# Nextcloud Files (Nextcloud Hub) — Cloud Storage & File Sharing

Nextcloud Files (Nextcloud Hub) by Nextcloud GmbH holds a panel rating of 4/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Nextcloud GmbH (https://nextcloud.com/files/)
- Category: [Cloud Storage & File Sharing](https://whats-best.ai/software/cloud-storage.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/cloud-storage/nextcloud-files
- Alternatives: https://whats-best.ai/software/cloud-storage/nextcloud-files/alternatives ([markdown](https://whats-best.ai/software/cloud-storage/nextcloud-files/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Nextcloud GmbH
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 1 Nov 2026

## The panel's verdict

Persona-weighted totals run from 7.2 to 7.9. It is strongest at sharing and collaboration, scored 8 to 9, where judges credit enforced link passwords and expiry, hide-download, video verification, watermark-protected secure view, File Drop uploads into end-to-end encrypted folders and a virtual data room; sovereignty holds at 8, with a published subprocessor list naming locations and transfer mechanisms while files stay on the customer's own infrastructure. It is weakest at pricing transparency, 6 to 7: tiers are public — Standard starting at 100 users for 71.29€/user/year, Premium at 104.99€/user/year, Ultimate at 204.75€/user/year, net excluding VAT — but the bench found no public prices for the separately purchasable optional components and no public information on storage included or the minimum contract term. Judges genuinely split on that criterion and on portability and integrations, 7 to 8: higher scores weigh self-hosted open-source exit paths, lower ones note community answers that shares cannot generally be re-created on another system.

**Speaks for it:**
- Link sharing carries enforced passwords, expiration, hide-download, watermark-protected secure view, video verification and a virtual data room with audit log
- End-to-end encryption is folder-level with user-held 12-word mnemonics, a published whitepaper, a zero-knowledge server and an optional offline master recovery key
- Fully open-source code runs self-hosted on-premises, in the cloud or hybrid, keeping files on infrastructure the customer chooses
- The vendor publishes its subprocessor list with names, locations and transfer mechanisms
- Documented migration paths cover Microsoft 365, Google Workspace, Box, Dropbox and DRACOON, with a dedicated migration service

**Held against it:**
- The bench found no public prices for the separately purchasable optional components, nor public information on storage included or the minimum contract term
- Subscriptions carry a stated minimum of 100 users, above the headcount of smaller teams
- A captured community answer states a lost 12-word end-to-end encryption mnemonic cannot be recovered
- Community answers state shares cannot generally be re-created on another system and the user migration app must be installed before export works
- Compliance documents and certifications are stated to cover Nextcloud Enterprise only, not the community edition

**Best for:**
- You operate your own servers — or contract a hosting partner — and want files on infrastructure you choose
- You exchange confidential documents with outside parties and need enforced passwords, expiry, watermarking and video verification on links
- You are migrating from Microsoft 365, Google Workspace, Box, Dropbox or DRACOON and want documented migration paths and open APIs
- Your organisation sits at or above the 100-user subscription minimum and can budget from published per-user tier prices

**Avoid if:**
- You are a team below the stated 100-user subscription minimum
- Your work depends on a virtual drive for large datasets — a community answer notes the desktop client must be running for it, and the bench found no public figures on block-level or delta sync
- You need SIEM streaming or legal hold — the bench found no public information, and a community answer states the audit app cannot log directly to syslog

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The IT Lead | The Data Protection Officer | The Architecture Practice Partner | The Tax Adviser | The Agency Producer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Sync, clients & file access | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Sharing & external collaboration | 4.5/5 | 4/5 | 4/5 | 4.5/5 | 4/5 | 4/5 |
| Encryption, key custody & recovery | 3.5/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Administration, audit & governance | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| Export, API & self-hosting | 4/5 | 3.5/5 | 4/5 | 4/5 | 3.5/5 | 4/5 |
| European sovereignty | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 | 4/5 |
| Pricing transparency | 3/5 | 3/5 | 3.5/5 | 3.5/5 | 3/5 | 3/5 |
| **Weighted verdict** | **3.5/5** | **4/5** | **4/5** | **4/5** | **3.5/5** | **4/5** |

