Cloud Storage & File Sharing
Jottacloud Business
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Jotta Group AS · jottacloud.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Jottacloud Business at a glance
- Vendor
- Jotta Group AS
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Norway source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Jottacloud Business 2.5/5, the mean of 6 judges. Jottacloud Business is cloud storage and file sharing from Jotta Group AS of Oslo. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Jottacloud Business is cloud storage and file sharing from Jotta Group AS of Oslo. Judges scored it highest on sovereignty at 6-7: all customer data is stored in Norway in data centres the vendor owns and operates, a data processing agreement with EU standard contractual clauses and audit rights is published, and subprocessors Microsoft Office Online and Stripe are named with 30 days' notice of changes — though the captured pages give no locations for those subprocessors and we found no public information on certifications such as ISO 27001, SOC 2 or BSI C5. It is weakest on portability and integrations at 3-4, with no public information on a REST API, open protocols or migration tools. Sharing and collaboration and administration and governance sit at 4: share links are described as public to anyone holding them, and we found no public information on link passwords, expiry, download limits, directory provisioning or remote wipe. Pricing transparency runs 5-6, with public tiers but no published price for additional terabytes. Weighted totals span 4.5 to 4.9 with no material split between judges.
Speaks for it
- Sovereignty is the highest-scored criterion at 6-7, with all customer data stored in Norway in data centres the vendor owns and operates
- A published data processing agreement carries EU standard contractual clauses, audit rights, breach notification and 30 days' notice of subprocessor changes, naming Microsoft Office Online for optional editing and Stripe for payment
- Three business tiers are published — Business Small NOK 129 / month for 2 users, Business Medium NOK 179 / month for 10 users and Business Large NOK 459 / month for unlimited users, each with 1 TB storage and prices excluding VAT
- Stated security basics cover 256-bit AES in transit and at rest, two-factor authentication, a 30-day recycle bin and the last five versions of every file
- Desktop two-way sync with selective sync, automatic mobile backup of photos and videos, a web app and a command-line client for Windows, macOS, Linux and FreeBSD score 4-5 on sync and access
Held against it
- Share links make data public to anyone who has the link, who can download and forward it, with no public information on link passwords, expiry or download limits
- Judges found no public information on certifications such as ISO 27001, SOC 2 or BSI C5, on independent audits, or on ransomware recovery and point-in-time restore
- Portability and integrations is the lowest-scored criterion at 3-4, with no public information on a REST API, open protocols such as WebDAV, SFTP or S3, migration tools or bulk export
- The administrator cannot access data on members' accounts unless it is shared, and judges found no public information on directory or SCIM provisioning, retention policies, remote wipe or transfer of a leaver's files
Best for
- Your procurement requires data residency in Norway on vendor-owned and operated infrastructure, backed by a published data processing agreement and a named subprocessor list
- You need published fixed-price plans for a defined headcount — 2, 10 or unlimited users at NOK 129, NOK 179 or NOK 459 per month, each with 1 TB
- You share very large files by plain link and co-edit documents in real time through Microsoft Office Online
- You back up servers, NAS devices or Raspberry Pi units and want a command-line client that runs on Windows, macOS, Linux and FreeBSD and sends webhooks
Avoid if
- You must send confidential client documents by link — the help pages state anyone with the link can download the data and forward it
- Your organisation needs central control over members' files — the terms state the administrator cannot reach data on members' accounts unless it is shared with them
- You need to budget an archive growing past 1 TB — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 2.5 of 5 |
| Sharing & external collaboration | 2 of 5 |
| Encryption, key custody & recovery | 2.5 of 5 |
| Administration, audit & governance | 2 of 5 |
| Export, API & self-hosting | 2 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
The desktop app gives two-way sync for Windows and Mac with selective sync, the mobile apps back up photos and videos automatically, and the web app uploads, downloads and previews files; a command-line client adds Windows, macOS, Linux and FreeBSD. We found no public information on a virtual drive with files on demand, block-level sync, full-text document search or access via WebDAV, SFTP or S3. 3 10 11
