whats-best.ai
Search Sign in

Cloud Storage & File Sharing

Nextcloud Files (Nextcloud Hub)

EU-Made Report an error

Panel rating · 6 judges · How to read the stars

Category median

Sovereignty: not determined

0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.

by Nextcloud GmbH · nextcloud.com

Compare with Microsoft OneDrive for Business → Report an error on this page Is this your product? →

Link to this page

Nextcloud Files (Nextcloud Hub): AI-assisted analysis on whats-best.ai Nextcloud Files (Nextcloud Hub): AI-assisted analysis on whats-best.ai (dark)

Add ?theme=dark to the image address for dark backgrounds. The badge shows the category and the month of the latest evaluation, and EU-Made where that is the product’s provenance. It never shows a score.

Nextcloud Files (Nextcloud Hub) at a glance

Vendor
Nextcloud GmbH
Headquarters
Not stated on the vendor’s pages as of 1 Nov 2026
Data hosting
Not stated on the vendor’s pages as of 1 Nov 2026
Free plan
Not stated on the vendor’s pages as of 1 Nov 2026
Panel verdict
The AI panel rates Nextcloud Files (Nextcloud Hub) 4/5, the mean of 6 judges. Persona-weighted totals run from 7.2 to 7.9. how scores are made
As of
Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources

Nextcloud Files (Nextcloud Hub) alternatives, European ones first →

Read this page as one judge. Each weighs the same scores by what they care about.

The Skeptic

Weighted verdict

Has seen "end-to-end encrypted" on a service that switches it off for shared folders, "hosted in Germany" on storage whose accounts and support run from the US, and "lifetime" plans from a company two years old. Reads that a product is "GDPR-compliant" and asks who holds the keys, whether ten years of folders, versions and shares can be exported in a form another provider imports — and what leaving would cost.

Same scores as the panel view — this lens weights them the way this judge cares.

Scored by The Skeptic

Panel median The Skeptic This judge’s scores over the panel median. Each label opens its reasoning below.
Scores per criterion, in stars out of 5
Criterion Panel median The Skeptic
Sync, clients & file access 3.5 of 5 3.5 of 5
Sharing & external collaboration 4 of 5 4 of 5
Encryption, key custody & recovery 4 of 5 4 of 5
Administration, audit & governance 3.5 of 5 3.5 of 5
Export, API & self-hosting 4 of 5 4 of 5
European sovereignty 4 of 5 4 of 5
Pricing transparency 3 of 5 3 of 5

Sync, clients & file access

How this is scored

How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.

0 — Not a file storage or sync product; files cannot be stored and synced with it.

3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.

5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.

8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.

10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.

Report an error

The Skeptic

Clients for Windows, Linux and Mac plus Android and iOS with automatic photo upload and selective sync are documented, a virtual drive keeps files visible on demand, and full-text search with ElasticSearch and a WebDAV API sit on the developer pages. What the captured pages never state is block-level or delta sync, file size limits, or a performance figure for large folders — precisely the technical depth an organisation with big data sets needs before committing. 1 2 3 8 13

Report an error

Sharing & external collaboration

How this is scored

How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.

0 — Files cannot be shared with anyone else.

3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.

5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.

8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.

10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.

Report an error

The Skeptic

Enforced passwords and expiry on links, hide-download, watermark-protected secure view, guest accounts, file locking, co-editing with Collabora Online named, an Outlook add-in, video verification and a virtual data room with DRM and audit log are all documented, and end-to-end encryption is documented to survive sharing a folder. One captured community exchange describes a share email going out immediately with the link unprotected until a password is set afterwards — a buyer should test that workflow before trusting the link governance story. 1 2 5 16

Report an error

Encryption, key custody & recovery

How this is scored

How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.

0 — Files are stored without any stated encryption and no account protection beyond a password.

3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.

5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.

8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.

10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.

Report an error

The Skeptic

End-to-end encryption is documented as a folder-level client option with a whitepaper, a zero-knowledge server and a 12-word mnemonic the user holds — and the captured pages state plainly that a lost mnemonic cannot be recovered, though administrators can create an offline master recovery key. TLS, server-side AES-256, enforcable two-factor including FIDO2, SAML SSO, a $10K bug bounty on HackerOne, fully open-source code and ANSSI CSPN, ISO/IEC 27001 and BSI IT-GRUNDSCHUTZ are listed, with the stated caveat that the compliance documents cover Nextcloud Enterprise only. Version history and restore exist but its length is not stated, and we found no public information on point-in-time restore after ransomware on these pages. 2 4 5 6 7 18

Report an error

Administration, audit & governance

How this is scored

What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.

0 — No administration: every account is independent and nobody can manage the team's users or files.

3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.

5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.

8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.

10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.

Report an error

The Skeptic

Directory provisioning from Active Directory, Azure AD and LDAP, a full audit trail written to a separate configurable log file, data retention rules, admin access rules by location, group and file type, automatic classification labels, team storage quotas and remote wipe without MDM are all documented. But we found no public information on legal hold, SCIM or SIEM streaming on the captured pages, and one community answer states that logging the admin audit app directly to syslog is not possible — so the SIEM story needs verification before a regulated buyer signs off. 2 3 7 19

Report an error

Export, API & self-hosting

How this is scored

Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.

0 — Files can only be downloaded one by one; no export, API or migration path.

3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.

5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.

8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.

10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.

Report an error

The Skeptic

The product is fully open source and self-hosted by design, with a RESTful API, a WebDAV API, an app store of 600+ apps and migration paths from Microsoft 365, Google Workspace, Box, Dropbox, DRACOON and ownCloud — the last with a dedicated migration service covering users, groups, guests and OAuth2 tokens. The catch for anyone planning an exit: a captured community answer says there is no general way to import or re-create shares on another system, and the user migration app must be installed first because it is not present in settings by default. We found no public information on SDKs, webhooks or data deletion on termination on these pages. 3 7 8 9 21 22

Report an error

European sovereignty

How this is scored

Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.

0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.

3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.

5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.

8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.

10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.

Report an error

The Skeptic

For the Enterprise subscription the vendor's own chain is disclosed subprocessor by subprocessor with locations and transfer mechanisms: mostly Germany (Hetzner, Zammad, Struktur, OpenProject, Open-Xchange) but also Postmark in the United States, Collabora and Stalwart in the United Kingdom and Thinkfree in Korea. That transparency plus a published data processing page and ISO/IEC 27001, BSI IT-GRUNDSCHUTZ and ANSSI CSPN is strong; it stops short of the top mark because parts of the vendor chain sit outside the EU under safeguards, and the push proxy and update server do call home — with documented alternatives. 1 3 6 9 10 12

Report an error

Pricing transparency

How this is scored

Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.

0 — No public prices at all; every customer is a sales call.

3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.

5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".

8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.

10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.

Report an error

The Skeptic

Tiers are public: Standard from 100 users at 71.29€/user/year, Premium at 104.99€/user/year and Ultimate at 204.75€/user/year, with 200-user steps of 53.17€, 81.99€ and 183.75€, prices stated as net/excl. VAT and a stated minimum of 100 users. Nowhere on the captured pricing pages could I find how much storage each user actually gets, what the "optional components" cost, or the minimum term — so the real annual cost for a given team size and storage need is not computable from public pages alone. 9

Report an error

European sovereignty — proven facts

0 of 6 dimensions proven

Built only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.

Hosting location Not determined — uncited Report an error
Hosting options Not determined ⚠ unverified — uncited Report an error
Open source Not determined ⚠ unverified — uncited Report an error
Data processing agreement Not determined — uncited Report an error
Transfer impact assessment Not determined — uncited Report an error

Questions about Nextcloud Files (Nextcloud Hub)

Is Nextcloud Files (Nextcloud Hub) European?

Yes. whats-best.ai classifies Nextcloud Files (Nextcloud Hub) as EU-Made.

Where does Nextcloud Files (Nextcloud Hub) store data?

Not stated on the vendor’s pages as of 1 Nov 2026.

Does Nextcloud Files (Nextcloud Hub) have a free plan?

Not stated on the vendor’s pages as of 1 Nov 2026.

What are the best alternatives to Nextcloud Files (Nextcloud Hub)?

As of 1 Nov 2026, the panel rates Tresorit (3.5/5), Proton Drive (3/5) and DRACOON (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Tresorit (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Nextcloud Files (Nextcloud Hub) alternatives.

Where this could be wrong

What we left out

A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.

Do you know more about Nextcloud Files (Nextcloud Hub)? Tell us Report an error on this page

Sources (24)

The pages every claim on this page was read from — each one checked, dated, and kept verifiable.

  1. 1 Vendor homepage (Nextcloud Files) nextcloud.com Checked 1 Nov 2026 Details →
  2. 2 Features page nextcloud.com Checked 1 Nov 2026 Details →
  3. 3 Features page (Enterprise subscription) nextcloud.com Checked 1 Nov 2026 Details →
  4. 4 Security / trust page nextcloud.com Checked 1 Nov 2026 Details →
  5. 5 Features page (encryption and hardening) nextcloud.com Checked 1 Nov 2026 Details →
  6. 6 Security / trust page (compliance) nextcloud.com Checked 1 Nov 2026 Details →
  7. 7 Features page (migration) nextcloud.com Checked 1 Nov 2026 Details →
  8. 8 API and developer documentation nextcloud.com Checked 1 Nov 2026 Details →
  9. 9 Pricing page nextcloud.com Checked 1 Nov 2026 Details →
  10. 10 Legal notice nextcloud.com Checked 1 Nov 2026 Details →
  11. 11 Privacy policy nextcloud.com Checked 1 Nov 2026 Details →
  12. 12 Data processing agreement (dpa) nextcloud.com Checked 1 Nov 2026 Details →
  13. 13 Sync, clients & file access — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  14. 14 Sync, clients & file access — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  15. 15 Sharing & external collaboration — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  16. 16 Sharing & external collaboration — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  17. 17 Encryption, key custody & recovery — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  18. 18 Encryption, key custody & recovery — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  19. 19 Administration, audit & governance — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  20. 20 Administration, audit & governance — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  21. 21 Export, API & self-hosting — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  22. 22 Export, API & self-hosting — found from sitemap help.nextcloud.com Checked 1 Nov 2026 Details →
  23. 23 Self-hosting / on-premises installation docs — found from the homepage nextcloud.com Checked 1 Nov 2026 Details →
  24. 24 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →