Cloud Storage & File Sharing
Filen
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Filen Cloud Dienste UG (haftungsbeschränkt) · filen.io
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Filen at a glance
- Vendor
- Filen Cloud Dienste UG (haftungsbeschränkt)
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Filen 2.5/5, the mean of 6 judges. Filen is end-to-end encrypted cloud storage from Filen Cloud Dienste UG in Recklinghausen, and the bench reads it as an individual-consumer product that runs out of evidence where organisations begin. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Filen is end-to-end encrypted cloud storage from Filen Cloud Dienste UG in Recklinghausen, and the bench reads it as an individual-consumer product that runs out of evidence where organisations begin. Strongest are portability and integrations, scored a flat 6 for TypeScript, Rust and Go SDKs, a fully-featured CLI and WebDAV/S3 packages, with sync and access at 5-7 on the Smart Sync network drive for Windows, macOS and Linux. Pricing transparency scores 6-7: four tiers from 1.99€ monthly for 200 GiB to 39.99€ monthly for 10 TiB, stacking on a single account with no upper limit. Sovereignty runs 6-7 — a German entity under German law, pages stating servers hosted in Germany with no third-country storage except payment providers. Weakest are administration and governance at 0-2, where plans stack on one account and team features are open requests, and sharing and collaboration at 3-4, where recipients cannot yet upload into a shared folder. Encryption sits 5-6: zero-knowledge AES-256 is stated, with no independent audit or certification documented. The flagged splits report came back empty — the gaps are shared, not contested.
Speaks for it
- States zero-knowledge client-side AES-256 end-to-end encryption, with open-source apps, encrypted thumbnails, a warrant canary and a PGP key.
- Publishes every monthly price from Pro I 200 GiB at 1.99€ monthly to Pro X 10 TiB at 39.99€ monthly, with plan stacking and no upper limit.
- Offers a free Starter tier, a lifetime free trial and 'No credit card required'.
- Provides scriptable access and exit paths through TypeScript, Rust and Go SDKs, a fully-featured CLI, and WebDAV/S3 packages including a self-hostable gateway.
- Shows a German chain on the captured pages: a Recklinghausen entity, German governing law, and servers hosted in Germany with no third-country storage except payment providers.
Held against it
- Administration and governance scores sit at 0-2, with plans stacking on a single account and family or team accounts still open feature requests.
- Sharing and collaboration scores sit at 3-4, with no public information on link passwords, expiry, download limits or guest accounts, and upload into a shared folder still an open request.
- No independent audit or ISO 27001, SOC 2 or BSI C5 certification is documented, and the terms state the service is not tailored to HIPAA or FISMA.
- The captured pages quote monthly figures only, so annual and lifetime prices and per-user team pricing are not visible.
- Global full-text search is marked only 'Started' on the feedback board, and two-factor appears only as an open passkey request.
Best for
- You are an individual user who wants stated zero-knowledge encryption and explicit key custody for confidential files.
- Your workflows are scripted and you need access and exit paths via a CLI, SDKs and WebDAV/S3.
- You want a German-contracted service whose pages state that servers are hosted in Germany with no third-country storage except payment providers.
- You need stackable capacity at published monthly prices, from 200 GiB at 1.99€ monthly to 10 TiB at 39.99€ monthly.
Avoid if
- You run an organisation that needs an admin console, roles, provisioning, audit logs or remote device wipe.
- You send files to external parties who need link passwords, expiry, download limits or upload rights into shared folders.
- You must evidence audited or certified security, or operate under HIPAA or FISMA.
- You need a per-seat budget, since the pricing model stacks plans on a single account.
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 3.5 of 5 |
| Sharing & external collaboration | 1.5 of 5 |
| Encryption, key custody & recovery | 3 of 5 |
| Administration, audit & governance | 0.5 of 5 |
| Export, API & self-hosting | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
Mounting the cloud as a network drive with Smart Sync on Windows, macOS and Linux, five sync modes, WebDAV and S3 access, a CLI and unlimited bandwidth would give my three sites workable access. But we found no public information on previews, offline mobile folders, file size limits or conflict resolution, and full-text search plus Android two-way sync are still open requests on the feedback board. 1 2 5
The Data Protection Officer
Windows, macOS and Linux are covered, the network drive with Smart Sync gives files on demand, and WebDAV and S3 access through a CLI and SDKs in three languages are documented. Full-text search exists only as an open feature request marked started, and we found no public information on camera upload, offline mobile folders, block-level sync or file size limits, beyond the statement of unlimited uploads. 1 2 5
The Architecture Practice Partner
The network drive mounts on Windows, macOS and Linux with Smart Sync on demand, plus WebDAV and S3 packages, a CLI and unlimited transfer speed — the drive letter our CAD software needs is documented. For multi-gigabyte models I miss any documented delta or block-level sync, and the captured feature board lists global full-text search only as a request just started; we also found no public information on offline folders in the mobile apps. 1 2 5
The Tax Adviser
Mounting the cloud as a network drive on Windows, macOS and Linux with Smart Sync, five sync modes, a CLI and WebDAV and S3 packages are all documented, with unrestricted transfer speed and unlimited uploads. We found no public information on previews, camera upload or offline folders on mobile, or block-level sync, and full-text search sits on the feature board marked 'Started' rather than shipped — a gap that bites when I search through four hundred clients' receipts. 1 2 5 8
The Agency Producer
Smart Sync mounting on Windows, macOS and Linux, five sync modes, no speed limits, and WebDAV/S3 plus a CLI cover most of what big footage transfers need. The feature board shows global full-text search only 'Started', and the captured pages are silent on camera upload, offline folders, previews and file size limits, so I cannot confirm the mobile half of my workflow. 1 2 5
The Skeptic
A network drive with Smart Sync is documented for Windows, macOS and Linux, alongside five sync modes, a CLI and WebDAV/S3 gateways, which takes file access beyond the basics. However, the only word on full-text search is a feature request on the feedback board still marked as started, two-way sync on Android and FileProvider on macOS are open requests, and we found no public information on camera upload, offline files, file size limits or previews. 1 2
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
File sharing is named as a plan feature and folders can be shared with other users, but letting a recipient upload into a shared folder is still an open request, and we found no public information on link passwords or expiry, guest accounts, upload links, or editing office documents together in a browser. For a company that sends drawings to customers, that is thin. 1 2 5
The Data Protection Officer
File sharing, end-to-end encrypted chats carrying shared documents, and notes shared and collaborated on with other users are documented. The controls a hospital needs before anything leaves the building are not described: we found no public information on link passwords, expiry, download limits or view-only links, on browser editing of office documents, or on guest accounts, and recipients' right to upload into a shared folder is still only an open feature request. 1 2 5
The Architecture Practice Partner
File sharing is included in every plan and notes and chats let us add other users, but the captured board shows an open request before the other side can even upload into a shared folder, and family or team accounts are likewise still requests. We found no public information on link passwords, expiry, download limits, guest accounts or upload links — which is what my structural engineers picking up a folder without an account would depend on. 1 2 5
The Tax Adviser
File sharing is included in every plan, and encrypted chats and notes shared with invited users exist. But the feature board shows recipients of a shared folder cannot yet upload into it and family accounts remain an open request, and we found no public information on link passwords, expiry, upload links for my clients, download limits, or a record of who opened and downloaded what — precisely the controls a tax office needs before sending drafts out. 1 2 5
The Agency Producer
Files can be shared, and encrypted chats and collaborative notes exist for discussing shared documents. For link passwords, expiry, view-only or no-download mode, upload links for customers, guest accounts, comments or an Outlook/Teams add-in we found no public information, and the board carries an open request just to let someone upload into a shared folder — client review round-trips stay manual for us. 1 2 5
The Skeptic
File sharing is listed as an included feature and encrypted notes let you add other users, but the evidence stops there. We found no public information on link passwords, expiry, download limits, upload links, guest accounts, file locking or office co-editing, and the vendor's own feedback board shows that recipients of a shared folder cannot upload into it — an open request with 28 votes. This is basic sharing, not external collaboration. 1 2 5
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
Zero-knowledge AES-256 end-to-end encryption is stated consistently, the keys sit with the user, and a forgotten password means losing the files unless a recovery key was exported; the open-source apps and a warrant canary add trust. For retiring my file server the gaps hurt: versioning exists but no retention length is stated, and we found no public information on an independent audit, certifications, two-factor authentication, ransomware detection, or restoring a folder to a point in time. 1 2 4 7
The Data Protection Officer
The core is strong: zero-knowledge client-side AES-256 end-to-end encryption is stated, thumbnails are stored encrypted, the apps are open source, and key custody is explicit — a forgotten password means lost files unless a recovery key was exported. What I cannot sign off: no independent audit, penetration test or ISO 27001, SOC 2 or BSI C5 certification is documented, the terms expressly state the service is not tailored to HIPAA or FISMA, two-factor options and version-history length appear only as user requests, and the pages do not say whether the end-to-end encryption survives a share link. 1 2 7 8
The Architecture Practice Partner
Zero-knowledge client-side AES-256 end-to-end encryption is documented, forgetting the password means losing the files unless a recovery key was exported, and the apps are open source — good custody for confidential building files. For an office of twenty-five, though, we found no public information on two-factor, version-history length, ransomware recovery, independent audits or certifications. 1 4 7
The Tax Adviser
Zero-knowledge client-side AES-256 encryption is stated plainly — files are encrypted on the device, a lost password means lost files unless a recovery key was exported, and even thumbnails stay encrypted — so the provider genuinely cannot read what I store. The rest is thin: versioning exists but its retention is not configurable, passkey two-factor is still a request, the terms say the service is not tailored to HIPAA or FISMA, and we found no public information on a recycle bin, point-in-time restore, audits or certifications. 1 2 7 8
The Agency Producer
Zero-knowledge AES-256 encryption happens on the device, all apps are open source, a warrant canary is published, and losing the password means losing the files unless a recovery key was exported — clear enough on who holds the keys. What I miss for a business is any named audit or certification, a version-history length, ransomware recovery, and two-factor only surfaces as an open passkey request. 1 2 7 8
The Skeptic
Zero-knowledge client-side AES-256 encryption is documented, and the pages back the claim with its uncomfortable corollary: forget your password and you lose all files unless you exported a recovery key, which is what a provider that truly cannot read your data would have to say. Open-source apps, encrypted thumbnails, a warrant canary and a PGP key reinforce it. But we found no public information on any independent audit, ISO 27001, SOC 2 or BSI C5 certification, single sign-on, a recycle bin, or restore after ransomware, and the only word on two-factor is an open request for passkey support. 1 2 4 7
Administration, audit & governance
n/r
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
This is where it fails for a 180-person company: plans stack on a single account, and shared storage or upload rights into shared folders appear only as open feature requests. We found no public information on an admin console, Entra ID or SCIM provisioning, an exportable audit log, retention or legal hold, company-owned team folders, or remote wipe of a lost laptop. 2 5
The Data Protection Officer
Plans are documented as stacking on a single account and shared family accounts exist only as an unimplemented feature request, which points to an individual-consumer product. We found no public information on an admin console, roles, directory provisioning, audit logs, retention policies or remote device wipe — nothing a care provider or payroll bureau could put before an auditor. 2 5
The Architecture Practice Partner
Plans stack on a single account, and family or shared accounts appear only as open feature requests, so as evidenced each of my colleagues would hold an independent account. We found no public information on a team plan, admin console, roles, audit log, provisioning or device management. 1 2 5
The Tax Adviser
The pricing page shows plans stacking on a single account and the feature board shows family and shared accounts still open requests, so the captured pages describe an individual's cloud rather than a practice's. We found no public information on an admin console, user roles, an audit log of logins and shares, retention policies, or remote wipe of lost devices. 2 5
The Agency Producer
The captured pages describe individual storage plans that 'stack on a single account', and family or team sharing sits on the feature board as requested and not implemented. We found no public information on an admin console, roles, provisioning, quotas or an audit log — I see no way to manage freelancers project by project. 2 5