The Data Protection Officer
Desktop sync and backup for Windows and macOS, selective sync configurable during or after installation, mobile apps with automatic photo and video backup, and a web interface with previews and upload/download are all documented, with a command-line client additionally covering Linux, FreeBSD, servers and NAS devices. I found no public information on files on demand or a virtual drive, block-level sync, file size limits, full-text search inside documents, or access through WebDAV, SFTP or S3. Before patient letters move onto this, I would want the limits and large-folder behaviour stated in technical documentation. 3 10 11
The Architecture Practice Partner
Two-way desktop sync with selective sync is documented in detail, mobile apps back up photos automatically, the web app previews various formats, and a command-line client covers Windows, macOS, Linux and FreeBSD — the CLI could serve our servers and NAS. But for our gigabyte CAD models the captured pages show no files-on-demand virtual drive, no delta or block-level sync, no drive-letter, WebDAV or SFTP access, and no stated file size limits, offline mobile behaviour or search by file name. 3 10 11
The Tax Adviser
The desktop application mirrors folders both ways on PC and Mac with selective sync documented step by step, the mobile apps back up photos and videos automatically, and the web app uploads, downloads and previews files. We found no public information on a files-on-demand virtual drive, search of files by name or content, offline folders on mobile, or access via open protocols such as WebDAV, SFTP or S3. 3 10 11
The Agency Producer
Desktop sync and backup for Windows and macOS, selective sync documented down to its deletion behaviour, mobile apps that back up photos automatically, a web app with previews and upload/download, plus a command-line client that even runs on Linux, NAS devices and a Raspberry Pi — and the business page promises maximum speed and sharing files of any size, which matters for my 100 GB masters. But we found no public information on files on demand, block-level sync, open protocols like WebDAV or S3, or stated file size limits. 1 3 10 11
The Skeptic
Desktop sync for PC and Mac with selective sync explained in real technical documentation, mobile apps that back up photos and videos automatically, a command-line client for Windows, macOS, Linux and even NAS devices, and a web app with previews cover the basics well. But we found no public information on files on demand or a virtual drive, block-level sync, offline folders on mobile, open protocols such as WebDAV or S3, or stated file size limits, and the search described is an AI photo search rather than search inside documents. 3 10 11
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Shared folders, share links of any size and real-time co-editing through Microsoft Office Online are documented, and link recipients can view or download but cannot upload or change data. Their help pages state a link makes the data public to anyone who holds it, and we found no public information on link passwords, expiry, download limits or upload links for customers. 1 3 12
The Data Protection Officer
Files, folders and albums can be shared by link and Microsoft Office Online provides real-time co-editing of shared documents, which is real collaborative capability. But the captured documentation describes links as publicly available to anyone who has the link, who can download and forward it, and I found no public information on link passwords, expiry, download limits, view-only or no-download mode, upload links or guest accounts. For a salary statement or a discharge letter, that is a link I could not responsibly send outside the organisation. 1 12 13
The Architecture Practice Partner
Share links let anyone with the URL download files of any size without an account — exactly what our structural engineers need — and shared folders plus real-time co-editing through Microsoft Office Online are documented. We found no public information on link passwords, expiry, download limits, no-download view mode, upload links, guest accounts, file locking or comments; the captured help pages state that link recipients can view or download but cannot upload or change data. 1 3 12 13
The Tax Adviser
Share links are plain URLs — anyone holding the link can download and even forward it, and recipients cannot upload or change anything — while shared folders and real-time editing through Microsoft Office Online exist for any file size. We found no public information on link passwords, expiry dates, download limits, upload requests for external people or a record of who opened what, and without those controls I would not send client drafts this way. 1 3 12 13
The Agency Producer
Customers receive a plain URL: the help pages state anyone with the link can download the data and forward it, and that recipients cannot upload or change it — we found no public information on link passwords, expiry, download limits or view-only links, and no comments, watermarking or upload links for client feedback. Real-time co-editing of shared documents via Microsoft Office Online is documented, and shared folders exist, but this is not yet the review-link workflow my customers need. 1 3 12
The Skeptic
Shared folders, public links that anyone holding them can open to view or download (recipients cannot upload or change the data), shared albums, and genuine real-time co-editing through Microsoft Office Online put this above the basics. We found no public information on link passwords, expiry, download limits, upload links for customers, guest accounts, watermarking, or an Outlook or Teams add-in. 1 3 12 13
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
Traffic and storage are AES-256 encrypted, two-factor authentication exists, the last five versions of every file and a 30-day recycle bin cover restore of deleted or overwritten files, and their endpoints score A+ at SSL Labs. Their own documentation states private encryption keys are not supported, and we found no public information on restoring a folder or account to a point in time after ransomware, malware scanning, or a named security certification or independent audit. 3 11 14 15
The Data Protection Officer
AES-256 in transit, encryption at rest, two-factor authentication with password policies, a 30-day recycle bin and five stored file versions are stated, which is sound basic hygiene, and passwords are held encrypted so staff cannot read them. However, the vendor itself documents that creating your own private encryption keys is not supported, so key custody sits with the provider, and I found no public information on single sign-on, ransomware detection or recovery, an independent audit, or ISO 27001, SOC 2 or BSI C5 certification; the only external assessment named is an SSL Labs rating on the TLS endpoints. 3 14 15
The Architecture Practice Partner
AES-256 in transit and at rest, two-factor authentication, a 30-day recycle bin, restore of deleted files and a stated five-version history are all documented, with an A+ SSL Labs rating for their endpoints. The vendor itself states that private encryption keys are not supported, so key custody stays with them, and we found no public information on ransomware detection or recovery, point-in-time restore, independent audits, or certifications such as ISO 27001, SOC 2 or BSI C5. 3 14 15
The Tax Adviser
Traffic is protected with 256-bit AES and an A+ TLS rating, data is encrypted at rest, two-factor authentication and password policies exist, deleted files rest 30 days in the trash, and the last five versions of every file are kept. 3 11 14 15
The Agency Producer
256-bit AES in transit, encryption at rest, two-factor authentication, a 30-day recycle bin and a version history of the last five file versions are all stated, which covers accidental overwrites of a cut. 3 7 14 15
The Skeptic
AES-256 in transit and at rest, an SSL Labs A+ rating, two-factor authentication, a 30-day recycle bin and five stored file versions are stated plainly — and I credit the honesty of a page saying outright that customers cannot create their own encryption keys, which means the provider holds them. We found no public information on an independent audit or penetration test, any certification such as ISO 27001 or SOC 2, single sign-on, ransomware detection, or restoring an account to a point in time. 3 7 14 15
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
An administrator can add and remove users, have several admins, set per-user storage to a fixed amount or unlimited, set permission levels, and read activity logs including member file and folder names — while an administrator cannot read member data unless it is shared with them. We found no public information on provisioning from Entra ID or SCIM, remote wipe of a lost laptop, retention policies or an exportable audit log, which is exactly what I would have to show our auditor. 8 14 16 17
The Data Protection Officer
A business administrator can add and remove users, grant admin privileges to several people, set each member's storage to a specific amount or unlimited, and read activity logs including member activity and file and folder names, with permission levels for staff using the admin tools. I found no public information on directory or SCIM provisioning, an exportable audit log, retention policies, legal hold, remote wipe or unlinking of lost devices, or company-owned team folders; indeed the terms state the administrator cannot reach data on members' accounts unless it is shared with them. For a payroll bureau this is a small-team console, not a governance framework a regulator would sign off. 8 14 17
The Architecture Practice Partner
