Cloud Storage & File Sharing
luckycloud Business
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by luckycloud GmbH · luckycloud.de
Compare with STRATO HiDrive Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
luckycloud Business at a glance
- Vendor
- luckycloud GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates luckycloud Business 2.5/5, the mean of 6 judges. luckycloud Business is a German cloud storage service whose persona-weighted totals run from 5.0 to 5.8. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
luckycloud Business is a German cloud storage service whose persona-weighted totals run from 5.0 to 5.8. It is strongest on sovereignty at 6-7, pricing transparency at 6-7, and administration and governance at a uniform 6: the vendor is a GmbH registered in Berlin, hosts exclusively on its own servers in Germany in ISO-certified data centres, publishes a transparency report and a documented route to a GDPR data processing agreement, prices Business from 4,50 € per person per month with a 30% saving at twelve months, and provides a Business admin panel with predefined roles, delegable department administration and detailed access logs. Weakest are portability and integrations, flat at 4, and sync and access at 4-5, where we found no public information on WebDAV, SFTP or S3, migration tools from named providers, files-on-demand or block-level sync. Encryption and security lands at 5-6: zero-knowledge end-to-end encryption is optional per folder, and external sharing is unencrypted only. Scores spread by at most one point on every criterion, and the captured pages give different figures for storage included on Business.
Speaks for it
- Zero-knowledge end-to-end encryption for individual folders, with the encryption password stated not to be stored on the vendor's servers so even administrators cannot read the content.
- Services run exclusively on the vendor's own servers in Germany in ISO-certified data centres, with a published transparency report and a documented data processing agreement under EU-GDPR.
- A Business admin panel with four predefined roles, delegable department administration, per-area storage quotas, and access logs with an Excel export of the rights overview.
- Public per-user prices — Business from 4,50 € per person per month, Teams from 2,50 € per user — with terms from one to 24 months, a 30% saving at twelve months and a 14-day free trial.
- Desktop sync clients for Windows, macOS and Linux including a headless command-line client for servers, plus iOS and Android apps.
Held against it
- Sharing with external users is documented as possible unencrypted only, and encrypted sharing requires provisioning the recipient as a user.
- We found no public information on WebDAV, SFTP or S3 access, migration tools from named providers, SDKs, webhooks or a self-hosted edition.
- We found no public information on directory or SCIM provisioning, retention policies, legal hold, remote wipe or SIEM integration.
- The captured pages give different figures for storage included on Business, the Enterprise and Enterprise Plus tiers carry no public price, and we found no public information on VAT treatment.
- Administrator-deleted directories are documented as unrestorable, and we found no public information on a recycle bin or a ransomware recovery path.
Best for
- You need a cloud hosted exclusively on the vendor's own servers in Germany, with a documented GDPR data processing agreement and a published transparency report.
- You organise work in departments and need delegable administration, per-area storage quotas, predefined roles and exportable rights overviews.
- You can provision every collaborator as a user in your own cloud and want zero-knowledge end-to-end encryption for internal folders.
- You want public per-user pricing with flexible terms and a 14-day free trial before committing.
Avoid if
- You must deliver confidential files to outside parties over links — external sharing is documented as possible unencrypted only.
- Your recovery expectations include restoring deleted directories — the help pages state administrator-deleted directories cannot be restored.
- Your team moves heavy traffic every month — included traffic is 120% of booked storage, with excess billed at 0,0396 € per GB.
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 2 of 5 |
| Sharing & external collaboration | 2.5 of 5 |
| Encryption, key custody & recovery | 3 of 5 |
| Administration, audit & governance | 3 of 5 |
| Export, API & self-hosting | 2 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
The sync client is documented for Windows, macOS and Linux including a headless server install, with automatic change propagation, the option to skip the default folder, and mounting as a network drive, plus iOS and Android apps. We found no public information on files-on-demand virtual drives, block-level sync, full-text search, previews, camera upload or file size limits, so beyond solid client coverage the access detail stays thin. 10 9 2 1
The Data Protection Officer
Desktop sync clients for Windows, macOS and Linux are documented with automatic propagation of changes to all devices, selective skipping of the default directory, a headless command-line client for servers, and the option to mount folders as a network drive, with mobile apps for iOS and Android named. We found no public information on files on demand, block-level sync, offline mobile folders, camera upload, previews, file-size limits or search, so we cannot place file access above the middle of the scale. 1 2 9 10
The Architecture Practice Partner
Desktop sync clients for Windows, Mac and Linux are documented, down to a headless install for servers, folders can be mounted as a network drive, and iOS and Android apps exist; selective sync is described only as skipping the default directory during setup. For our multi-gigabyte BIM models I found no public information on files on demand, delta or block-level sync, file size limits, offline folders or camera upload on the phones, previews or search. 10 9 2 1
The Tax Adviser
Desktop sync clients for Windows, macOS and Linux are documented, with automatic propagation of changes to all devices, a headless command-line install for servers, the ability to skip or relocate directories during setup, iOS and Android apps, and mounting as a network drive. We found no public information on files on demand, block-level sync, previews, full-text search, camera upload, file size limits, or access via WebDAV, SFTP or S3. 1 2 9 10
The Agency Producer
Windows, Mac and Linux clients synchronise changes automatically, the cloud can be mounted as a network drive, and apps exist for iOS and Android — a decent base for our edit suites. But with traffic included at 120% of booked storage and excess billed at 0,0396 € per GB, a month of heavy footage sends gets metered, and we found no public information on files on demand, delta sync, offline mobile folders, browser previews or file size limits. 2 8 9 10
The Skeptic
Sync clients for Windows, macOS and Linux are documented with automatic change propagation, selectable directories, a headless command-line client for servers and network-drive mounting, plus iOS and Android apps and real-time sync. We found no public information on files on demand, block-level or delta sync, full-text search, previews, file size limits, or open protocols such as WebDAV, SFTP or S3, which keeps this below the next level. 1 2 9 10
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Download, upload and combined links with optional password protection, per-folder read and write rights, group shares, guest roles and collaborative editing are all documented, and an admin can oversee every public link with its call count. Sharing with people outside the account works unencrypted only, and we found no public information on link expiry, download limits, watermarking, comments, file locking or an Outlook/Teams add-in. 11 12 18 16 2 1
The Data Protection Officer
Shares for users and groups, download links, upload links and a combined share-and-upload option for external people are documented, with read and write rights assignable, optional password protection on shareable links mentioned in the API documentation, isolation of external recipients to the shared data only, and an administrator view of every public link with owner, creation date and call counts. Link expiry, download limits, watermarking and guest accounts with their own rights are not described, and the captured pages state that for external users it is only possible to share data unencrypted — encrypted sharing requires provisioning the recipient as a user — which is decisive when the folder holds patient letters and salary statements. 1 2 11 12 15 16 18
The Architecture Practice Partner
Team folders with read and write rights, download links and upload links for external people without an account, guest roles, and an admin view of every public link with its owner and call count are all documented, and the API additionally offers links with optional password protection. Collaborative editing is claimed but no editor or browser office suite is named, and I found no public information on link expiry, download limits, view-only links, notifications, comments or file locking; sharing to external users is documented as unencrypted only. 11 12 2 16 18
The Tax Adviser
Upload links, download links, a combined share-and-upload option, read and write permissions, sharing with users and groups, collaborative editing, and an administrator view of every public link with owner, creation date and call count are all documented, and password-protected links appear in the API description. But we found no public information on link expiry, download limits or a view-only mode for outsiders, and the documentation states that sharing with external users is possible unencrypted only — a real caution for client tax data under professional secrecy. 2 11 12 15 18
The Agency Producer
Download, upload and combined links let us deliver cuts and collect files back — the vendor explicitly names freelancers and customers as the use case — and guest roles with read/write permissions plus an admin view of every public link with its call count are documented. We found no public information on link expiry, download limits, comments or file locking, and the documentation states external sharing is possible unencrypted only, which bites when NDA material goes to a client. 1 2 11 12 16
The Skeptic
Shares to internal users and groups, download and upload links, isolated external access and joint editing in the cloud are documented, and the administrator can view and revoke every public link with owner and call counts. End-to-end encryption survives only for people provisioned as users in your own cloud while external sharing is unencrypted, and we found no public information on link expiry, download limits, view-only or no-download mode, watermarking, comments, file locking or an Outlook or Teams add-in. 1 11 12 16
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
TLS 1.2 in transit, encrypted storage media, two-factor authentication and version history are documented, and the end-to-end option is real zero-knowledge: the folder password is never stored on their servers and not even their administrators can read encrypted folders. The encryption is optional per folder, and we found no public information on a recycle bin, restore of a folder to a point in time after ransomware, or a named independent audit — the certifications appear only as "recognized security standards" and ISO-certified data centres. 7 2 1 14 18 13
The Data Protection Officer
End-to-end encryption on a zero-knowledge basis is documented for individual folders, with the encryption password not stored on the vendor's servers so that not even its administrators can read encrypted folders, alongside TLS 1.2 upload, encrypted storage media, optional two-factor authentication and version history reachable through the API. We found no public information on key recovery, a published cryptography description, single sign-on, ransomware detection or recovery, or a named independent audit, the certifications appear only as unnamed references to ISO-certified data centres, and the pages state that directories deleted by an administrator cannot be restored. 1 2 7 13 14 15 18
The Architecture Practice Partner
Uploads run over TLS 1.2, the storage media are stated to be highly encrypted, and optional end-to-end encryption for individual folders is documented with the password not stored on the servers so that not even administrators can read the content; two-factor authentication and exclusive use of open-source software are also stated. For recovery I found no public information on version-history length, a recycle bin or a restore path — directories deleted by the administrator are explicitly unrestorable — and beyond 'recognized security standards' no independent audit or named certification with its scope appears. 7 2 14 1 16
The Tax Adviser
Transit encryption via TLS 1.2, encrypted storage media, optional end-to-end encryption for individual folders under a zero-knowledge principle — the end-to-end password is stated not to be held on the servers, and administrators cannot read encrypted folders — plus two-factor authentication are documented. We found no public information on a recycle bin, restore of deleted files, key recovery when a password is lost, ransomware detection, or any named audit or certification with its scope beyond ISO-certified data centres; the help pages themselves note that administrator-deleted directories cannot be restored. 1 2 7 15 18
The Agency Producer
Optional per-folder end-to-end encryption runs on a zero-knowledge principle — the password is never stored on luckycloud's servers and even administrators cannot read it — alongside encrypted storage media, TLS 1.2 and activatable two-factor authentication. We found no public information on version history length, a recycle bin, restore after ransomware, single sign-on, or any named audit or certification; the pages cite only "recognized security standards" and ISO-certified data centres without naming them. 1 2 7 13 14
The Skeptic
Zero-knowledge end-to-end encryption for individual folders is documented with the key custody in the open: the encryption password is not stored on the servers, even administrators cannot read it, the code base is claimed open source, and TLS 1.2, encrypted storage media and two-factor authentication are published. But end-to-end encryption is optional per folder and does not extend to external links, and we found no public information on version-history length, a recycle bin, restore to a point in time after ransomware, single sign-on, recovery from a lost encryption password, or any named audit or certification with its scope. 1 2 5 7 12 14
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
The Business admin panel covers users, areas with their own storage quotas, sub-areas, four predefined roles plus delegated area administration, bulk user import, and transfer of directory ownership when someone leaves — that answers my team-folders-stay-with-the-company requirement. The logging is genuinely usable for an auditor: logins, file accesses, file changes, permission changes and link call counts, with an Excel export of the rights overview. What stops me going higher is provisioning by spreadsheet import rather than Entra ID or SCIM, and we found no public information on remote wipe or device unlinking for a lost laptop. 15 16 9
The Data Protection Officer
For Business and Enterprise an admin panel is documented with user creation, password resets and deletion, bulk import via spreadsheet, departments and sub-areas with their own storage allocation, four predefined roles with eleven listed permissions, custom roles on Enterprise, delegable area administration, transfer of directory ownership, and access logs covering logins, file accesses, changes and link calls with an Excel export of the rights overview. We found no public information on directory or SCIM provisioning, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or SIEM streaming, which keeps governance below what a regulated organisation signs off. 15 16 18
The Architecture Practice Partner
From the Business plan upward an admin panel is documented with user creation, password resets and bulk XLSX import, departments and sub-departments with per-area storage allocation, four predefined roles plus delegable area administration and multiple system administrators, and access logs covering logins, file accesses, file changes, permission changes and shared-link calls, with a rights overview exportable to Excel. I found no public information on provisioning through Entra ID, Google or LDAP with SCIM, retention policies and legal hold, remote wipe of devices, or forwarding the logs to a SIEM. 16 15 18
The Tax Adviser
For Business and Enterprise the admin panel is documented with user creation, password resets and deletion, areas and sub-areas with their own storage allocation, four predefined roles with a granular permission list, delegated administration per area, bulk import from an XLSX file, ownership transfer of directories, and access logs covering logins, file accesses, file changes, permission changes and shared-link calls, with the rights overview exportable to Excel and logs retrievable through the API. We found no public information on directory or SCIM provisioning, retention policies, legal hold, or remote wiping of lost devices. 15 16 18
The Agency Producer
Business plans unlock an admin panel with four predefined roles plus guests, nested departments with their own storage quotas, delegated department administrators, XLSX user import, password resets, directory ownership transfer when someone leaves, and access logs covering logins, file accesses, file changes, permission changes and shared-link calls — exportable as an Excel rights overview and retrievable through the API. We found no public information on provisioning via a directory or SCIM, retention policies, legal hold, remote wipe or a SIEM connection. 15 16 18
The Skeptic
The Business admin console covers users, groups, four predefined roles plus delegable department administration, quotas per user and sub-area, directory ownership transfers, and access logs for logins, file changes, permission changes and shared-link calls, with the rights overview exportable to Excel. We found no public information on provisioning via a directory or SCIM, retention policies or legal hold, remote wipe or unlinking of devices, IP restrictions, data loss prevention or SIEM integration. 15 16
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
A documented REST API with published documentation covers file upload, download and editing, password-protected share links, users, groups and access logs, and the Enterprise plan runs on the customer's own domain. We found no public information on WebDAV, S3 or SFTP access, migration tools from OneDrive or an existing file server, named office-suite or Teams integrations, or a self-hosted edition — the software they run is open source, but a customer cannot run it themselves. Termination terms are stated for unpaid trial accounts, deleted fully after 14 days. 18 17 1 8
The Data Protection Officer
A documented REST API offers upload, download and editing of files and folders, user and group management with roles, monitoring and shareable links, with separate endpoints per plan and the Enterprise plan on the customer's own domain, and the vendor states it uses exclusively open-source software so the code can be inspected. We found no public information on bulk export of all data with the folder structure, open protocols such as WebDAV or S3, SDKs or webhooks, migration tools from named providers, or a self-hosted edition, while deletion on request or when data is no longer needed for contract purposes is stated in the privacy policy and unpaid trial accounts are deleted after fourteen days. 1 7 8 17 18
The Architecture Practice Partner
A REST API is documented for uploading, downloading and editing files and folders, for user and group management, share links and access logs, and the vendor states it uses exclusively open-source software so anyone can view the code. I found no public information on a bulk export with folder structure and versions, migration tools from named providers, open protocols such as WebDAV, S3 or SFTP for migration, an app marketplace or a self-hosted edition; deletion is documented for unpaid accounts, which are fully deleted after 14 days, and on request when data is no longer needed for the contract. 18 17 1 8
The Tax Adviser
A REST API is documented with upload, download and editing of files and folders, share links, version history, user and group management and log retrieval, with per-plan endpoints, and the sync client can bring whole directories to a local machine; deletion of unpaid accounts after 14 days and general deletion on request are stated. We found no public information on open protocols such as WebDAV, S3 or SFTP for migration, SDKs, webhooks, an app marketplace, or a self-hosted edition the customer runs itself — the Enterprise tier is described as a dedicated hosting service. 7 8 10 17 18
The Agency Producer
A documented REST API handles files, password-protected share links, version history, users and access logs — enough for us to build our own bridges to Slack and our project tool. Beyond that we found no public information on named integrations, migration tools from Dropbox, Drive or OneDrive, open protocols like WebDAV, SFTP or S3, or a self-hosted edition; Enterprise is described as a dedicated hosting service on the customer's own domain run by luckycloud, and an unpaid account is fully deleted after 14 days. 8 17 18
The Skeptic
A documented REST API with published documentation covers files and folders, version history, sharing, users, groups and monitoring, and the vendor states it uses exclusively open source software whose code anyone can inspect. We found no public information on a bulk export of all data with the folder structure, open protocols usable for migration, SDKs or webhooks, an app marketplace, or migration tools from a named provider, and the Enterprise plan is a dedicated hosting service on the vendor's servers rather than a self-hosted edition; deletion on request and full deletion of unpaid accounts after 14 days are stated. 1 8 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
This is a German GmbH registered in Berlin, hosting exclusively on its own servers in Germany in ISO-certified data centres, processing under GDPR and BDSG with a documented route to a data processing agreement, and publishing a transparency report on government data requests together with the formal conditions it demands before disclosing anything. What keeps it from the top band: the data centres are not individually named, there is no subprocessor list, and the certifications are described only as "ISO-certified" and "recognized security standards" without scope. 6 7 1 14 13 4
The Data Protection Officer
The contracting entity is luckycloud GmbH of Berlin with registry court, register number and VAT identification published, the services are hosted exclusively on the vendor's own servers in Germany in ISO-certified data centres, German law and Berlin venue apply, documentation on obtaining a data processing agreement under EU-DSGPR and BDSG exists, and a transparency report on government data requests with the disclosure conditions under German law is published. We found no public information naming the data centres, listing subprocessors with their locations, or stating the security certifications with a named standard and scope, which keeps this just below the fully evidenced level. 1 4 6 7 8 13 14
The Architecture Practice Partner
The legal notice shows luckycloud GmbH registered at Amtsgericht Charlottenburg in Berlin with a German VAT ID, the privacy policy states the services run exclusively on the company's own servers in Germany, the business page names ISO-certified data centres in Germany, and how to obtain a data processing agreement under EU-GDPR is documented alongside a transparency report on government requests. I found no public information naming the data centres or listing subprocessors such as email or payment providers with their locations, and no certification is published with its scope. 6 7 1 13 14
The Tax Adviser
luckycloud GmbH is registered in Berlin at Amtsgericht Charlottenburg with a German VAT number, contracts under German law with exclusive venue in Berlin, and states that its services run exclusively on its own servers in Germany in ISO-certified data centres, with a data processing agreement per EU-GDPR, processing per GDPR and BDSG, and a published transparency report on law-enforcement requests together with the disclosure conditions it requires. The captured pages do not name the individual data centres and publish no subprocessor list with locations, which is what keeps this one step short of fully evidenced sovereignty. 1 4 5 6 7 8
The Agency Producer
luckycloud GmbH is registered in Berlin at Amtsgericht Charlottenburg with a German VAT ID, hosts exclusively on its own servers in ISO-certified data centres in Germany, documents a GDPR data processing agreement, and publishes a transparency report on government data requests — a genuinely European chain on the storage side. We found no public information naming the data centres, listing subprocessors, or naming the audited security standards. 1 4 6 7 14
The Skeptic
The contracting entity is a German GmbH with register court, number and VAT ID in Berlin, the services run exclusively on the vendor's own servers in Germany, operation is stated to be in Germany in ISO-certified data centres, a transparency report on government requests is published, master-data disclosure is limited to German telecom-law conditions, and a data processing agreement is obtainable under EU-GDPR and BDSG. The data centres are not named, no subprocessor list with locations is published, and no certification appears with its standard and scope, so the chain is credibly European but not evidenced end to end. 1 4 6 7 13 14
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
Prices are public and detailed: Business from 4,50 € per person, Teams from 2,50 € per user, storage billed per gigabyte ("3 GB (0,33 € pro GB)") or "unbegrenzt" on Business, terms of one to 24 months with a 30% saving at twelve, a minimum of two users, a free 14-day trial, excess traffic at 0,0396 € per GB and support tickets at 22,50 Euro per 15 minutes. For a complete annual cost the gaps matter: Enterprise and Enterprise Plus carry no public price, VAT treatment is not stated, and the captured pages give different figures for Business storage ("unbegrenzt" versus "0 GB (0,00 € pro GB) + 100 GB extra"). 1 2 8
The Data Protection Officer
Business is published from 4,50 € per person per month for teams of two to 1000+ with unlimited storage, Teams from 2,50 € per user with storage at 0,33 € per GB, terms from one to twenty-four months with a default of twelve and automatic renewal, a 30% saving at twelve months, traffic of 120% of booked storage included with overage at 0,0396 € per GB, a fourteen-day free trial, paid accounts only, and support tickets priced at 22,50 € per fifteen minutes. We found no public price for the dedicated Enterprise hosting tier and no statement of VAT treatment for the published prices, so a Business deployment is computable from public pages but the top tier is not. 1 2 8
The Architecture Practice Partner
Public pages give 'ab 4,50 €' per person and month for Business with unlimited storage and 'ab 2,50 € pro Nutzer' for Teams, the configurator prices storage at '0,33 € pro GB', and a 12-month term saves 30%; contract lengths of 1 to 24 months, a minimum of two users, the 14-day trial, excess traffic at '0,0396€ pro GB' and support tickets at '22,50 Euro' per 15 minutes are all stated. I found no public information on Enterprise and Enterprise Plus prices, on VAT treatment of the shown prices, or on which features beyond the plan boundaries cost extra. 1 2 8
The Tax Adviser
Business is published from 4,50 € per person per month with a stated 30% saving at 12 months and unlimited storage, Teams from 2,50 € per user with configurator storage at 0,33 € per GB, minimum two users, terms from one to 24 months, included traffic of 120% of booked storage, excess traffic at 0,0396 € per GB, a 14-day free trial, and paid support at 22,50 € per 15-minute ticket. We found no public price for the Enterprise tier and no public information on VAT treatment, and the captured pages give different figures for extra storage, so the full annual cost for a given team size and storage need is not computable from public pages alone. 1 2 8
The Agency Producer
Per-user prices are public — Teams from 2,50 € per user, Business from 4,50 € per person with unlimited storage and 30% off a twelve-month term — along with contract lengths from one to 24 months, prorated upgrades, traffic overage at 0,0396 € per GB and support tickets at 22,50 € per 15 minutes. But we found no public price for Enterprise and Enterprise Plus, no statement on VAT treatment, and the captured pages give different figures for extra storage, so a full annual bill is not computable from public pages alone. 1 2 8
The Skeptic
Per-user prices are public (Business from 4,50 € per person per month, Teams from 2,50 €), with storage at 0,33 € per GB, excess traffic at 0,0396 € per GB, a support ticket at 22,50 € per 15 minutes, terms from one to 24 months with a 30% saving at twelve months, and midterm user additions at no extra cost. The captured pages give different figures for storage included (unlimited on the Business page, gigabyte-priced in the configurator), the Enterprise tier carrying the custom roles has no public price, and VAT treatment of the prices is not stated. 1 2 8
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about luckycloud Business
Is luckycloud Business European?
Yes. whats-best.ai classifies luckycloud Business as EU-Made.
Where does luckycloud Business store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 1 Nov 2026.
Does luckycloud Business have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to luckycloud Business?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: luckycloud Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Transfer impact assessment, Legal entity, Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 13 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 7 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (business plans and pricing) luckycloud.de Checked 1 Nov 2026 Details →
- 2 Features page (team plans and pricing) luckycloud.de Checked 1 Nov 2026 Details →
- 3 Security / trust page luckycloud.de Checked 1 Nov 2026 Details →
- 4 Security / trust page (transparency report) luckycloud.de Checked 1 Nov 2026 Details →
- 5 Documentation (data protection and security) docs.luckycloud.de Checked 1 Nov 2026 Details →
- 6 Legal notice luckycloud.de Checked 1 Nov 2026 Details →
- 7 Privacy policy luckycloud.de Checked 1 Nov 2026 Details →
- 8 Terms of service luckycloud.de Checked 1 Nov 2026 Details →
- 9 Sync, clients & file access — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 10 Sync, clients & file access — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 11 Sharing & external collaboration — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 12 Sharing & external collaboration — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 13 Encryption, key custody & recovery — found from sitemap luckycloud.de Checked 1 Nov 2026 Details →
- 14 Encryption, key custody & recovery — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 15 Administration, audit & governance — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 16 Administration, audit & governance — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 17 Export, API & self-hosting — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →
- 18 Export, API & self-hosting — found from sitemap docs.luckycloud.de Checked 1 Nov 2026 Details →