The Skeptic not rated — no public information
We found no public information on administration and governance: the homepage, feedback board, pricing page and terms say nothing about an admin console, roles, provisioning, audit logs, retention or device management. The pricing model of individual plans stacking on one account and a family-sharing request with 175 votes still open suggest a consumer product, but no captured page states what a team administrator could control. 1 2 5 8
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
The developer path is genuinely there — TypeScript, Rust and Go SDKs, a fully-featured CLI, WebDAV and S3 including a self-hostable gateway, and open-source apps — and what happens to data on cancellation is stated. But no migration tool from Dropbox, Google Drive, OneDrive or a file server is named, and we found no public information on integrations with Microsoft 365, Teams or Slack, so moving my people in would be hand-rolled. 1 7 8
The Data Protection Officer
TypeScript, Rust and Go SDKs, a fully-featured CLI and WebDAV and S3 packages give real programmatic exit paths, and the apps are open source with a documented deletion process for files. However, the self-hosting on offer is a self-hosted WebDAV or S3 gateway in front of their cloud rather than an on-premise edition, and we found no public information on webhooks, bulk export with folder structure and versions, or migration tools from named providers. 1 7 8
The Architecture Practice Partner
TypeScript, Rust and Go SDKs, a full CLI, WebDAV and S3 packages and open-source apps give us scriptable, tool-independent access, and files are deleted on request under the privacy policy. We found no public information on migration tools from named providers, webhooks, or integrations with office suites, Teams or Slack. 1 2 7
The Tax Adviser
Every app is open source, SDKs exist for TypeScript, Rust and Go alongside a fully-featured CLI, and WebDAV and S3 packages can even be self-hosted as a gateway, so a scripted exit path is plausible. The terms state plainly what happens after cancellation — deletion on request or at contract end, with three reminder emails over four weeks — though retention after termination is optional and not guaranteed. We found no public information on webhooks, an app marketplace, migration tools from named providers, or a documented bulk export with folder structure and versions. 1 7 8
The Agency Producer
TypeScript, Rust and Go SDKs, a fully-featured CLI, self-hostable WebDAV and S3 gateways and open-source apps make a technical exit path real. We found no public information on migration tools from Dropbox, Google Drive or OneDrive, on webhooks, or on integrations with Slack, Teams or project tools — the connections my agency would wire up first — and retention of files after termination is stated as optional rather than guaranteed. 1 2 7
The Skeptic
TypeScript, Rust and Go SDKs, a fully-featured CLI, open-source apps and the option to self-host a WebDAV or S3 gateway in front of the storage give a developer a real way in and out, and deletion on termination is spelled out — including the honest note that retention after termination is optional and not guaranteed. But we found no public information on a migration path from Dropbox, Google Drive or OneDrive, on webhooks, an app marketplace, or a bulk export that includes versions and shares. 1 2 7
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
Everything I can check is German: a Recklinghausen company, servers hosted in Germany with no third-country storage except payment providers handled through their EU entities, German governing law, and analytics and feedback tools self-hosted in Germany. Missing are named data centres, a published data processing agreement, security certifications and any statement about ownership, so the picture is credible but not fully evidenced. 1 6 7 8
The Data Protection Officer
The contracting chain is on paper: Filen Cloud Dienste UG in Recklinghausen, HRB 8896, under German governing law, all servers stated to be in Germany with no third-country storage except payment providers, analytics and the feedback board self-hosted in Germany, and a warrant canary published. The payment leg runs through PayPal and Stripe, we found no public information naming the data centres, the published policy list — imprint, terms, privacy policy, refund policy, warrant canary, DMCA, PGP — names no data processing agreement, and no ISO 27001, BSI C5 or SOC 2 certification is documented while the terms expressly disclaim HIPAA and FISMA. 1 5 6 7 8
The Architecture Practice Partner
The contracting entity is Filen Cloud Dienste UG in Recklinghausen under German law, all servers sit in Germany with no data stored in third countries except payment processing, and analytics plus the feedback tool run self-hosted in Germany. We found no public information on named data centres, a published data processing agreement, or security certifications. 1 6 7 8
The Tax Adviser
The imprint names Filen Cloud Dienste UG in Recklinghausen with a German commercial register number and VAT ID, the terms put German law and North Rhine-Westphalia courts over the contract, and the privacy policy secures all data on servers in Germany with no third-country storage outside payment providers, while analytics are self-hosted in Germany. We found no public information on named data centres, a published data processing agreement, a full subprocessor list with locations, or ISO 27001, SOC 2 or BSI C5 certifications — under §203 I need that chain on paper before client files move. 1 6 7 8