A business administrator can add and remove users, grant multiple admins, set per-user storage to a fixed amount or unlimited, and read activity logs covering member activity and file names; permission levels for admin-tool access are stated. We found no public information on directory provisioning, exportable audit logs, retention policies, legal hold, remote wipe or unlinking of devices, or transfer of files when someone leaves — and the terms state the admin cannot access member data unless it is shared with them, so we could not confirm company-owned team folders. 8 14 16 17
The Tax Adviser
Business administrators add and delete users, can appoint multiple admins, set each member's storage to a specific amount or unlimited, and can read activity logs covering member activity and file names. We found no public information on directory or SCIM provisioning, groups, policies for external sharing, transfer of a leaver's files, retention rules, or remote wiping and unlinking of lost devices — and member data stays closed to the admin unless individually shared, so team folders owned by the practice are not in evidence. 8 14 16 17
The Agency Producer
Adding and removing users, setting each member's storage to a fixed amount or unlimited, multiple administrators with permission levels, and administrator access to activity logs including member activity are all documented — enough to bring a freelancer onto a project and take them off again. We found no public information on group management, directory or SCIM provisioning, retention policies, remote wipe of devices, or what happens to a member's files when they leave. 8 14 16 17
The Skeptic
An administrator adds and removes members, sets each user's storage or leaves it unlimited, can appoint multiple admins with permission levels, and reads activity logs including file and folder names — while members' unshared data stays closed even to the admin. We found no public information on group management, directory or SCIM provisioning, export of the audit log, retention policies or legal hold, remote wipe of devices, or team folders owned by the company rather than a user. 8 9 16 17
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
The command-line client can send documented webhooks in Slack format, Microsoft Office Online is integrated for editing, and stored data is deleted no later than 90 days after termination. We found no public information on a documented REST API with SDKs, a bulk export with the folder structure, migration tools from another provider or a file server, open protocols such as WebDAV, S3 or SFTP, or a self-hosted edition. 1 3 8 18
The Data Protection Officer
The command-line client is documented for Windows, macOS and Linux, runs on desktops, servers, NAS devices and Raspberry Pi, and can send webhooks including Slack-formatted status messages; Microsoft Office Online integration is named for editing, and the terms state data is deleted no later than 90 days after termination. I found no public information on a documented REST API with SDKs, bulk export preserving folder structure and versions, open protocols such as WebDAV, S3 or SFTP that would make migration tool-independent, migration tools from a named provider, or a self-hosted or on-premise edition. Getting out again looks harder than getting in. 3 11 18 8 1
The Architecture Practice Partner
The command-line client runs on Windows, macOS, Linux and FreeBSD and can send webhooks with Slack formatting, Microsoft Office Online integration is named, and deletion of all data within 90 days of termination is stated. We found no public information on a documented REST API or SDKs, WebDAV, S3 or SFTP access, bulk export with folder structure, migration tools from other providers, or a self-hosted edition — the pages describe the vendor running its own infrastructure in Norway, not an edition a customer could run. 1 3 8 18
The Tax Adviser
A documented command-line client runs on Windows, macOS, Linux and FreeBSD and sends configurable webhooks in Slack format, Microsoft Office Online is integrated for editing, and the terms state data is deleted no later than 90 days after termination. We found no public information on a REST API, migration tools from named providers, bulk export of all files with their folder structure, open protocols such as WebDAV or S3, or a self-hosted edition. 1 3 8 18
The Agency Producer
The command-line client is documented in detail, including webhooks that send Slack-formatted status messages from servers and NAS boxes, and Microsoft Office Online integration plus deletion of data within 90 days after termination are stated. We found no public information on a documented REST API, SDKs, migration tools from other providers, open protocols, or a self-hosted edition — the "own data centres" on the pages are the vendor's, not one I could run. 1 8 11 18
The Skeptic
