Cloud Storage & File Sharing
STRATO HiDrive Business
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by STRATO GmbH · www.strato.de
Compare with luckycloud Business → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
STRATO HiDrive Business at a glance
- Vendor
- STRATO GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Starting price
- “HIDRIVE Starter 500 GB kostenlos für 1 Monat danach 3,50 €/Mon. Einrichtung: 0 €” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates STRATO HiDrive Business 2.5/5, the mean of 6 judges. STRATO HiDrive Business scores highest on sovereignty, at 6-7: STRATO GmbH of Berlin is the contracting entity, the captured pages state servers sit exclusively in German data centres, an Article 28 data processing agreement is published, and ISO 27001 confirmed by TÜV Nord and the Trusted Cloud seal are stated. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
STRATO HiDrive Business scores highest on sovereignty, at 6-7: STRATO GmbH of Berlin is the contracting entity, the captured pages state servers sit exclusively in German data centres, an Article 28 data processing agreement is published, and ISO 27001 confirmed by TÜV Nord and the Trusted Cloud seal are stated. That score is capped by documented facts: the privacy notice names Meta, LinkedIn, TikTok, Reddit and Google as recipients of SHA-256-hashed marketing data and permits transfers outside the EU and EEA. Portability and integrations follows at 4-6, the widest spread, split between crediting the included audriga-run migration and OAuth-secured REST API and weighing the undocumented bulk export, SDKs and webhooks. Encryption and security splits 4-5 over who holds the optional end-to-end keys; administration and governance is weakest at a flat 3, sharing and collaboration a flat 4. Plan prices are public — Starter 500 GB at 3,50 €/Mon. — but with no per-user or add-on figures a team's annual cost is not computable. The flagged splits came back showing none significant, so these splits stayed within tolerance.
Speaks for it
- Sovereignty scores 6-7, resting on STRATO GmbH of Berlin as contracting entity, a published Article 28 data processing agreement, and captured pages stating servers sit exclusively in German data centres.
- ISO 27001 certification confirmed by TÜV Nord plus the Trusted Cloud seal, with AES-256 over SSL, two-factor authentication and optional end-to-end encryption stated.
- A managed migration run with audriga and included in the HiDrive packages, from providers named on the pages including Dropbox, Google Drive and MagentaCLOUD, with status tracking and completion notice.
- Tool-independent access through a REST API with OAuth 2.0, S3-compatible storage and optional WebDAV/rsync, the basis of the 4-6 portability and integrations scores.
- Published plan prices — Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 €/Mon. für 12 Monate danach 5 €/Mon. — with 0 € setup, monthly billing and a one-month free trial cancellable at any time.
Held against it
- Administration and governance sits at a flat 3, with no public information on an admin console with roles, directory provisioning, exportable audit logs, retention policies or remote wipe.
- No public information on who holds the end-to-end encryption keys, key loss, version history length, a recycle bin, or restore to a point in time.
- The privacy notice names Meta, LinkedIn, TikTok, Reddit and Google as recipients of SHA-256-hashed marketing data and permits transfers outside the EU and EEA.
- An annual team cost is not computable, with tiers priced per plan and no public figure for additional users or the WebDAV/rsync and end-to-end encryption add-ons.
- The free transfer service caps single files at 2 GB with seven-day link validity and cannot send whole folders, and we found no public information on upload links, guest accounts, download limits or access logs for HiDrive.
Best for
- You need storage the captured pages place exclusively in German data centres, under a German contracting entity with a published Article 28 data processing agreement.
- You are moving in from Dropbox, Google Drive, MagentaCLOUD or IONOS HiDrive and want the included audriga-run managed migration.
- You are a small team wanting multi-user storage — team folders from two accounts, per-folder access rights, and Collabora browser editing included in every plan.
- Your workflows connect via API — the documented REST API with OAuth 2.0 and S3-compatible access drew the highest portability scores.
Avoid if
- Your compliance review cannot accept the privacy notice's transfers of SHA-256-hashed account data to Meta, LinkedIn, TikTok, Reddit and Google, or its permission for transfers outside the EU and EEA.
- You need to share whole folders or files above 2 GB by link — the free transfer service fixes links at seven days, caps single files at 2 GB, and cannot send whole folders.
- You must compute an annual bill for a team before signing — tiers are priced per plan and the captured pages show no per-user or add-on price.
- You administer a larger organisation — what the pages document for governance stops at team folders from two accounts and per-folder rights, with no public information on provisioning, audit logs or remote wipe.
The scores
| Criterion | Panel median |
|---|---|
| Sync, clients & file access | 2 of 5 |
| Sharing & external collaboration | 2 of 5 |
| Encryption, key custody & recovery | 2.5 of 5 |
| Administration, audit & governance | 1.5 of 5 |
| Export, API & self-hosting | 3 of 5 |
| European sovereignty | 3.5 of 5 |
| Pricing transparency | 2.5 of 5 |
Sync, clients & file access
Show reasoningHide reasoning
How this is scored
How files reach the people who work with them: desktop clients for Windows, macOS and Linux, files on demand (virtual drive) and selective sync, offline access, mobile apps with camera upload and offline folders, a web interface, block-level or delta sync for large files, sync of folders outside the main folder, file size limits, preview of common formats, full-text search, and access through open protocols (WebDAV, SFTP, S3) or a mounted network drive.
0 — Not a file storage or sync product; files cannot be stored and synced with it.
3 — A web interface and apps for some platforms to upload and download files; desktop sync, files on demand, offline access and limits are basic or not described.
5 — Desktop sync clients for Windows and macOS, files on demand or selective sync, mobile apps with offline files and camera upload, a web interface with previews, file size limits stated, and search by file name.
8 — Clients for Windows, macOS and Linux, a virtual drive with files on demand, block-level or delta sync documented, full-text search inside documents, access via WebDAV, SFTP or S3, large-file handling stated, and LAN sync or a performance figure for big folders.
10 — File access that a whole organisation runs on: every platform covered with feature parity stated, sync conflicts and their resolution documented, open protocols and a mountable drive on every desktop, search across content and metadata with OCR, and sync behaviour and limits published in technical documentation.
The IT Lead
Bidirectional sync with folder exclusion, mounting HiDrive as a drive or folder, WebDAV and rsync (bookable as an add-on), an S3-compatible object store, a free mobile app with document scanning, and a REST API are documented. We found no public information on which desktop platforms the sync client covers, files on demand, offline folders on mobile, block-level sync, search, or file size limits for the storage itself. 12 1 11 2
The Data Protection Officer
Bidirectional sync with the ability to exclude individual folders from synchronisation, mounting HiDrive as a drive or folder, a free mobile app that scans documents to PDF with text recognition, and S3-compatible object storage access are all documented. WebDAV and rsync exist but only as a chargeable add-on, and we found no public information on named desktop clients per platform, files on demand, previews, search, or offline folder behaviour. 12 1 2 11
The Architecture Practice Partner
The captured pages document sync software with bidirectional synchronisation, exclusion of individual folders from syncing, and mounting HiDrive as a drive or folder — the drive letter my CAD software needs — plus WebDAV and rsync as a bookable add-on and an S3-compatible object storage with fast transfer rates. We found no public information on files on demand, block-level sync for multi-gigabyte files, offline access on mobile devices, the platforms the desktop client covers, or stated file size limits for storage, so for a 25-person practice the picture stays incomplete. 12 1 11 2
The Tax Adviser
A sync program with bidirectional synchronisation, the ability to exclude individual folders, and HiDrive mountable as a drive or folder are documented, plus a free mobile app whose document scan with text recognition would suit my receipt intake. Access over WebDAV and rsync exists only as a paid add-on. I found no public information on desktop clients named per platform, files on demand, offline files, previews or search. 1 2 12
The Agency Producer
Sync software with bidirectional sync, folder exclusion and mounting HiDrive as a drive or folder is documented, plus free mobile apps for iOS and Android with document scanning and text recognition; WebDAV and rsync exist but only as a bookable add-on, and S3 compatibility belongs to the separate object storage. We found no public information on which desktop platforms the sync client covers, offline access, camera upload, previews, search or large-file performance — for a shop pushing 100 GB of raw footage that silence matters. 1 2 12 11
The Skeptic
Bidirectional desktop sync with folder exclusion and mounting as a drive or folder is described, alongside a free mobile app, scanning with text recognition to PDF and direct NAS support; WebDAV and rsync exist only as a bookable extra and the S3 access belongs to the separate object storage. We found no public information on files on demand, offline files on mobile, previews, search or the desktop platforms supported, and file limits are stated only for the free transfer service, where single files max out at 2 GB. 1 2 4 12
Sharing & external collaboration
Show reasoningHide reasoning
How this is scored
How files are shared inside the team and with people outside it: shared team folders or spaces, share links with password, expiry, download limits and view-only or no-download mode, upload links (file requests) for customers, guest or external user accounts, link and access reports, notifications, watermarking, comments and file locking, editing of office documents in the browser together, large-file transfer, and an Outlook or Teams add-in for sending links instead of attachments.
0 — Files cannot be shared with anyone else.
3 — Folders and files can be shared with other users and by public link; link controls, upload links and external accounts are basic or not described.
5 — Shared team folders, share links with password and expiry, view-only links, upload links for external people, permissions per folder (view, edit), notifications on changes, and office documents opened and edited in the browser.
8 — Link policies the administrator sets (forced expiry, passwords, domains allowed), download limits and no-download view, watermarking, guest accounts with their own permissions, an access log per share, file locking and comments, co-editing documented with the editor named, and an Outlook or Teams add-in.
10 — External collaboration at the level of a data room: granular rights including print and download control on shared files, revocation that also reaches copies already opened, recipient identity verification, a complete record of who opened and downloaded what, and end-to-end encryption kept intact when sharing externally and when editing.
The IT Lead
Team folders from two accounts, per-folder access rights, password protection, browser editing via Collabora, and a transfer service with automatic download links (2 GB, seven-day validity) are on the pages. We found no public information on upload links for customers, guest accounts with their own rights, download limits, watermarking, per-share access reports, or an Outlook add-in that sends links instead of attachments. 2 17 7 1 4
The Data Protection Officer
Team folders are automatically included from two accounts upwards, access rights can be distributed to selected people, password protection is offered, and HiDrive Office by Collabora provides browser editing of documents in every plan. We found no public information on upload links, view-only or no-download modes, guest accounts, access logs, file locking or comments for HiDrive itself; the free transfer service generates links valid seven days and deletes files automatically after seven days. 2 17 7 1 4
The Architecture Practice Partner
Team folders are included automatically from two accounts, access rights can be distributed to selected people, share links are generated automatically with password protection available, and Collabora-based HiDrive Office is included in all plans for browser editing. Link controls end at a fixed seven-day validity on the free send service with a 2 GB per-file limit and no whole-folder sending there, and we found no public information on download limits, view-only or no-download links, guest accounts, access logs, file locking or comments. 2 4 1 17 7
The Tax Adviser
Team folders come automatically from two accounts, rights can be distributed per folder, links sit behind password protection, and Collabora office editing is included in every plan; HiDrive Share generates download links valid seven days with no registration for the recipient, though whole folders cannot go that way and files are capped at 2 GB. What my practice actually needs is the reverse direction — clients sending me paidlips without installing anything — and I found no public information on upload links, configurable expiry, download limits, view-only mode, or a record of who downloaded what. 1 2 4 7 17
The Agency Producer
Team folders are included from two accounts with flexible access rights, HiDrive Share creates download links valid for seven days with password protection available, and Collabora-based office editing runs in the browser. The transfer service itself states a 2 GB file cap and, per its own note, sends selected files but not whole folders; we found no public information on upload links for customers, comments on files, watermarking or guest accounts — the daily review workflow with clients is not what these pages describe. 2 4 1 7
The Skeptic
Team folders come included from two accounts, access rights can be handed to selected people, and public download links carry a fixed seven-day validity with a two-gigabyte per-send cap, while browser editing runs on Collabora included in all plans. We found no public information on link passwords, sender-chosen expiry, view-only or download-restricted links, guest accounts, access logs, comments or file locking — and the free transfer service itself cannot send an entire folder. 1 2 4 17
Encryption, key custody & recovery
Show reasoningHide reasoning
How this is scored
How the files are protected and restored: encryption in transit and at rest, client-side or end-to-end encryption and whether it covers all folders, sharing and office editing, who holds the keys and what happens when a user loses theirs, customer-managed keys, two-factor authentication and single sign-on, version history and its length, a recycle bin, restore of a whole folder or account to a point in time after ransomware, ransomware detection, malware scanning, an independent security audit or penetration test, a bug bounty, and certifications (ISO 27001, SOC 2, BSI C5) with their scope. Where the data is stored is scored under sovereignty.
0 — Files are stored without any stated encryption and no account protection beyond a password.
3 — Encryption is mentioned and a recycle bin or version history exists; key custody, two-factor, restore after ransomware and audits are basic or not described.
5 — TLS in transit and AES encryption at rest stated, two-factor authentication, version history with its length stated, a recycle bin, the restore of deleted or overwritten files, and a security page naming at least one certification or audit.
8 — Client-side or end-to-end encryption documented with who holds the keys (or customer-managed keys), a whitepaper describing the scheme, single sign-on (SAML), restore of a folder or account to a point in time, ransomware detection or recovery documented, an independent audit or penetration test named, and ISO 27001, SOC 2 or BSI C5 stated with scope.
10 — Security that can be verified: zero-knowledge end-to-end encryption by default that stays on for sharing and editing, the cryptography published and externally audited with the report available, key recovery for organisations documented without the provider gaining access, open-source clients or a public bug bounty, and certifications published with their scope and date.
The IT Lead
AES-256 over SSL, optional end-to-end encryption, two-factor authentication, and ISO 27001 with TÜV Nord named are documented. We found no public information on key custody, version history length, a recycle bin, or restoring a share to a point in time after ransomware — the ransomware protection evidence concerns the separate Acronis Cyber Protect product, and that gap decides it for me. 1 5 18 11 16
The Data Protection Officer
AES-256 over SSL and optional end-to-end encryption are stated, two-factor authentication exists, and ISO 27001 certification through TÜV Nord plus the Trusted Cloud seal are published. We found no public information on who holds the end-to-end keys, what happens on key loss, whether encryption survives share links or the Collabora editor, version history length, a recycle bin, or restore to a point in time; the anti-malware wording with ransomware protection belongs to a separate Acronis-based product rather than the storage itself. 1 5 16 18 11 15
The Architecture Practice Partner
AES-256 over SSL for HiDrive Business, optional end-to-end encryption, two-factor authentication, redundant storage, and an ISO 27001 information management system certified by TÜV Nord plus the Trusted Cloud seal are all documented. Who holds the keys and what happens when a user loses one is not described, and we found no public information on version history length, a recycle bin, restore of a folder or account to a point in time, single sign-on, or the scope of the certifications. 16 1 5 18 11 2
The Tax Adviser
AES-256 over SSL, an optional end-to-end encryption, two-factor authentication, ISO 27001 confirmed by TÜV Nord and a vulnerability reporting channel are stated. The decisive point under §203 StGB: the end-to-end option is a single line with nothing on who holds the keys, what happens when a key is lost, or whether the protection survives sharing. I found no public information on version history length, a recycle bin, restore to a point in time after ransomware, or single sign-on for HiDrive itself. 1 5 11 16 18
The Agency Producer
AES-256 over SSL and optional end-to-end encryption are stated, two-factor authentication is included, and ISO 27001 certification, TÜV Nord and the Trusted Cloud seal appear on the trust pages. We found no public information on key custody, version history length, a recycle bin or ransomware recovery for HiDrive itself, so the level is solid middle ground. 1 5 16 18
The Skeptic
AES-256 over SSL, two-factor authentication and an optional end-to-end encryption are stated, and TÜV Nord certifies STRATO to ISO 27001, with the Trusted Cloud seal on top. That end-to-end encryption is optional and nothing documents who holds the keys or whether it survives sharing and browser editing; we found no public information on version history length, a recycle bin, single sign-on or a point-in-time restore. The anti-ransomware capability on offer is a separate Acronis product for Windows, licensed per machine. 2 5 11 15 16 18
Administration, audit & governance
Show reasoningHide reasoning
How this is scored
What an administrator controls: an admin console with users, groups and roles, provisioning through Entra ID, Google or LDAP with SCIM, quotas per user or team, an audit log of logins, shares and file actions with export, retention policies and legal hold, data loss prevention or classification, device management with remote wipe and unlinking, policies for external sharing, account transfer when someone leaves, team folders that belong to the company rather than to a user, and reports on storage and sharing.
0 — No administration: every account is independent and nobody can manage the team's users or files.
3 — A team plan with an administrator who can invite and remove users; roles, audit log, retention and device controls are basic or not described.
5 — An admin console with users, groups and admin roles, quotas, an activity or audit log, policies for external sharing, file transfer when a user leaves, company-owned team folders, and remote unlinking of lost devices.
8 — Provisioning via SCIM or a directory (Entra ID, Google, LDAP), an exportable audit log covering logins, shares and file actions, retention policies and legal hold, remote wipe, IP or device restrictions, data classification or DLP, and integration with a SIEM.
10 — Governance a regulated organisation can sign off: granular delegated administration per department or tenant, retention and legal hold with eDiscovery export, DLP with content inspection, every admin and user action logged and streamed to a SIEM, and the audit log retention and completeness stated.
The IT Lead
Multi-user accounts, team folders included from two accounts, and freely assignable folder rights are documented — small-team level. We found no public information on Entra ID or SCIM provisioning, an exportable audit log, retention or legal hold, quotas, remote wipe of a lost laptop, or transferring an account when someone leaves, which is exactly what I need for 180 people. 2 17 18
The Data Protection Officer
Several users with flexible access rights, team folders included from two accounts, and the ability to define folder structures and hand out access rights to selected people are documented. We found no public information on an admin console with roles, provisioning through a directory or SCIM, quotas, an audit log of logins, shares and file actions, retention policies or legal hold, or remote wipe and unlinking of devices. 2 17
The Architecture Practice Partner
The evidence shows multiple users per account, team folders automatically included from two accounts, folder structures with access rights assigned to selected people, and a customer control panel where data processing can be viewed and changed. We found no public information on an admin console with roles and groups, provisioning via a directory or SCIM, quotas, an exportable audit log of logins and file actions, retention policies, legal hold or device management with remote wipe. 2 17 9
The Tax Adviser
Multiple users, flexible access rights and company team folders from two accounts are documented, and the privacy policy states log files are kept a few days up to 60-90 days — that is a server log, not an exportable audit trail. For an office with eleven staff I found no public information on an admin console with roles and quotas, retention policies, device management with remote wipe, or provisioning from a directory. 2 9 17
The Agency Producer
Multiple users with flexible access rights and team folders included from two accesses give a basic team setup where I can hand folder rights to selected people. We found no public information on an admin console with roles and quotas, an audit log, retention policies or device management — nothing here for adding freelancers per project or seeing who downloaded what. 2 17
The Skeptic
The documented team administration amounts to team folders included from two accounts, flexible access rights and multiple users per package. We found no public information on an admin console with user and role management, provisioning, quotas, an audit log, retention policies, or device management with remote wipe. 2 17
Export, API & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the files and their structure can leave and connect: a bulk export or download of all data with folders and versions, open protocols (WebDAV, S3, SFTP) usable for migration, a documented REST API and SDKs, webhooks, migration tools from Dropbox, Google Drive, OneDrive or a file server, integrations with office suites, Microsoft 365 and Teams, Slack, CRM and project tools, an app marketplace, open-source code, a self-hosted or on-premise edition, and deletion of data on termination.
0 — Files can only be downloaded one by one; no export, API or migration path.
3 — Files can be downloaded in bulk or as an archive; an API, migration tools, integrations and self-hosting are basic or not described.
5 — A documented API, bulk download of all files with the folder structure, a migration path from at least one named provider, integrations with named office and collaboration tools, and what happens to data after cancellation stated.
8 — A REST API with SDKs and webhooks, open-protocol access (WebDAV, S3 or SFTP) that makes migration tool-independent, migration tools in both directions or a supported migration service, an app marketplace, a self-hosted or on-premise edition, and deletion on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export including versions, shares and permissions in a documented format, and the deletion of every copy and backup on termination documented.
The IT Lead
A REST API with OAuth 2.0, S3 compatibility, WebDAV and rsync, and a managed migration from Dropbox, Google Drive, MagentaCLOUD and other accounts — run with audriga and included in the packages — give us a clear way in. We found no public information on bulk export with versions, webhooks or SDKs, or deletion of data on termination. 1 11 12 18
The Data Protection Officer
A REST API with OAuth 2.0, S3 compatibility, and a managed migration into HiDrive from Dropbox, Google Drive, Telekom MagentaCloud, IONOS HiDrive and OneDrive — run by STRATO with audriga and included in the packages — are documented. We found no public information on bulk export of all files with folder structure and versions, SDKs, webhooks, an app marketplace, a self-hosted edition, or deletion of data on termination. 1 11 17 18 2 12
The Architecture Practice Partner
A RESTful web API with OAuth 2.0, WebDAV and rsync add-ons and S3-compatible access give tool-independent ways in and out, and STRATO runs a managed migration in collaboration with audriga from named providers including Dropbox, Google Drive and MagentaCLOUD, included in the HiDrive packages with status tracking and completion notification. We found no public information on SDKs, webhooks, an app marketplace, a self-hosted or on-premise edition, or what happens to the data after cancellation. 1 12 11 18 17
The Tax Adviser
A REST API with OAuth 2.0 is documented, and the migration service run with audriga from Dropbox, Google Drive, OneDrive, MagentaCLOUD or IONOS HiDrive is included in the packages with a status page and completion notice — a genuinely usable way to bring four hundred client folders across. WebDAV and rsync are bookable add-ons and the object storage is S3-compatible, so the way in is broad. I found no public information on webhooks, SDKs, bulk export with folder structure and versions, or a self-hosted edition, so the way out rests on the same protocols. 1 11 12 17 18
The Agency Producer
A RESTful API with OAuth 2.0, WebDAV and rsync as add-ons, S3-compatible object storage, and a managed migration from Dropbox, Google Drive, MagentaCLOUD and IONOS HiDrive that STRATO runs via audriga and includes in the packages — that migration service genuinely helps a move. We found no public information on SDKs, webhooks, an app marketplace or a self-hosted edition, and the named connections around the storage are NAS devices, FreeFileSync and IFTTT rather than Slack or project tools. 1 12 18 11
The Skeptic
A RESTful API with OAuth 2.0, S3 compatibility and bookable WebDAV/rsync make inbound migration tool-independent, and STRATO runs managed migrations from Dropbox, Google Drive, Telekom MagentaCLOUD and IONOS HiDrive via audriga, included in the packages and tracked on a status page. We found no public information on bulk export with folder structure and versions, SDKs, webhooks, an app marketplace, a self-hosted edition, or deletion of data on termination. 1 11 12 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where files, metadata and backups are stored and processed, and who the subprocessors are (data centres, CDN, email that carries share notifications, support desk, payment, office editing). Independently sourced by the sovereignty pipeline; files hold the company's documents and personal data, so the whole chain counts, not only the storage. End-to-end encryption with keys only the customer holds reduces what a foreign provider could hand over but does not change who the provider is. A self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, storage location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the storage location is unstated or non-EU and the subprocessors are not listed.
5 — EU storage available and an EU contracting entity or EU representative, but parts of the chain (account data, metadata, notifications, support, office editing, payment) run through non-EU providers without a stated safeguard, or the parent company is subject to non-EU disclosure laws.
8 — EU storage on named data centres, EU or EEA or Swiss contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or a self-hosted edition documented that keeps every file on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, storage and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The IT Lead
STRATO GmbH in Berlin is the contracting entity and controller, servers sit exclusively in German data centres, a data processing agreement is published, and ISO 27001 plus the Trusted Cloud seal are stated. We found no public information naming the individual data centres, and the privacy policy shows hashed marketing data going to Meta, LinkedIn, TikTok, Reddit and Google with transfers outside the EU/EEA under general safeguards — that caps it. 5 8 10 11 9 16
The Data Protection Officer
The contracting entity is STRATO GmbH in Berlin with commercial register, jurisdiction and data protection officer contact in writing, the vendor's captured pages state that servers sit exclusively in German data centres, an Article 28 data processing agreement is published at a public link, and ISO 27001 through TÜV Nord and the Trusted Cloud seal are stated. We found no public information on a subprocessor list with locations for the storage, support, payment or office-editing chain; the privacy notice itself names Meta, LinkedIn, TikTok, Reddit and Google as recipients of hashed marketing data, permits transfers outside the EU and EEA under general safeguards, and lists artificial-intelligence training as a processing purpose. 8 9 10 5 16 11
The Architecture Practice Partner
STRATO GmbH in Berlin is the contracting entity, controller and place of jurisdiction with a published Art. 28 data processing agreement, the servers sit exclusively in German data centres, and ISO 27001 certification plus the Trusted Cloud seal are stated, with the group rooted in IONOS SE and United Internet in Germany. The subprocessor picture is partial — marketing audiences are named with SHA-256 hashing before transmission, but the operational chain such as support, email and payment is not listed — and the privacy policy allows transfers outside the EU and EEA with safeguards. 5 16 8 9 10 11 2
The Tax Adviser
STRATO GmbH is a German company in Berlin with a published data processing agreement, states on several pages that servers sit exclusively in German data centres, and carries ISO 27001 confirmed by TÜV Nord plus the Trusted Cloud seal — the core of what I need for client files. What holds me back: the privacy policy allows transfers to countries outside the EU and EEA and names Meta, LinkedIn, TikTok, Reddit and Google as advertising partners receiving hashed account data, while the data centres carry no named locations and I found no public information on a full subprocessor list with locations for support, notifications or payment. 5 8 9 10 11 16
The Agency Producer
The provider is STRATO GmbH of Berlin, the captured pages state storage exclusively in German data centres, a data-processing agreement under Art. 28 GDPR is published, and ISO 27001 plus the Trusted Cloud seal are stated. The privacy notice, however, names marketing audiences shared after SHA-256 hashing with Meta, LinkedIn, TikTok, Reddit and Google, and states that transfers outside the EU and EEA can occur — the file chain reads as German, while parts of the account chain reach further. 5 8 9 16
The Skeptic
STRATO GmbH of Berlin is the contracting entity and data controller, storage is stated exclusively in German data centres, an Article 28 processing agreement is published, and ISO 27001 certification with TÜV Nord is named. The privacy policy nonetheless names Meta, LinkedIn, TikTok, Reddit and Google as recipients of SHA-256-hashed customer data for advertising and reserves transfers outside the EU under unspecified safeguards; we found no public information naming the individual data centres, the locations of subprocessors, or the scope of the certifications. 5 8 9 10 11 16
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or per plan, storage included per user or pooled, the minimum number of users, what extra storage costs, which features (end-to-end encryption, SSO, audit log, longer version history, data residency, advanced admin) need a higher tier or an add-on, the free tier and its limits, lifetime offers and their terms, the self-hosted edition's licence and support, minimum term and VAT.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, storage or features is unclear.
5 — Business tiers are public with their price per user and storage included, but at least one commonly needed piece (extra storage, SSO, audit log, data residency, minimum users) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (users, storage), extra storage and add-ons priced, minimum users and term stated, the self-hosted edition's licence and support cost stated, and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, storage need and feature set, with every add-on, migration, support and overage fee and the cancellation and data-return terms published.
The IT Lead
Every HiDrive plan is public with price, storage and a free first month — Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 €/Mon. for 12 months then 5 €/Mon., Plus 2 TB at 10 €/Mon., Family 2 TB at 15 €/Mon. — prices include VAT, billing is monthly, and payment and cancellation terms are stated. But we found no public figure for the WebDAV/rsync add-on, and no public information on per-user business pricing for a company our size, extra storage, or what the optional end-to-end encryption costs, so I cannot compute our annual cost. 17 18 12 10
The Data Protection Officer
Plan prices are public with storage included — Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 €/Mon. für 12 Monate danach 5 €/Mon., Plus 2 TB at 10 €/Mon. — with prices including VAT, zero setup fee, monthly billing, a one-month free trial cancellable at any time and a one-month notice period after the initial term. We found no public information on how cost scales with users for a team, extra storage prices for HiDrive, or the cost of the optional end-to-end encryption and the WebDAV/rsync add-ons, so an annual cost for a given team size is not computable from the captured pages. 16 17 18 1 12 10
The Architecture Practice Partner
Every HiDrive tier is published with storage and monthly price including VAT — Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 €/Mon. für 12 Monate danach 5 €/Mon., Plus 2 TB at 10 €/Mon., Family 2 TB at 15 €/Mon. — each with 0 € setup, monthly billing, one month's notice after the initial term, and a cancellable free trial month. What a team of 25 would pay per user, and the price of the WebDAV/rsync and end-to-end encryption add-ons, are not stated on the captured pages, so the real annual cost is not computable from what is public. 16 17 18 1 12 10
The Tax Adviser
The tiers are public and exact: Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 €/Mon. für 12 Monate danach 5 €/Mon., Plus 2 TB at 10 €/Mon., Family 2 TB at 15 €/Mon., each with Einrichtung: 0 €, prices including VAT, monthly billing and a one-month notice period. What I cannot compute for my office is the cost of what I would actually need: the WebDAV and rsync add-on is described only as "preisgünstig" hinzubuchbar with no figure, and I found no public information on a price for the optional end-to-end encryption or on per-user scaling beyond the two-account team-folder threshold. 1 10 12 16 17 18
The Agency Producer
Every plan is public with its storage and monthly price — 500 GB for 3,50 € per month, 1 TB at 0,50 € per month for 12 months then 5 €, 2 TB at 10 € — with setup at 0 €, prices including VAT, monthly billing and one-month notice. Pricing is per plan rather than per user, and we found no public information on what additional users cost or on prices for the end-to-end encryption and WebDAV add-ons, so the annual bill for a 30-person shop is not computable from these pages. 1 16 18 12
The Skeptic
All HiDrive tiers are public — Starter 500 GB at 3,50 €/Mon., Basic 1 TB at 0,50 € for twelve months then 5 €/Mon., Plus and Family 2 TB at 10 € and 15 € — with setup at 0 €, one-month trials, prices including VAT and one-month cancellation after the first term. Pricing is per package rather than per user while team folders arrive only from two accounts, the WebDAV/rsync extra is sold as "preisgünstig" with no figure, and per-gigabyte prices exist only for the separate object storage; we found no public information on the cost of the optional end-to-end encryption or additional storage for the file plans. 1 2 10 11 12 16 18
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about STRATO HiDrive Business
Is STRATO HiDrive Business European?
Yes. whats-best.ai classifies STRATO HiDrive Business as EU-Made.
Where does STRATO HiDrive Business store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does STRATO HiDrive Business have a free plan?
Yes. STRATO HiDrive Business has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to STRATO HiDrive Business?
As of 1 Nov 2026, the panel rates Nextcloud Files (Nextcloud Hub) (4/5), Tresorit (3.5/5) and Proton Drive (3/5) highest among the other 13 Cloud Storage & File Sharing products evaluated. The highest-rated European alternative is Nextcloud Files (Nextcloud Hub) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: STRATO HiDrive Business alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 51 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 24 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 22 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (HiDrive Business with pricing) www.strato.de Checked 1 Nov 2026 Details →
- 2 Features page (HiDrive overview) www.strato.de Checked 1 Nov 2026 Details →
- 3 Features page (HiDrive features) www.strato.de Checked 1 Nov 2026 Details →
- 4 Features page (file transfer) www.strato.de Checked 1 Nov 2026 Details →
- 5 Features page (encryption) www.strato.de Checked 1 Nov 2026 Details →
- 6 Documentation (help centre) www.strato.de Checked 1 Nov 2026 Details →
- 7 Security / trust page www.strato.de Checked 1 Nov 2026 Details →
- 8 Legal notice www.strato.de Checked 1 Nov 2026 Details →
- 9 Privacy policy www.strato.de Checked 1 Nov 2026 Details →
- 10 Terms of service www.strato.de Checked 1 Nov 2026 Details →
- 11 Sync, clients & file access — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 12 Sync, clients & file access — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 13 Sharing & external collaboration — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 14 Sharing & external collaboration — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 15 Encryption, key custody & recovery — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 16 Administration, audit & governance — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 17 Export, API & self-hosting — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 18 Export, API & self-hosting — found from sitemap www.strato.de Checked 1 Nov 2026 Details →
- 19 Self-hosting / on-premises installation docs — found from the homepage www.strato.de Checked 1 Nov 2026 Details →