### The judges

- **The IT Lead** (v1.0): Runs IT with one colleague for a 180-person machine builder with three sites and a sales office in Poland. Is retiring the old file server and wants every account provisioned from Entra ID, team folders that stay with the company when someone leaves, an audit log they can hand to the auditor, a lost laptop wiped remotely, and a way back to the last clean state if ransomware ever encrypts a share.
- **The Data Protection Officer** (v1.0): External data protection officer for a hospital group, two care providers and a payroll bureau, where the files are patient letters and salary statements. Reads who holds the keys before the feature page, asks whether end-to-end encryption survives a share link and the office editor, and wants the subprocessor list, the storage location and the contracting entity in writing before a single folder moves.
- **The Architecture Practice Partner** (v1.0): Partner in a 25-person architecture practice in Hamburg whose CAD and BIM models run to several gigabytes each, worked on from the office, from home and on the building site. Needs files on demand so laptops do not fill up, sync that sends only what changed, a drive letter the CAD software accepts, phones that open plans offline in a basement, and structural engineers who can pick up a folder without an account.
- **The Tax Adviser** (v1.0): Runs a tax practice with eleven staff and 400 clients, bound by professional secrecy under §203 StGB. Receives receipts, payslips and annual accounts from clients who will not install anything, and sends back drafts that must not end up in a forwarded email. Needs upload links, shares with expiry and passwords, a record of who downloaded what, and a provider that cannot read the files it stores.
- **The Agency Producer** (v1.0): Producer at a 30-person video and design agency in Cologne that sends cuts, layouts and raw footage to customers every day and collects their feedback. Wants review links that play in the browser, comments on the file, transfers of 100 GB that do not stall, freelancers added for one project and removed after it, connections to Slack and the project tool, and a storage bill that does not jump when one shoot fills a terabyte.
- **The Skeptic** (v1.0): Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Abuse contact: abuse@nextcloud.com [S11]
- Additional certifications: ANSSI CSPN · BITV 2.0 · BLAUER ENGEL [S6]
- Anssi cspn: CSPN-certified by ANSSI, maps to EN 17640, recognized by BSI as equivalent to BSZ [S6]
- Audit logging: Data locality, retention and access controlled and logged for audit [S3]
- Brute force protection: yes [S2]
- By design: HIPAA · GDPR · data policy enforcement · encryption · user management · auditing [S1]
- Certifications list: GDPR · NIS2 · KRITIS · EN 301 549 · WCAG 2.2 · NIST · CCPA · HIPAA · FERPA · COPPA · MTCDPA · PCI DSS [S6]
- Compliance kit contents: 12-step compliance checklist, over-20-page administrator manual, direct consultation, compliance tools and apps [S6]
- Cybersecurity act readiness: anticipates readiness for certification under EU Cybersecurity Act once in effect [S6]
- Diagnostic data ip retention: 7 [S12]
- Docs enterprise only: Compliance documents and certifications cover Nextcloud Enterprise only, not community edition [S6]
- Downloadable documents: data processing record · HIPAA compliance statement [S6]
- Dsar retention: 2 [S12]
- Fda title21: FDA Title 21 CFR Part 11 compliant environment, with retention, versioning and auditing features [S6]
- GDPR no DPA needed: Nextcloud designed so Nextcloud GmbH has no access to customer data, removing need for GDPR data processor/controller agreement [S6]
- GDPR overview contents: GDPR overview covers where personal data is stored: user accounts, monitoring and logs, apps, file storage, database, backups [S6]
- Hosting responsibility: Hosting party is responsible for certification; compliance depends on hosting solution [S6]
- ISO 27001 BSI: ISO/IEC 27001 · BSI IT-GRUNDSCHUTZ [S6]
- Kit: Compliance Kit · Auditing capabilities · File Access Control [S1]
- Matomo DPA: yes [S11]
- More standards: REUSE · OPENSSF BEST PRACTICES [S6]
- Newsletter retention: security update newsletter subscription · until consent is withdrawn · 45 [S12]
- No customer data access: no [S12]
- No hosting no controller: no · no [S12]
- Processing scope: Data processing disclosure applies only to Nextcloud Enterprise customers [S12]
- Procurement retention: procurement and legal communication · 7-10 statutory (AO/HGB) [S12]
- Push notification data: until app deinstalled or account removed [S12]
- Regulations: GDPR · CCPA · HIPAA · FERPA · COPPA · MTCDPA [S2]
- Security features: yes · yes · yes · yes [S3]
- Seven data sources: 7 [S12]

**Data**
- Appstore github login: yes [S11]
- Appstore registration fields: Email · User name · First name · Surname · Password · Security code (SSH/GPG code) [S11]
- Consent cookie retention: 30 [S11]
- Consent withdrawal deletion days: 7 [S11]
- Forum email not public: no [S11]
- Forum pseudonym allowed: no [S11]
- Forum read without registration: no [S11]
- Log no marketing use: no [S11]
- Log not merged: Server log data is not merged with other data sources and not used to identify visitors [S11]
- Log retention: 7 [S11]
- Matomo anonymise ip: yes [S11]
- Matomo retention: 365 · 30 [S11]
- Migration export import: data migration, export, and import, including user migration to another server [S2]
- Newsletter data minimisation: email address · no [S11]
- Newsletter double optin: yes [S11]
- Newsletter retention: 3 [S11]

**Hosting**
- All in one deployments: All-in-one Docker · VM image · Azure · AWS [S2]
- No hosting: no [S9]
- Visitor offices: Berlin (Albrechtstraße 14b, 10117) · Stuttgart (Hospitalstraße 35, 70174) [S10]

**Integrations**
- App store count: 600+ [S7]
- App store examples: Example apps available via Nextcloud App Store [S8]
- Appstore policy: App store policy against misuse of private data; offending apps removed and author blocked [S11]
- Clients: Android · iOS · Windows · Linux · Mac [S3]
- Devmode github codespaces: GitHub Codespaces · local Docker setup · manual component deployment [S8]
- External storage: FTP · Windows Network Drive · SharePoint · NFS · Object storage [S1]
- Forum discourse: Discourse · help.nextcloud.com · no · Nextcloud [S11]
- Microsoft: file storage · user directory · Outlook · SharePoint · Windows Desktop · MS Office online server · Teams [S1]
- Microsoft: Outlook Files Sharing · Exchange Connector · Teams · WND & Sharepoint · Office Online [S2]
- Microsoft modules: Outlook integration · Exchange connector · Teams integration · WND & Sharepoint integration · Active Directory integration · Office Online Integration [S1]
- Ocs API classes: OCP API provides PHP classes/functions for core functionality [S8]
- Ocs rest API: OCS API is a RESTful API for external apps and front-end components [S8]
- Own consent manager: Nextcloud uses its own cookie consent manager [S11]
- Sharing import: No general way to import/re-create shares on another system [S21]
- Ultimate exclusive: Ultimate only [S9]
- Videos click through: yes · no [S11]
- Webdav API: WebDAV API enables file/folder manipulation and calendar/scheduling functions [S8]

**Legal**
- Address: Stuttgart · Hauptmannsreute 44a · Germany · 70192 [S10]
- Controller: Nextcloud GmbH · controller and website operator [S11]
- Controller address: Stuttgart · Hauptmannsreute 44a · Nextcloud GmbH · Germany · 70192 [S11]
- Copyright entity: 2016 - 2026 · Nextcloud GmbH [S1]
- Entity: Nextcloud GmbH [S4]
- Entity: Nextcloud GmbH [S7]
- Entity: Nextcloud GmbH [S9]
- Entity: Nextcloud GmbH [S12]
- Entity name: Nextcloud GmbH [S10]
- Gmbh: Nextcloud GmbH [S2]
- Gmbh entity: Nextcloud GmbH · 2016 - 2026 [S8]
- Nextcloud gmbh: Nextcloud GmbH [S5]
- Register entry: AG München · HRB 227086 [S10]
- VAT id: DE307093598 [S10]

**Pricing**
- Framework agreements: pricing tiers and framework agreements up to millions of users [S9]
- Minimum users: 100 [S9]
- Optional components: optional components can be separately purchased [S9]
- Premium price 100users: Premium · 100 · 104.99 [S9]
- Premium price 200users: Premium · 200 · 81.99 [S9]
- Standard price 100users: Standard · 100 · 71.29 [S9]
- Standard price 200users: Standard · 200 · 53.17 [S9]
- Ultimate price 100users: Ultimate · 100 · 204.75 [S9]
- Ultimate price 200users: Ultimate · 200 · 183.75 [S9]
- VAT treatment: per year · EUR · no [S9]

**Product**
- Academy courses beta: yes · beginner only [S8]
- Accessibility: dyslexia font · high contrast mode · light/dark theme · screen reader support [S2]
- Admin audit occ logfile: The admin_audit app logfile can be set with 'occ config:app:set admin_audit logfile' [S19]
- Admin audit syslog: Logging admin_audit app to syslog directly is stated as not possible (community answer) [S19]
- AI agency features: AI agency features acting across Calendar, Talk, Mail [S2]
- AI image generation: AI image generation [S2]
- Analytics matomo: Matomo · yes [S11]
- Android app: Android · 4.0 [S2]
- Appapi external microservices: External apps can run as micro services in any language using AppAPI [S8]
- Assistant: Assistant with self-hosted or cloud LLM options, transcription, email summaries, reply suggestions, Talk bot, OCR, scheduled tasks, subtitles, translation [S2]
- Benefits list: Microsoft Outlook · SharePoint · Windows Desktop · MS Office online server · Teams · Slack integrations · Tagging files · Smart picker links in Rich workspaces · Circles and Team folders [S1]
- Branding: yes [S7]
- Branding availability: Standard · Premium [S9]
- Branding theming: branded clients, MSI and MDM support, logo/colors/login graphics, custom links [S2]
- Bug bounty: bug bounty · 10000 · USD [S7]
- Case federal ministry: Microsoft 365 · 1200 · 5-10 months [S7]
- Case university: Microsoft 365 · 10,000 staff, 50,000 students · 12-24 months [S7]
- Cli encryption tools: yes [S5]
- Client e2ee: yes [S1]
- Client features: automatic upload of pictures and videos · synchronize selected files and folders · multiple accounts · activity display · notifications of new events [S1]
- Client required for virtual drive: unconfirmed user interpretation · yes [S13]
- Clients: Android · iOS · desktop [S1]
- Clustered support: yes · no · yes [S9]
- Collaboration features: password protected public links · federated share notifications · File Drop · file version restore · collaborative editing with Collabora Online [S2]
- Compliance apps: Configurable imprint and privacy links for login page · Data Request app for data deletion or modification requests · Delete Account app · Terms of Service app [S6]
- Confidential files: Automatic classification labels for files [S2]
- Context agent: Context Agent powering Assistant Unified Search [S2]
- Context chat: Context Chat with definable scope [S2]
- Cryptographic identity protection: certificate-based identity protection, Trust On First Use, keys can't change by default [S2]
- Dashboard: configurable dashboard widgets [S2]

**Subprocessors**
- Ac pm: Email delivery service (Postmark) · United States · EU-US Data Privacy Framework adequacy (Art. 45) [S12]
- Collabora: licenses and support for Nextcloud Office · United Kingdom [S12]
- Collabora EU only support: yes [S12]
- Hetzner: Hosting of portal.nextcloud.com · Germany [S12]
- Odoo: security information and updates · European Union [S12]
- Open xchange: licenses and support for Dovecot Pro · Germany [S12]
- Openproject: licenses and support for OpenProject · Germany [S12]
- Sendent: MS Outlook Add-in, MS Exchange Connector, MS Teams Integration · Netherlands [S12]
- Stalwart: licenses and support for Stalwart · United Kingdom [S12]
- Struktur: Nextcloud Talk High Performance Back-end and SIP bridge · Germany [S12]
- Thinkfree: licenses and support for Thinkfree Office · Republic of Korea [S12]
- Xwiki: licenses and support for XWiki · France [S12]
- Zammad: Provider of the Nextcloud support portal · Germany [S12]

**Support**
- Developer community channels: Talk room · forum category · e-mail newsletter [S8]
- Enterprise benefits: yes · yes · yes · 5-10 [S3]
- Language: English · yes [S9]
- Portal included: yes [S9]
- Premium reaction time: Premium · 1 business day [S9]
- Standard reaction time: Standard · 2 business days [S9]
- Timezone: 5x8 UTC+01:00 [S9]
- Ultimate reaction time: Ultimate · 1h · 4h · 12h · 24h [S9]

146 more facts on the canonical page: https://whats-best.ai/software/cloud-storage/nextcloud-files

## Questions

### Is Nextcloud Files (Nextcloud Hub) European?

Yes. whats-best.ai classifies Nextcloud Files (Nextcloud Hub) as EU-Made.

### Where does Nextcloud Files (Nextcloud Hub) store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

### Does Nextcloud Files (Nextcloud Hub) have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

### What are the best alternatives to Nextcloud Files (Nextcloud Hub)?

As of 1 Nov 2026, the panel rates [Tresorit (3.5/5)](https://whats-best.ai/software/cloud-storage/tresorit), [Proton Drive (3/5)](https://whats-best.ai/software/cloud-storage/proton-drive) and [DRACOON (3/5)](https://whats-best.ai/software/cloud-storage/dracoon) highest among the other 13 Cloud Storage & File Sharing products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Tresorit](https://whats-best.ai/software/cloud-storage/tresorit) (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Nextcloud Files (Nextcloud Hub) alternatives](https://whats-best.ai/software/cloud-storage/nextcloud-files/alternatives).

## Head-to-head

- [Nextcloud Files (Nextcloud Hub) vs Microsoft OneDrive for Business](https://whats-best.ai/compare/microsoft-onedrive-vs-nextcloud-files.md)

## What this page leaves out

- 10 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage (Nextcloud Files): https://nextcloud.com/files/ (checked 2026-11-01)
- [S2] Features page: https://nextcloud.com/features/ (checked 2026-11-01)
- [S3] Features page (Enterprise subscription): https://nextcloud.com/enterprise/ (checked 2026-11-01)
- [S4] Security / trust page: https://nextcloud.com/security/ (checked 2026-11-01)
- [S5] Features page (encryption and hardening): https://nextcloud.com/encryption/ (checked 2026-11-01)
- [S6] Security / trust page (compliance): https://nextcloud.com/compliance/ (checked 2026-11-01)
- [S7] Features page (migration): https://nextcloud.com/migrate/ (checked 2026-11-01)
- [S8] API and developer documentation: https://nextcloud.com/developer/ (checked 2026-11-01)
- [S9] Pricing page: https://nextcloud.com/pricing/ (checked 2026-11-01)
- [S10] Legal notice: https://nextcloud.com/impressum/ (checked 2026-11-01)
- [S11] Privacy policy: https://nextcloud.com/privacy/ (checked 2026-11-01)
- [S12] Data processing agreement (dpa): https://nextcloud.com/data-processing/ (checked 2026-11-01)
- [S13] Sync, clients & file access — found from sitemap: https://help.nextcloud.com/t/does-new-virtual-drive-desktop-client-have-to-run-for-accessing-offline-files/50482 (checked 2026-11-01)
- [S14] Sync, clients & file access — found from sitemap: https://help.nextcloud.com/t/desktop-sync-client-for-nextcloud/123620 (checked 2026-11-01)
- [S15] Sharing & external collaboration — found from sitemap: https://help.nextcloud.com/t/share-files-and-folders-to-external-collaborators/166781 (checked 2026-11-01)
- [S16] Sharing & external collaboration — found from sitemap: https://help.nextcloud.com/t/link-extern-mit-passwort-teilen/100885 (checked 2026-11-01)
- [S17] Encryption, key custody & recovery — found from sitemap: https://help.nextcloud.com/t/ransomware-recovery/44419 (checked 2026-11-01)
- [S18] Encryption, key custody & recovery — found from sitemap: https://help.nextcloud.com/t/reset-end-to-end-encryption-password/27519 (checked 2026-11-01)
- [S19] Administration, audit & governance — found from sitemap: https://help.nextcloud.com/t/admin-audit-logs-to-syslog/63532 (checked 2026-11-01)
- [S20] Administration, audit & governance — found from sitemap: https://help.nextcloud.com/t/admin-audit-app-for-monitoring-user-activity/58542 (checked 2026-11-01)
- [S21] Export, API & self-hosting — found from sitemap: https://help.nextcloud.com/t/export-all-share-for-migration/178179 (checked 2026-11-01)
- [S22] Export, API & self-hosting — found from sitemap: https://help.nextcloud.com/t/export-data-migration-tool-in-nc24/139024 (checked 2026-11-01)
- [S23] Self-hosting / on-premises installation docs — found from the homepage: https://nextcloud.com/install/ (checked 2026-11-01)
- [S24] Code repository (open-source licence) — found from the homepage: https://github.com/nextcloud (checked 2026-11-01)

---

Cite as: whats-best.ai, "Nextcloud Files (Nextcloud Hub) — Cloud Storage & File Sharing", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-storage/nextcloud-files

Corrections: https://whats-best.ai/correct/1211?target=page