# DRACOON — Cloud Storage & File Sharing DRACOON by DRACOON GmbH holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: EU origin, foreign-owned; sovereignty: not determined. - Vendor: DRACOON GmbH (https://www.dracoon.com/de/home) - Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md) - Provenance (editorial classification): EU origin, foreign-owned - Canonical page: https://whats-best.ai/software/cloud-storage/dracoon - Alternatives: https://whats-best.ai/software/cloud-storage/dracoon/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/dracoon/alternatives.md)) - Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01 **AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology ## At a glance - Vendor: DRACOON GmbH - Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026 - Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026 - Free plan: Not stated on the vendor’s pages as of 1 Nov 2026 ## The panel's verdict DRACOON is an enterprise file-sharing cloud from DRACOON GmbH of Regensburg. Its strongest showing is encryption and security, where scores cluster at 7-8: client-side encryption holds keys only on the user's device and the operator cannot decrypt even with the user's consent, with BSI C5 Type 2 and a YesWeHack bug bounty stated. Sharing and collaboration and portability and integrations follow, the latter resting on a documented JSON/REST API exposing the complete feature set, over 130 connection options and an on-premises option. Sovereignty is the weakest substantive cluster at 4-5: we found no public information on storage locations for files and metadata or on a published data processing agreement for the file chain — the privacy policy names only website subprocessors such as HubSpot and Facebook in the USA — and the pages carry the US acquirer Kiteworks' branding and support address. Sync and access scored 5-6, with no public information on a Linux client, delta sync or file size limits. Scores sit within a single point on every criterion, with no split flagged; each tier price reads 'auf Nachfrage'. **Speaks for it:** - Client-side encryption generates and holds keys only on the client, so the operator cannot decrypt even with the user's consent - A documented JSON/REST API exposes the complete feature set, with SDKs, a developer community, over 130 connection options and cloud or on-premises deployment - Share and file-request links carry password, expiry, download caps and a second password by SMS, alongside read-only or write data rooms - Group and role-based rights, one-click revocation of a leaver's authorisations and automatic alerts on abnormal data drains are documented - Previous versions remain fully recoverable from the recycle bin after a ransomware attack **Held against it:** - We found no public information on storage locations for files, metadata and backups, or on a published data processing agreement for the file chain - The captured pages carry Kiteworks branding with a kiteworks.com support address, and the parent company is US-based - We found no public information on organisational key recovery, the length of version history, or the scope of the BSI C5 certification - We found no public information on SCIM provisioning, remote wipe, legal hold or an exportable audit log - Every tier price appears only as 'auf Nachfrage', and Basic and Pro start at 50 licences, Premium at 100 **Best for:** - You handle confidential client files — patient letters, tax records — and need encryption the operator cannot decrypt even with the user's consent - You are retiring an FTP or file server and want the complete feature set available through a documented JSON/REST API, with an on-premises option - You exchange large files with external partners who install nothing, using share and upload links with passwords, expiry and size caps - Your collaboration runs on Microsoft Outlook and Teams, where attachments convert to secure share links **Avoid if:** - You are a team of fewer than 50 people, since Basic and Pro start at 50 licences and Premium at 100 - Your sign-off requires storage locations and a data processing agreement for the file chain in writing before any file moves - Your procurement requires a fully European-facing chain, since the pages carry US-owned Kiteworks branding, a kiteworks.com support address and US website subprocessors ## Scores by judge and criterion Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion. | Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic | | --- | --- | --- | --- | --- | --- | --- | | Sync, clients & file access | 3/5 | 2.5/5 | 3/5 | 2.5/5 | 3/5 | 3/5 | | Sharing & external collaboration | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 | | Encryption, key custody & recovery | 4/5 | 3.5/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | | Administration, audit & governance | 3.5/5 | 3/5 | 3.5/5 | 3/5 | 3/5 | 3/5 | | Export, API & self-hosting | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 | 3/5 | | European sovereignty | 2/5 | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 | | Pricing transparency | n/r | n/r | n/r | n/r | n/r | n/r | | **Weighted verdict** | **3.5/5** | **3/5** | **3/5** | **3/5** | **3/5** | **3/5** | ### The judges - **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share. - **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves. - **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account. - **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores. - **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte. - **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost. ## European sovereignty — proven facts Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined. | Dimension | Finding | Points | Source | |---|---|---|---| | Legal entity | Not determined | — | — | | Hosting location | Not determined | — | — | | Hosting options | Not determined | — | — | | Open source | Not determined | — | — | | Data processing agreement | Not determined | — | — | | Transfer impact assessment | Not determined | — | — | ## Key facts Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources). **Compliance** - BSI C5: BSI C5 Typ 2 [S1] - Data subject rights: Auskunft · Berichtigung · Löschung · Einschränkung · Widerspruch · Datenübertragbarkeit · Beschwerde [S8] - Dora: Datenschutz gemäß DORA [S4] - Encryption in transit: yes [S8] - GDPR: yes [S15] - GDPR breach notification: With client-side encryption, server hacks are not considered data mishaps and GDPR notification rules do not apply [S13] - GDPR claims: Mit DRACOON können Sie Daten einfach im Einklang mit der EU-DSGVO (GDPR) versenden und speichern. [S4] - GDPR transfer storage: yes · 400000 [S14] - Google analytics anonymization: Google Analytics · Google Ireland Limited · yes [S8] - Hubspot dpf: yes [S8] - Log retention anonymization: 7 · IP-Verkürzung auf Domain-Ebene [S8] - Microsoft dpf: yes [S8] - Regulations supported: DORA · KRITIS · NIS-2 · DSGVO [S1] - Server log no third party sharing: no [S8] **Hosting** - Made in germany: yes [S4] - Made in germany: yes [S3] - Made in germany: Made in Germany [S11] - Made in germany: Made in Germany [S14] - Made in germany: Made in Germany [S13] - Made in germany: Made in Germany [S16] - Made in germany: Made in Germany [S15] - Origin: Germany [S9] **Integrations** - API alliance: NetApp · Avira · Telekom · Bechtle · DATEV [S15] - API alliance partners: NetApp · Avira · Telekom · Bechtle · DATEV [S16] - API central storage: yes [S11] - API connection options: 130 [S16] - API count: yes · 130 [S9] - API docs: yes · yes [S15] - API documentation: yes · yes · yes [S16] - API type: JSON/REST API with workflows and automations [S16] - API type: JSON/REST API [S15] - Connection options: 130 [S15] - Consulting: yes [S15] - Datev: yes · DATEV DMS integration [S9] - Full API access: yes [S15] - Full feature access via API: yes [S16] - Native clients: DRACOON für Outlook · DRACOON für Teams · DRACOON für Windows/Mac [S7] - Outlook addin: yes [S11] - Outlook share: yes · convert attachments/emails into encrypted download shares [S9] - Partner integrations: Avira · Digittrade · FoxIT · NetApp · NetSfere [S15] - Partner integrations named: Avira · Digittrade · FoxIT · NetApp · NetSfere [S16] - Sdk: yes [S15] - Sdks: yes [S16] - Sharepoint: yes [S15] - Support login email: support@kiteworks.com [S5] - Universal API: Universal API & Integration listed among solutions [S12] - Universal API: yes [S14] - Universal API: Universal API & Integration offered as a solution [S13] - Zapier: Zapier · yes · 2000 [S16] - Zapier: Zapier · 2000 [S15] **Legal** - Address: Regensburg · Galgenbergstraße 2a · Deutschland · 93053 [S7] - Company: DRACOON GmbH [S3] - Company: 2021 · DRACOON GmbH [S15] - Company name: DRACOON GmbH · 2021 [S4] - Company name: DRACOON GmbH [S6] - Company name: DRACOON GmbH [S5] - Content responsible: Dr. Björn Momsen · Verantwortlich für die Inhalte der Website [S7] - Dispute resolution: no [S7] - Entity: DRACOON GmbH [S1] - Entity: DRACOON GmbH [S10] - Entity: DRACOON GmbH [S9] - Entity: DRACOON GmbH · Germany [S12] - Entity: DRACOON GmbH [S14] - Entity: DRACOON GmbH [S13] - Entity: DRACOON GmbH [S16] - Entity name: DRACOON GmbH [S7] - Made in germany: © 2021 DRACOON GmbH · yes [S7] - Register: Amtsgericht Regensburg · HRB 16261 [S7] - VAT id: DE259222278 [S7] **Pricing** - Basic price on request: auf Nachfrage · per Benutzer/Monat · auf Nachfrage · auf Nachfrage [S5] - Free trial: yes · 14 · yes [S16] - License minimums: 50 · 50 · 100 [S5] - Max users unlimited: unbegrenzt · unbegrenzt · unbegrenzt [S5] - Trial: yes · 14 [S15] - Trial days: 14 [S14] - Trial free: yes [S14] - Trial included: 5 · 10 [S14] **Product** - Administration controls: admin control over access rights, shares and security policies [S1] - Administration features: Firmendesign-Anpassung, Gruppenverwaltung, Echtzeit-Auswertung, SSO via Identity Provider, SIEM-Anbindung [S5] - API calls basic: Basic: 50k Anfragen pro Monat; Pro/Premium: unlimitierte API-Calls [S5] - API integration: yes [S3] - API json rest: yes [S5] - App languages: DE · EN · IT · ES · CZ · PL · RU · FR [S5] - Apps and integrations: WebApp, Desktop App (Windows/Mac), Mobile Apps (iOS/Android), Outlook- und Teams-Integration, WebDAV [S5] - Apps mobile free: 0 · yes · iOS · Android [S9] - Basic summary: DRACOON Basic: ab 50 Lizenzen, 50 GB Cloud-Speicher pro User, 4 Apps & Integrationen, Basic Reporting, Basic Identity Management, Standard SLA [S5] - Bug bounty program: YesWeHack · yes [S8] - Capabilities listed: Datentransfer · Datenschutz · Modernisierung IT-Infrastruktur · File Service · E-Mail-Verschlüsselung · Ende-zu-Ende-Verschlüsselung · Benutzer- und Rechtemanagement · Universelle API & Integration · Digitale Signatur [S7] - Client side e2ee: DRACOON offers client-side/end-to-end encryption, described as the most secure encryption for data [S12] - Client side encryption: yes [S11] - Client side encryption: Encryption and decryption take place exclusively on the client [S13] - Client side key generation: All cryptographic keys are generated exclusively on the client [S13] - Cloud and onpremises: cloud · on-premises [S9] - Cloud only files: files can be moved to cloud only while remaining visible/openable in Explorer/Finder [S10] - Cross platform encryption: End-to-end encryption works platform-independent and cross-platform on all end devices [S13] - Data rooms: read-only · write · yes [S11] - Desktop sync: yes · mount as drive in Windows Explorer / Mac Finder [S9] - Digital signature: DRACOON Premium · digital signature via FP Sign · yes [S9] - Document management: yes · yes [S1] - Download sharing controls: yes · yes [S11] - Drive mount: DRACOON mountable as drive in Windows Explorer and Mac Finder, save directly from any application [S10] - E2ee solution: End-to-End Encryption listed among solutions [S12] - Encrypted file access: client-side encrypted files remain encrypted and accessible via DRACOON for Windows/Mac [S10] - End to end encryption: yes [S1] - End to end encryption: yes [S11] - End to end encryption: yes [S14] - End to end encryption feature: yes [S3] - Endtoend encryption: yes · client-side / end-to-end encryption documented [S9] - File requests: expiry date · password protection · additional SMS password · upload notification · max upload size · max file count · internal/public notes [S3] - File sharing features: Freigabe-Links mit Kennwort, Ablaufdatum, Download-Begrenzung; Dateianfrage-Links; Offline-Bearbeitung und Synchronisation; DICOM-Ansicht; Digitale Signatur [S5] - File work features: Dateizugriff, Versand großer Dateien, Dokumenten-Scanner, app-übergreifende Favoriten, unbegrenzte verknüpfte Geräte [S5] - Fine grained rights: yes · yes [S11] - Ftp replacement: replacement of FTP and file servers [S14] - Google tag manager: yes · no [S8] - Granular permissions: yes [S3] - Identity provider integration: integration with identity service providers (OneLogin case) [S9] - Key custody user control: Encryption keys controlled by the user only [S13] - Key management simplified: User only chooses a personal encryption/decryption password; encryption runs in the background [S13] - Kiteworks data control plane: Kiteworks Data Control Plane integrates sensitive data transfers in one platform [S1] - Level1: Simple Ad Hoc Transfer · Sending and receiving large files [S14] - Level2: Collaboration · Simultaneously work on files together (internal and external) [S14] - Level3: Enterprise File Sync & Share · Clients and apps · Central administration · Outlook integration [S14] - Level4: Enterprise File Service including Sync & Share · File service as a web service · integration into all operating systems as central file storage · data security and encryption (GDPR) · e-mail encryption via Outlook add-in (GDPR) · object st… [S14] - Levels: Four maturity levels: Level 1 Simple Ad Hoc Transfer, Level 2 Collaboration, Level 3 Enterprise File Sync & Share, Level 4 Enterprise File Service including Sync & Share [S14] - Link sharing avoids duplicates: yes [S3] - Microsoft advertising: yes · Microsoft Ireland Operations Limited [S8] - Newsletter double optin: yes [S8] - No data sharing with microsoft: yes [S3] - No personalized evaluation of webserver logs: no [S8] - No server side decryption: Server-side decryption impossible for operator and third parties [S13] - No server side keys: No unencrypted files, keys or crypto passwords are transferred to the server [S13] - Notifications: yes · yes [S11] - Object storage: yes [S14] - Offline auto reconnect: offline edits auto-sync after internet connection is restored [S10] **Subprocessors** - Facebook connect: Facebook · Sign in / Facebook Connect · USA [S8] - Facebook custom audiences: Facebook Custom Audiences Pixel · interessenbezogene Werbeanzeigen [S8] - Hubspot: HubSpot · Website / Inbound-Marketing / E-Mails · USA [S8] - Linkedin: LinkedIn · Conversion Tracking [S8] - Yeswehack: YesWeHack · Bug-Bounty-Programm · Paris, Frankreich [S8] **Support** - Channels: support portal · ticket submission [S3] - Channels: E-Mail-Support [S5] - Custom integration consulting: yes [S16] - Expert appointment: yes [S11] - Portal: Support Portal with ticket submission offered [S12] - Professional services available: Professional Services gegen Aufpreis verfügbar [S5] - Security contact: yes [S15] - Security incident contact: yes [S3] - Security incidents contact: Kontakt zur Meldung von Sicherheitsvorfällen [S4] - Security incidents contact: Kontakt zur Meldung von Sicherheitsvorfällen möglich über die Support-/Kontaktseite [S7] - Security incidents contact: contact for reporting security incidents · yes [S9] - Security incidents contact: yes [S11] - SLA by plan: Standard (Upgrade auf Premium möglich) · Standard · Premium [S5] - Submit ticket: Support Portal · Submit Ticket · Community · Web Session [S14] - Ticket portal: support ticket submission · yes [S9] 38 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/dracoon ## Questions ### Is DRACOON European? Partly. whats-best.ai classifies DRACOON as EU origin, foreign-owned. ### Where does DRACOON store data? Not stated on the vendor’s pages as of 1 Nov 2026. ### Does DRACOON have a free plan? Not stated on the vendor’s pages as of 1 Nov 2026. ### What are the best alternatives to DRACOON? As of 1 Nov 2026, the panel rates [Nextcloud Files (Nextcloud Hub) (4/5)](https://whats-best.ai/software/cloud-storage/nextcloud-files), [Tresorit (3.5/5)](https://whats-best.ai/software/cloud-storage/tresorit) and [Proton Drive (3/5)](https://whats-best.ai/software/cloud-storage/proton-drive) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is [Nextcloud Files (Nextcloud Hub)](https://whats-best.ai/software/cloud-storage/nextcloud-files) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [DRACOON alternatives](https://whats-best.ai/software/cloud-storage/dracoon/alternatives). ## What this page leaves out - 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 9 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 6 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 5 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. - 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. - 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. ## Sources - [S1] Vendor homepage: https://www.dracoon.com/de/home (checked 2026-11-01) - [S2] Features page (platform): https://www.dracoon.com/de/produkt (checked 2026-11-01) - [S3] Integrations page (Microsoft Teams): https://www.dracoon.com/de/dracoon-fuer-teams (checked 2026-11-01) - [S4] Features page (GDPR-compliant file exchange): https://www.dracoon.com/de/so-gelingt-dsgvo-konformer-datenaustausch (checked 2026-11-01) - [S5] Pricing page: https://www.dracoon.com/de/preise (checked 2026-11-01) - [S6] Company page: https://www.dracoon.com/de/ueber-uns (checked 2026-11-01) - [S7] Legal notice: https://www.dracoon.com/de/impressum (checked 2026-11-01) - [S8] Privacy policy: https://www.dracoon.com/de/datenschutzerklaerung (checked 2026-11-01) - [S9] Sync, clients & file access — found from sitemap: https://www.dracoon.com/de/downloads (checked 2026-11-01) - [S10] Sync, clients & file access — found from sitemap: https://www.dracoon.com/de/daten-synchronisieren-mit-dracoon-fuer-windows-und-mac (checked 2026-11-01) - [S11] Sharing & external collaboration — found from sitemap: https://www.dracoon.com/en/data-transfer (checked 2026-11-01) - [S12] Encryption, key custody & recovery — found from sitemap: https://www.dracoon.com/en/encryption (checked 2026-11-01) - [S13] Encryption, key custody & recovery — found from sitemap: https://www.dracoon.com/en/client-side-encryption (checked 2026-11-01) - [S14] Administration, audit & governance — found from sitemap: https://www.dracoon.com/en/enterprise-file-service-central-storage-location-for-all-data (checked 2026-11-01) - [S15] Export, API & self-hosting — found from sitemap: https://www.dracoon.com/de/api-und-integration (checked 2026-11-01) - [S16] Export, API & self-hosting — found from sitemap: https://www.dracoon.com/en/api-and-integration (checked 2026-11-01) --- Cite as: whats-best.ai, "DRACOON — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/dracoon Corrections: https://whats-best.ai/correct/1216?target=page