A command-line client that runs on servers, NAS devices and Raspberry Pi and can send webhooks, Office Online for browser editing, and deletion of all data no later than 90 days after termination give a buyer some of what leaving should look like. We found no public information on a documented REST API with SDKs, open-protocol access for tool-independent migration, migration tools from named providers, a bulk export preserving folder structure and versions, or a self-hosted edition. 1 8 11 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
Jotta Group AS of Oslo is the contracting side, all customer data sits on servers the company itself owns and operates in Norway, a data processing agreement with EU standard contractual clauses and audit rights is published, and subprocessors Stripe and Microsoft Office Online are named with 30 days' notice of changes. We found no public information on the subprocessors' locations or on ISO 27001, BSI C5 or SOC 2 certifications, which keeps this one notch below the top. 1 3 5 9
The Data Protection Officer
The chain I demand in writing is largely there: the contracting entity is Jotta AS in Oslo with a Norwegian organisation number, all customer data is stored in data centres in Norway that the vendor owns and operates itself, a data processing agreement with standard contractual clauses, audit rights and breach notification is published, a subprocessor list is referenced with 30 days' notice of changes naming Stripe for payment and Microsoft Office Online for optional editing, and disclosure happens only on a binding Norwegian court order with user notification where law permits. What holds it below the top band is that the captured pages give no locations for the subprocessors and state no ISO 27001, BSI C5 or SOC 2 certification for any of it. 5 9 3 14 8
The Architecture Practice Partner
All customer data is stored in Norway in data centres the vendor owns and operates, the contracting entity is Jotta Group AS of Oslo under Norwegian law and the Court of Oslo, a data processing agreement with EU standard contractual clauses is published, and Stripe (payment) and Microsoft Office Online (optional editing) are named subprocessors with a published list, 30-day change notice, and authority access only on a Norwegian court order with user notification. This stays short of the top level because the captured pages give no locations for the subprocessors and we found no security certifications such as ISO 27001, BSI C5 or SOC 2. 1 5 8 9
The Tax Adviser
All customer data is stored in Norway in data centres the company itself owns and operates without outsourcing, the contracting entity is Jotta Group AS of Oslo under Norwegian law with disclosure only on a Norwegian court order and user notification, and a data processing agreement with standard contractual clauses is published naming the subprocessors — Microsoft Office Online for optional editing and Stripe for payment processing — with 30 days' notice of changes. The chain includes those two non-European services, and we found no public information on where the listed subprocessors process data or on certifications such as ISO 27001, BSI C5 or SOC 2. 1 5 8 9 14
The Agency Producer
Jotta Group AS in Oslo is the contracting entity, all customer data is stated to be stored in Norway in data centres the company owns and operates itself (a former NATO ammunition facility in the mountains), a data processing agreement with standard contractual clauses is published, and a sub-processor list exists, with Microsoft Office Online for optional editing and Stripe for payment named. The chain looks genuinely European; we found no public information on ISO 27001, SOC 2 or BSI C5 certifications, or on the listed sub-processors' locations. 3 4 8 9
The Skeptic
The contracting entity is Jotta Group AS of Oslo under Norwegian law and the Oslo courts, every customer byte is stored in Norway in data centers the vendor owns and operates itself — no hyperscaler in the chain — with a published data processing agreement carrying 2021/915 clauses, a subprocessor list with 30 days' notice of changes, and disclosure only on a Norwegian court order with user notification. The two named subprocessors, Microsoft Office Online for optional editing and Stripe for payment, appear without their locations on the captured pages, and we found no public information on ISO 27001 or comparable certifications. 1 3 4 5 8 9
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
The business tiers are public — NOK 129, NOK 179 and NOK 459 per month for 2, 10 or unlimited users, each with 1 TB storage — with VAT excluded, monthly or yearly renewal, and price-change notice of 30 days stated. Additional terabytes are said to be addable at checkout, but their price is not published, so I cannot compute our full annual cost from these pages alone. 1 5 8
The Data Protection Officer