The Agency Producer
The contracting entity is a German company in Recklinghausen with a German VAT number, all servers are stated to be hosted in Germany with no third-country storage, analytics and the feedback tool are self-hosted in Germany, and German law governs the terms. The pages name no data centres, no data processing agreement and no certifications, and payment runs through PayPal and Stripe, so the chain is European where evidenced but not fully documented. 1 6 7 8
The Skeptic
The contracting entity is Filen Cloud Dienste UG in Recklinghausen with a commercial register number and VAT ID, the pages state that all servers are hosted in Germany with no third-country storage except payment providers, and both the analytics tool and the feedback tool are self-hosted in Germany. That is a more European chain than most providers show. But no data centres are named, we found no published data processing agreement or certifications, and the payment leg runs through PayPal, Stripe and Coinbase — providers flagged for US disclosure exposure, softened only by the note that PayPal Europe and Coinbase Europe serve the European region. 1 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
Four tiers are priced to the euro per month — 1.99€ for 200 GiB, 3.99€ for 500 GiB, 8.99€ for 2 TiB, 39.99€ for 10 TiB — with plan stacking to any size, a free starter tier, VAT treatment, cancellation terms and every feature included. The annual and lifetime prices are not shown, and pricing is per account rather than per seat, so I cannot derive a real cost for 180 employees. 1 5 8
The Data Protection Officer
Every tier is public with storage and a monthly figure — 1.99€ monthly for 200 GiB up to 39.99€ monthly for 10 TiB — plans stack with no upper limit, a free Starter tier and a lifetime free trial exist, and cancellation, payment methods and the addition of sales tax are stated. The captured pages give monthly figures only, so annual-plan and lifetime prices are not visible, and pricing is storage-based per account rather than per user, so an organisation would have to compute its cost from stacked plans. 1 5 8
The Architecture Practice Partner
Four tiers are public from 1.99€ monthly for 200 GiB to 39.99€ monthly for 10 TiB, plans stack with no upper limit, and "every feature and full encryption are included in the price", with sales tax added and the monthly, annual and lifetime terms stated. We found no public information on the free tier's storage limit or the annual price figures. 1 5 8
The Tax Adviser
Prices are public and simple: a free Starter tier, then Pro plans at 1.99€, 3.99€, 8.99€ and 39.99€ monthly for 200 GiB up to 10 TiB, stackable with no upper limit, with VAT treatment and self-service cancellation terms stated. The captured pages quote only the monthly figures, so annual and lifetime rates are not shown, and we found no public information on per-user team pricing — I could not compute an eleven-seat annual cost from these pages. 1 5 8
The Agency Producer
Four plans are priced publicly from 1.99€ to 39.99€ monthly with exact storage amounts, they stack on one account with no upper limit, and 'every feature and full encryption are included in the price' — no add-on games. But the captured pages give no annual or lifetime prices, no limits for the free Starter plan, sales tax only 'as deemed required by us', and no per-user team pricing that a 30-person shop could buy. 1 5 8
The Skeptic
The monthly ladder is fully public — 1.99€ monthly for 200 GiB up to 39.99€ monthly for 10 TiB — plans stack with no upper limit, VAT treatment and the 30- and 365-day terms are stated, and cancellation is self-service at the end of the paid term; the lifetime plan's terms are stated plainly, active as long as the service is online with a login required every three years. "No hidden fees" with every feature and encryption included means there is no add-on tiering to decode. But the captured pages show no annual or lifetime price and no limit for the free tier, so a buyer cannot compute a full annual cost from public pages alone. 1 5 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Filen
Is Filen European?
Yes. whats-best.ai classifies Filen as EU-Made.
Where does Filen store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 1 Nov 2026.
Does Filen have a free plan?
Yes. Filen has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Filen?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Filen alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Hosting location, Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (9)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage filen.io Checked 1 Nov 2026 Details →
- 2 Features page features.filen.io Checked 1 Nov 2026 Details →
- 3 Security / trust page filen.io Checked 1 Nov 2026 Details →
- 4 Company page (servers and encryption) filen.io Checked 1 Nov 2026 Details →
- 5 Pricing page filen.io Checked 1 Nov 2026 Details →
- 6 Legal notice filen.io Checked 1 Nov 2026 Details →
- 7 Privacy policy filen.io Checked 1 Nov 2026 Details →
- 8 Terms of service filen.io Checked 1 Nov 2026 Details →
- 9 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →