubSpot and Facebook in the USA appear as named subprocessors. Meanwhile the pages carry the US acquirer Kiteworks' branding and support answers at a kiteworks.com address, so a German shell of a page sits over an unstated, partly foreign-owned chain. 1 5 6 7 8 9
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
The tier structure is public: Basic from 50 licenses with 50 GB per user, Pro from 50 licenses with 100 GB, Premium from 100 licenses with 100 GB, unlimited users, SLA and API-call limits per plan, and a 14-day free trial with 5 users and 10 GB. But every tier's price is "auf Nachfrage" per user per month, and professional services are simply marked as charged extra, so I cannot compute our real annual cost from public pages and every quote is a sales conversation. 5 14 15
The Data Protection Officer
The plan structure is public — Basic from 50 licences with 50 GB per user, Pro from 50 licences and Premium from 100 licences at 100 GB per user, unlimited user numbers, and a 14-day trial with 5 users and 10 GB — but every per-user price is quoted as "auf Nachfrage", so no annual cost can be computed. VAT treatment and the cost of Professional Services, offered only "gegen Aufpreis", are likewise not stated anywhere we read. 5 14
The Architecture Practice Partner
Every business tier — Basic, Pro and Premium — is priced 'auf Nachfrage' with a request-price button, so no annual cost can be computed from the public pages; what is public is the structure: minimum licences of 50 (Basic and Pro) and 100 (Premium), unlimited maximum users, 50 to 100 GB cloud storage per user, per-tier SLA and API-call limits, and a 14-day free trial with 5 users and 10 GB. For a 25-person practice like ours the 50-licence minimum is itself a hurdle before any price is even named. 5 14 15
The Tax Adviser
The three business plans are published with their structure — minimum 50 licenses for Basic and Pro, 100 for Premium, 50 or 100 GB per user, and each tier's features and SLA — but every price appears only as 'auf Nachfrage' with 'Preis anfragen', so a buyer cannot compute an annual cost from the pages. A 14-day free trial with 5 users and 10 GB is public. For my eleven-person practice the 50-license minimum would already require a sales conversation. 5 14
The Agency Producer
The three plans publish their structure — 50 GB or 100 GB cloud storage per user, minimum 50 or 100 licences, SLA levels and API-call limits — but every price is 'auf Nachfrage' per user and month, so no annual cost for a 30-person shop can be computed from public pages. The only public offer is a 14-day free trial with five users and 10 GB, and we found no public information on extra storage, VAT or a free tier. 5 14
The Skeptic
Every paid tier — Basic, Pro and Premium — is priced "auf Nachfrage" per user per month, so no annual cost can be computed from public pages; what is public is the tier structure, minimum licences of 50, 50 and 100, storage per user, API call limits per tier, and a 14-day trial for 5 users with 10 GB. Published tier limits with unpublished prices still make every real purchase a sales call. 5 14
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about DRACOON
Is DRACOON European?
Partly. whats-best.ai classifies DRACOON as EU origin, foreign-owned.
Where does DRACOON store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does DRACOON have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to DRACOON?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: DRACOON alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 9 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
Sources (16)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.dracoon.com Checked 1 Nov 2026 Details →
- 2 Features page (platform) www.dracoon.com Checked 1 Nov 2026 Details →
- 3 Integrations page (Microsoft Teams) www.dracoon.com Checked 1 Nov 2026 Details →
- 4 Features page (GDPR-compliant file exchange) www.dracoon.com Checked 1 Nov 2026 Details →
- 5 Pricing page www.dracoon.com Checked 1 Nov 2026 Details →
- 6 Company page www.dracoon.com Checked 1 Nov 2026 Details →
- 7 Legal notice www.dracoon.com Checked 1 Nov 2026 Details →
- 8 Privacy policy www.dracoon.com Checked 1 Nov 2026 Details →
- 9 Sync, clients & file access — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 10 Sync, clients & file access — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 11 Sharing & external collaboration — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 12 Encryption, key custody & recovery — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 13 Encryption, key custody & recovery — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 14 Administration, audit & governance — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 15 Export, API & self-hosting — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →
- 16 Export, API & self-hosting — found from sitemap www.dracoon.com Checked 1 Nov 2026 Details →