Business tiers are public with exact figures — Business Small at NOK 129 / month for 2 users, Business Medium at NOK 179 / month for 10 users and Business Large at NOK 459 / month for unlimited users, each with 1 TB — and the terms state VAT is excluded, that additional TB can be added at checkout, that payments are non-refundable, and the 14-day right of cancellation applies to individual accounts only. The price of those additional terabytes is not published, and neither are any feature add-ons, so the true annual cost of a growing archive of patient letters cannot be computed from public pages alone. A free tier with 5 GB and its inactivity termination is clearly stated. 1 5 8
The Architecture Practice Partner
Every business tier is public with exact prices (NOK 129 per month for 2 users, NOK 179 for 10 users, NOK 459 for unlimited users, each with 1 TB storage), VAT is stated as excluded, monthly and yearly billing with auto-renewal is described, and the 5 GB free tier with email and chat support is clear. The gap for computing a real annual cost: additional storage is only said to be addable at checkout with no public price, and we found no public information on feature gating across tiers or a cooling-off period for business accounts. 1 5 8
The Tax Adviser
Three business tiers are public — Business Small NOK 129 / month for 2 users, Business Medium NOK 179 / month for 10 users and Business Large NOK 459 / month for unlimited users, each with 1 TB and prices excluding VAT — alongside a free 5 GB account, monthly or yearly billing, automatic renewal and non-refundable payments. Additional terabytes are said to be addable at checkout with no published price, so the storage cost for my eleven staff and their client archives cannot be computed from the public pages alone. 1 5 8
The Agency Producer
The business tiers are public and fixed-price — Business Small at NOK 129 / month for 2 users, Medium at NOK 179 / month for 10 users, Large at NOK 459 / month with unlimited users, each with 1 TB storage and VAT excluded — with a 5 GB free tier, monthly or yearly billing, and renewal, price-change and refund terms published. What I could not compute is the bill when one shoot fills the terabyte: the page says "Additional TB can be added at checkout" without a price on the captured pages, and storage does not grow with users. 1 5 8
The Skeptic
The business tiers are public with exact figures — NOK 129 per month for 2 users, NOK 179 for 10 users, NOK 459 for unlimited users, each with 1 TB — alongside a free tier of 5 GB, VAT stated as excluded, and terms like non-refundable payments and a 14-day cancellation right for individual accounts only. But additional terabytes are said to be addable at checkout without any published price, the yearly business figures are not shown on the captured pages, and storage is per plan rather than per user, so a buyer cannot compute the full annual cost from these pages alone. 1 5 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Jottacloud Business
Is Jottacloud Business European?
Yes, though not from the EU. whats-best.ai classifies Jottacloud Business as UK / wider Europe.
Where does Jottacloud Business store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Norway as hosting location, per the vendor’s page captured 1 Nov 2026.
Does Jottacloud Business have a free plan?
Yes. Jottacloud Business has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Jottacloud Business?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Jottacloud Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Transfer impact assessment, Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business) jottacloud.com Checked 1 Nov 2026 Details →
- 2 Company homepage jottacloud.com Checked 1 Nov 2026 Details →
- 3 Features page jottacloud.com Checked 1 Nov 2026 Details →
- 4 Security / trust page jottacloud.com Checked 1 Nov 2026 Details →
- 5 Pricing page jottacloud.com Checked 1 Nov 2026 Details →
- 6 Company page jottacloud.com Checked 1 Nov 2026 Details →
- 7 Privacy policy jottacloud.com Checked 1 Nov 2026 Details →
- 8 Terms of service jottacloud.com Checked 1 Nov 2026 Details →
- 9 Data processing agreement (dpa) jottacloud.com Checked 1 Nov 2026 Details →
- 10 Sync, clients & file access — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 11 Sync, clients & file access — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 12 Sharing & external collaboration — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 13 Sharing & external collaboration — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 14 Encryption, key custody & recovery — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 15 Encryption, key custody & recovery — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 16 Administration, audit & governance — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 17 Administration, audit & governance — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →
- 18 Export, API & self-hosting — found from sitemap docs.jottacloud.com Checked 1 Nov 2026 Details →