Cloud Telephony (VoIP & Cloud PBX)
3CX
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by 3CX Ltd. · www.3cx.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
3CX at a glance
- Vendor
- 3CX Ltd.
- Headquarters
- Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 5 Nov 2026
- Panel verdict
- The AI panel rates 3CX 3/5, the mean of 6 judges. 3CX is a software phone system and contact centre sold through a German imprint under 3CX Ltd of Nicosia, Cyprus, offered hosted or self-hosted. how scores are made
- As of
- Vendor pages captured 5 Nov 2026; evaluated by the panel 5 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
3CX is a software phone system and contact centre sold through a German imprint under 3CX Ltd of Nicosia, Cyprus, offered hosted or self-hosted. It scores highest on the contact centre, with skill-based queues, wallboards, SLA alerts, AI transcription and chat channels at no per-agent fee, and on integration and admin, with a documented REST configuration API and a separate call control API. Calling and routing holds a uniform 6. The weakest scores are apps and devices, where clients are documented but we found no public information on desk phone makers or devices for sale or rent, and network and compliance, which credits testing by Mandiant and HackerOne; we found no public information on an availability guarantee, a status page or ISO 27001. The judges split on sovereignty: the on-premises route with an on-premise transcription engine earns the top score, while hosted on Amazon, Google and Digital Ocean draws the low end. Pricing sits at 5-6, with edition prices public per simultaneous call but call costs resting on the trunk provider of your choice.
Speaks for it
- Contact centre included without per-agent fees, with skill-based queues, wallboards, SLA alerts and SMS, WhatsApp and live chat beside calls
- Documented REST configuration API (OData/OpenAPI) plus a separate Call Control API with WebSocket events, both requiring at least an 8SC AI licence
- Self-hosting documented on Windows or Linux on-premises or in a private cloud, with the transcription engine configurable on-premise
- Editions priced publicly per simultaneous call (24SC: BASIC €785, PRO €1,045, AI €1,425, with further figures in the same rows), a free tier for fewer than ten users, and a twelve-month purchase with no lock-in
- Security testing evidenced by Mandiant, ReversingLabs, Coverity and HackerOne, with a downloadable Mandiant assessment
Held against it
- The licence terms prohibit relying on the product as the sole means of contacting emergency services, and we found no public information on porting timelines
- We found no public information on number, porting, per-minute call or device prices, as the vendor states it is not a telecom provider and calls run through a SIP trunk provider of your choice
- We found no public information on an availability guarantee with credits, a public status page or ISO 27001 certification
- Hosted instances run on Amazon, Google and Digital Ocean infrastructure; we found no public information on hosting regions or a subprocessor list with locations
- We found no public information on desk phone makers with automatic provisioning or on devices for sale or rent
Best for
- You want a contact centre with queues, wallboards and SLA alerts built into the PBX licence at no per-agent fee
- Your administrators will drive configuration and automation through the documented configuration and call control APIs
- You can run the system self-hosted on your own Windows or Linux servers or a private cloud, keeping transcription on-premise
- You are ready to choose and manage your own SIP trunk provider and port your numbers to it
Avoid if
- You want one vendor for system, numbers and calls — the licence terms state 3CX is not a telecom or SIP trunk provider
- You need the phone system as your sole means of reaching emergency services — the licence terms prohibit that use
- You are a regulated financial firm expecting the standard hosted service to satisfy DORA without a separate signed addendum
- Your workplace depends on desk phones or DECT handsets — the captured pages position the web client as a desk-phone replacement
The scores
| Criterion | Panel median |
|---|---|
| Calling, numbers & call routing | 3 of 5 |
| Apps, desk phones & Microsoft Teams | 2 of 5 |
| Call centre, analytics & AI | 3.5 of 5 |
| CRM integration, API & administration | 3.5 of 5 |
| Reliability, call security & telecoms compliance | 2.5 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 2.5 of 5 |
Calling, numbers & call routing
Show reasoningHide reasoning
How this is scored
What the phone system does with a call: local geographic numbers in the customer's own area code and in other countries, number blocks and porting of existing numbers, extensions, IVR menus, queues, ring groups and hunt groups, time-based and holiday routing, call forwarding and transfer, voicemail to email, fax to email, conference calls, call recording, call park and pickup, busy lamp fields, caller ID per user or team, and emergency calls (110 and 112) with the caller's location.
0 — Places no phone calls on the public telephone network; a chat or meeting tool with internal calling only.
3 — Phone numbers and extensions with forwarding and voicemail; IVR, queues, time-based routing and porting are basic or not described.
5 — Local numbers in the customer's area code with porting documented, IVR menus, queues and ring groups, time-based and holiday routing, voicemail to email, call transfer and pickup, call recording, fax or fax to email, and emergency calling described.
8 — Number blocks and international numbers in many countries, a visual call flow editor, skills or priority routing, call park and busy lamp fields, recording rules per user or queue with consent announcements, emergency calls with a registered location per user or site, and the porting process and its timelines documented.
10 — Call handling a large multi-site company runs on: every feature above with number provisioning and porting by API, routing by caller data from the CRM, location-aware emergency calling for home offices, and the full feature set documented per plan with its limits.
The Office Manager
Keeping our letterhead number is documented — porting to a SIP trunk provider of our choice — and the greeting, queues, business-hours routing and voicemail to email for users, groups and even queues with WAV or MP3 attachments are all described, plus blind and announced transfer, recording and an integrated fax server. The Call Flow Designer and skills-based routing go beyond what we need. What holds it back for a switch without a gap: no porting timelines are described, and the terms state the product must not be used as the sole means of contacting emergency services. 5 12 13 14 16 8 10
The IT Administrator
IVR with DTMF navigation, voice prompts and text-to-speech, queues with ring groups, business-hours routing, voicemail to email with WAV or MP3 attachments, blind and announced transfer, recording, an integrated fax server and a Call Flow Designer for complex scenarios are all documented, and porting is addressed by keeping your existing numbers with a SIP trunk provider of your choice. What caps it for my three sites: the vendor states it is not a telecom provider, so the numbers and the trunk are the customer's own — no number blocks or international number supply of the vendor's, no porting timelines — and on emergency calls the only statement I find is the licence term that the product must not be the sole means of contacting emergency services, with nothing on location-based routing for home offices. 5 10 12 13 14 16
The Contact Centre Lead
IVR with text-to-speech and recorded prompts, ring groups, business-hours routing, voicemail-to-email per user, group and queue, an integrated fax server, blind and announced transfer and call recording are all documented. Porting means moving my numbers to a SIP trunk provider of my choice, and the terms state 3CX is not a telecom provider, so number provisioning, number blocks and emergency-calling handling are not described on these pages. 12 13 16 14 8 5 10
The Inside Sales Lead
IVR with speech menus, business-hours routing, queues and ring groups, voicemail to email, blind and announced transfer, ad-hoc conferences, call recording and an integrated fax server are all documented, and existing numbers can be ported to the SIP trunk provider of my choice. What holds it back for my DACH team: the vendor states it is not a telecoms provider, so local numbers, number blocks and per-minute rates come from a third-party carrier, and we found no public information on emergency calling with a registered location, call park and pickup, or porting timelines. 12 13 5 14 8 16 10
The Data Protection Officer
Routing is documented in breadth: IVR menus, queues and ring groups, business-hours routing, voicemail to email with WAV or MP3 attachment, blind and announced transfer, call recording, an integrated fax server, and porting of existing numbers to a SIP trunk provider of your choice — with a visual call flow designer, skill-based routing and busy lamp fields beyond that. We found no public information on emergency calls with a registered location, number blocks, international numbers or consent announcements before recording; the licence terms instead prohibit relying on the product as the sole means of reaching emergency services and place recording consent, retention and access control on the licensee. 5 8 10 12 13 14 16
The Skeptic
The routing core is genuinely documented: IVR with DTMF and text-to-speech, round-robin, longest-idle and skill-based queue strategies, DID-based routing, ring groups, business-hours routing, voicemail to email per user, group and queue, blind and announced transfer, recording and an integrated fax server. But 3CX itself states it is not a telecom or SIP trunk provider — numbers and porting sit with a trunk provider of the customer's choice, porting timelines are undocumented, and the licence terms prohibit relying on the system as the sole means of reaching emergency services, which is exactly the part a buyer cannot outsource. 12 16 13 14 8 5 10
Apps, desk phones & Microsoft Teams
Show reasoningHide reasoning
How this is scored
Where the calls are made and taken: desktop and mobile softphone apps, a browser client, presence, desk phones and DECT handsets from named makers (Yealink, Snom, Gigaset, Poly, Cisco) provisioned automatically, devices for sale or rent, the mobile phone as an extension with the company number shown, fixed-mobile convergence, Microsoft Teams calling through Direct Routing or Operator Connect, headset support, and the apps' ratings and update notes.
0 — No app and no device support; calls only through hardware the customer configures by hand.
3 — A softphone or mobile app; desk phones, Teams calling and the company number on mobile are basic or not described.
5 — Desktop, mobile and browser apps with presence, desk phones from named makers provisioned automatically, the company number shown on outgoing mobile calls, call handover between devices, and a Microsoft Teams integration or connector.
8 — A list of supported desk and DECT phones with auto-provisioning documented, devices sold or rented, Microsoft Teams calling through Direct Routing or Operator Connect with certification stated, fixed-mobile convergence with a SIM or mobile network, and app features documented per platform.
10 — Every endpoint a workforce uses, managed from one place: desk, DECT, mobile, browser and Teams with feature parity stated, device fleet management and firmware updates from the portal, and the app's accessibility and offline behaviour documented.
The Office Manager
Native apps for Windows, iOS and Android, a browser client with presence, and Microsoft Teams Direct Routing are all documented, and the Windows app can even drive our desk phones. But the captured pages name no desk phone makers with automatic provisioning, show no devices for sale or rent, and we found no public information on the company number appearing on outgoing mobile calls or handover between devices. 13 14 15 8 21
The IT Administrator
Windows, macOS, Linux, iOS and Android apps plus a browser client with presence and BLF panels are documented, the Windows app is native and store-distributed with admin PnP provisioning, and Microsoft Teams Direct Routing is listed as an integration. For my production halls, however, I find no public information on DECT handsets or desk phones from named makers with automatic provisioning — the vendor even positions web apps as a desk-phone replacement — and nothing on the company number shown on mobile calls or fixed-mobile convergence. 6 8 13 14 15
The Contact Centre Lead
Windows, macOS, Linux, iOS and Android clients plus a browser client with presence and per-status forwarding are documented, the web client is marketed as a desk-phone replacement, and Microsoft Teams Direct Routing is listed. We found no public information on a supported desk phone list from named makers with auto-provisioning, on the company number shown on outgoing mobile calls, or on call handover between devices. 13 14 15 8 3 21
The Inside Sales Lead
Windows, macOS and Linux desktops, iPhone and Android apps, a browser client with presence and a busy-lamp panel, and Microsoft Teams Direct Routing are documented, and the Windows app can control my desk phone with plug-and-play provisioning. We found no public information on desk phone makers by name, on the company number shown on outgoing mobile calls — which my reps need at trade fairs — on devices for sale or rent, or on fixed-mobile convergence. 14 15 13 8 21 12
The Data Protection Officer
Native apps for Windows, iOS and Android, a browser client with presence and status-based call rules, desk-phone control from the Windows softphone and Microsoft Teams calling through Direct Routing are documented. We found no public information on desk phones or DECT handsets from named makers with automatic provisioning, devices for sale or rent, or the company number shown on outgoing mobile calls. 3 8 14 15
The Skeptic
Windows, macOS, Linux, iOS and Android clients plus a browser app with presence, a busy-lamp field panel, notifications when the web app is closed, control of the desk phone from the Windows app and Microsoft Teams Direct Routing are all documented. We found no public information on supported desk phone makers and their auto-provisioning, devices for sale or rent, Teams certification, fixed-mobile convergence, or the company number shown on outgoing mobile calls — so the endpoint story stops at the softphones. 13 14 15 8 21
Call centre, analytics & AI
Show reasoningHide reasoning
How this is scored
How a team that lives on the phone is run: ACD queues with skills and priorities, agent states and wrap-up time, a wallboard, live monitoring with listen, whisper and barge, callbacks instead of waiting, outbound and power dialers, call statistics and reports per agent and queue, missed-call handling, AI transcription, summaries and sentiment, an AI receptionist or voicebot, and SMS or WhatsApp beside calls.
0 — No queues or call statistics of any kind; calls ring until someone answers.
3 — A simple queue and a call history; agent states, live monitoring, reports and AI features are basic or not described.
5 — Queues with agent log-in and log-out, wrap-up time, a wallboard or live view, call statistics per agent and queue, missed-call lists with callback, call recording for coaching, and AI transcription or summaries offered.
8 — Skills-based routing, listen, whisper and barge, callback in queue, outbound or power dialers, scheduled and exportable reports, AI transcription, summaries and sentiment with the languages listed, an AI receptionist or voicebot, and SMS or messaging channels beside calls.
10 — A contact centre that replaces a separate suite: workforce management and quality scoring, omnichannel routing, real-time AI coaching, and every AI feature documented with its model provider, data handling and an opt-out.
The Office Manager
For the deadline weeks we get queues with Round Robin, longest-idle and skills-based distribution, SLA alerts, live wallboards and real-time statistics, and the contact centre is included without per-agent charges. AI transcription, summaries and sentiment are documented with the engines named, alongside voicebots, an AI reception and routing of email, chat, WhatsApp and social media. We found no public information on listen, whisper and barge supervision, callbacks from the queue, wrap-up time or scheduled exportable reports. 16 4 8 17 2
The IT Administrator
Skill-based and round-robin queues with wallboard, real-time statistics, SLA alerts, switchboard, reports on wait times and resolution rate, call recording, AI transcription with summaries and sentiment via Google, OpenAI or an on-premise engine, voicebots, and live chat, SMS and WhatsApp routing are all documented with no per-agent fee. The operational detail my service team would ask about is thin: agent states and wrap-up time, listen/whisper/barge, callback in queue and scheduled or exportable reports are not described, and a dialer appears only as a sample application for the call control API. 4 8 16 17
The Contact Centre Lead
Skills-based routing with round robin, longest idle and least occupied, live wallboards with real-time queue statistics, call centre reports, SLA alerts, and AI transcription, sentiment and automated summaries configurable per department, user or queue with an on-premise engine option are documented, alongside voicebots and SMS, WhatsApp and live chat. Live supervision appears only as a generic call-monitoring mention without listen, whisper and barge named, and we found no public information on callbacks offered from the queue. 16 4 8 17 15 3
The Inside Sales Lead
Queues with skill-based, round-robin, longest-idle and least-occupied distribution, SLA alerts, wallboards with real-time statistics, reports on wait times and resolution rates, AI transcription, summaries and sentiment with the providers named, AI reception and voicebots, and SMS, WhatsApp and live chat beside calls are all documented. A dialer appears only as a do-it-yourself example application on the Call Control API, and we found no public information on listen, whisper and barge, callback in queue, or scheduled exportable reports. 16 8 4 17 19 12
The Data Protection Officer
The contact centre covers skill-based routing with four queue strategies, wallboards and real-time statistics, call-centre reports, AI transcription with sentiment analysis and automated summaries, an AI receptionist and voicebots, plus SMS, WhatsApp and live chat beside calls. The transcription providers are named — OpenAI/Whisper, a 3CX engine, Google Cloud, and Grok for mailbox transcription — but we found no public information on listen, whisper and barge, callback in queue, or the languages supported. 4 8 16 17
The Skeptic
Skills-based and round-robin queues, wallboards, real-time statistics, SLA alerts, reports on wait times and resolution rate, recording start/stop, SMS, WhatsApp and live chat, voicebots, AI agents for reception, and transcription and summaries through Google, OpenAI or an on-premise engine are documented, with no per-agent fees. Listen, whisper and barge and callback in queue are things we found no public information on, and outbound dialing appears only as an API example application rather than a product feature. 16 4 8 17 12 19
CRM integration, API & administration
Show reasoningHide reasoning
How this is scored
How the phone system fits the company: integrations with CRM and helpdesk tools (Salesforce, HubSpot, Pipedrive, Zendesk, Microsoft Dynamics) with click-to-call, caller pop-ups and automatic call logging, a documented REST API and webhooks for call events, SIP trunks for an existing PBX and bring-your-own-carrier, an admin portal with roles, single sign-on (SAML) and SCIM, two-factor authentication, multi-site and multi-company set-up, bulk user import, audit logs, and partner or reseller accounts.
0 — No integrations and no administration beyond one login per number.
3 — A web portal to manage users and numbers and one or two integrations; the API, roles and SSO are basic or not described.
5 — Integrations with the common CRM and helpdesk tools with click-to-call and call logging, a documented REST API and webhooks, an admin portal with roles, two-factor authentication, several sites in one account, and SIP trunking or a connection to an existing PBX.
8 — Caller pop-ups and call data written to the CRM record, an API covering users, numbers, routing and call records, single sign-on (SAML) and SCIM provisioning, audit logs, bulk import and templates, partner or reseller accounts with sub-customers, and SIP trunks documented for named PBX systems.
10 — Administration that scales across many sites and companies: every setting reachable by API with parity stated, granular roles per site and team, SSO enforced with SCIM, audit logs exportable to a SIEM, and a partner portal with white-label and separate billing.
The Office Manager
Click-to-call, caller-ID lookup into the CRM record and automatic call logging are documented for Microsoft 365, Salesforce and more, and the configuration API is documented in real depth — REST-based on OData and OpenAPI, covering users, departments, call forwarding and nearly every configuration aspect — with a separate call control API and WebSocket events. The admin console with roles, two-factor and Google or Microsoft 365 single sign-on covers our house. Single sign-on via SAML, SCIM provisioning, audit logs, bulk import and partner or reseller accounts are not described on the captured pages. 18 19 4 8 14 2
The IT Administrator
Strongest area for me as an administrator: a REST configuration API built on OData and OpenAPI covers departments, users, call forwarding and system extensions — described as programmatically controlling nearly every configuration aspect — beside a separate Call Control API with WebSocket events, plus Microsoft 365 integration in full or user-sync mode with single sign-on, CRM pop-ups with caller lookup and data sync to MS 365 and Salesforce, roles such as system owner and administrator, two-factor via security PIN, IP-restricted admin access and multi-tenant operation. Below the top because single sign-on is documented only through Google and Microsoft 365 accounts — I found no public information on SAML or SCIM provisioning — and none on audit logs, bulk import templates or partner and reseller accounts. 2 4 8 18 19 21
The Contact Centre Lead
Caller-ID lookup opens the CRM record, call data syncs back, click-to-call works from CRM and website, and helpdesk, ERP, Zapier and Make are listed; a REST configuration API (OData/OpenAPI) plus a Call Control API with WebSocket events are documented, though both require at least an 8SC AI licence. Roles like system owner and administrator, Google and Microsoft 365 single sign-on, IP restrictions and two-factor authentication are described, while SAML with SCIM provisioning and audit logs are not described on the captured pages. 4 15 13 18 19 8 21
The Inside Sales Lead
Click-to-call from the CRM by right click, caller-ID lookup that opens the CRM record and syncs call data, call logging, a documented REST configuration API covering users, departments and forwarding, a Call Control API with WebSocket events, SIP trunking with setup guides and templates, roles, two-factor authentication and Google or Microsoft 365 single sign-on are documented. Salesforce and Microsoft 365 are the CRMs named — HubSpot, which my team lives in, is not — and we found no public information on SAML single sign-on, SCIM provisioning, audit logs or bulk user import. 15 19 4 18 5 14 21 6
The Data Protection Officer
CRM integrations with named systems (Microsoft 365, Salesforce) deliver click-to-call, caller lookup and call logging; a REST configuration API and a call control API with WebSocket events, roles from system owner down, two-factor authentication, single sign-on with user synchronisation via Google and Microsoft 365, multi-tenant operation and SIP trunking with bring-your-own carrier are all documented. We found no public information on SAML, SCIM provisioning, audit logs, bulk import or partner and reseller accounts. 2 5 14 15 18 19
The Skeptic
A REST configuration API based on OData and OpenAPI covering departments, users, call forwarding and system extensions, plus a separate Call Control API with WebSocket events, documented token handling and a public example repository, sits beside click-to-call, caller-ID lookup that opens the CRM record, Microsoft 365, Salesforce, helpdesk, ERP, Zapier and Make connectors, single sign-on via Google or Microsoft, roles, a two-factor PIN, IP restrictions, multi-tenant operation and setup templates for SIP trunk providers. Single sign-on via SAML, SCIM provisioning, audit logs and bulk user import are things we found no public information on. 18 19 15 4 8 14 21 5
Reliability, call security & telecoms compliance
Show reasoningHide reasoning
How this is scored
Whether the service holds on a bad day and in an audit: redundant data centres and carrier connections, a stated availability or SLA with credits, the vendor's own public status page and incident history, call quality measures (codecs, quality monitoring), encryption of signalling and media (TLS and SRTP), registration as a telecoms provider with the national regulator (Bundesnetzagentur or its EU equivalent), the secrecy of telecommunications, recording consent and retention, emergency call handling for remote users, fraud protection against toll fraud, and security certifications such as ISO 27001.
0 — Nothing on availability, security or the provider's status as a telecoms operator.
3 — A claim of high availability or "German data centres"; encryption, the SLA, the status page and regulatory status are basic or not described.
5 — Redundant data centres named by country, a public status page, TLS and SRTP encryption offered, the provider's registration with the national regulator or the carrier behind the numbers stated, a stated availability, and call recording rules described.
8 — An SLA with credits published, the incident history public, encryption on by default with the protocols documented, ISO 27001 or comparable certification with its scope, toll fraud protection and spending limits, emergency calls from softphones and home offices documented, and retention of recordings and call records stated.
10 — Carrier-grade operation evidenced: geo-redundant platforms with failover tested and published, end-to-end encryption options, independent audits (ISO 27001, BSI C5 or SOC 2) with reports available, and the regulatory and lawful-interception obligations explained in plain language.
The Office Manager
Media encryption is properly documented — SRTP with AES per RFC 3711 — and there are named security partners with a downloadable Mandiant assessment, anti-hacking features, a firewall checker, IP restrictions, integrated failover with a standby licence, nightly backups and 24/7 monitoring. But we found no public information on an availability figure or SLA with credits, a status page or a certification with its scope, and the terms state plainly that 3CX is not a telecoms provider while the product must not be the sole means of contacting emergency services. 20 6 3 8 21 10
The IT Administrator
SRTP with AES, replay protection and message authentication per RFC 3711 is documented in depth, the hosted service runs with 24/7 monitoring, nightly backups, security patches and integrated failover plus a standby licence, and the security programme is unusually well evidenced through Mandiant, ReversingLabs, Coverity and HackerOne with a downloadable product security assessment. For an audit, though, I found no public information on a stated availability or SLA with credits, a public status page, ISO 27001 or comparable certification, toll-fraud spending limits, or emergency-call handling for remote users beyond the licence restriction — and the vendor itself states it is not a telecom provider, so regulator registration sits with whichever trunk provider I choose. 3 6 10 14 20 21
The Contact Centre Lead
SRTP with AES per RFC 3711 is documented, integrated failover and a standby licence exist, managed hosting runs on named hyperscalers with 24/7 monitoring and nightly backups, and an anti-hacking feature, password and IP restrictions, 2FA and a downloadable Mandiant assessment show real security work. We found no public information on a stated availability or SLA with credits, a status page or ISO 27001 certification, and recording consent duties rest with the licensee while emergency reach runs through the trunk provider I choose. 20 8 3 21 6 10
The Inside Sales Lead
SRTP with AES, replay protection and message authentication is documented in depth, every release is scanned by Coverity and ReversingLabs with a downloadable Mandiant assessment and a HackerOne bug bounty, and hosted customers get 24/7 monitoring, nightly backups, failover and a standby licence. Recording consent, retention and update installation are squarely the customer's responsibility and the vendor states it is not a telecoms provider; we found no public information on a stated availability, an SLA with credits, a public status page, or emergency calling from home offices. 20 6 3 8 10 11 21
The Data Protection Officer
Media encryption is documented in depth — SRTP to RFC 3711 with AES by default, replay protection and message authentication — and managed hosting runs with 24/7 monitoring, nightly backups, automatic security patches and integrated failover, checked externally by Mandiant, ReversingLabs, Coverity and HackerOne. The licence terms state that 3CX is not a telecoms provider and place recording consent and retention on the licensee; we found no public information on an SLA, a public status page, a stated availability figure, data-centre locations or ISO 27001 certification. 3 6 8 10 20
The Skeptic
SRTP per RFC 3711 with AES and replay protection, TLS for voicemail email, an integrated SBC, failover and standby licences, 24/7 monitoring with nightly backups, and testing by Mandiant, ReversingLabs, Coverity and HackerOne with a downloadable assessment show real engineering effort. But we found no public information on an availability guarantee with credits, a status page, ISO 27001 or comparable certification, or retention periods for recordings; 3CX states it is not a telecom provider, leaves recording consent to the licensee, and prohibits relying on the system for emergency services — when the platform is down, nothing on the captured pages says who pays. 20 13 8 3 6 21 10
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where call records, voicemails, recordings, transcripts, contacts and account data are stored and processed, which carriers carry the calls, and who the subprocessors are (hosting, carriers and number providers, SMS gateways, AI transcription and summary models, email delivery, support and payment tools). Independently sourced by the sovereignty pipeline. International numbers and carriers needed to reach other countries are part of what the product does and are not counted against it; where the data is stored and who processes it is. A self-hosted phone system the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI transcription, SMS, support, payment) run through non-EU providers without a stated safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting, carriers and every subprocessor including the AI models, or a self-hosted edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Office Manager
There is a German entity — 3CX GmbH registered at the Hanover district court — under a Cyprus parent, a published data processing addendum with Article 28 guarantees, and standard contractual clauses for transfers outside the EU. Hosted instances run on Amazon, Google and Digital Ocean infrastructure with no region stated, transcription runs through Google, OpenAI or Grok unless configured on-premise, and no subprocessor list with locations is published. The documented self-hosting option — on-premises or in a private cloud, with an on-premise transcription engine and a full data sovereignty claim — is what keeps this score where it is. 9 10 11 3 8 17 1
The IT Administrator
A German entity (3CX GmbH, Hanover) sells it, but the default contracting party is 3CX Ltd in Nicosia, Cyprus — inside the EU, yet under Cypriot law and Nicosia courts — while managed hosting runs on Amazon, Google and Digital Ocean hyperscalers with no region named and transcription can run through Google or OpenAI, mitigated by standard contractual clauses and a published data processing agreement. The saving grace for a German machine builder is the documented self-hosting route: on-premises Windows or Linux or a private cloud for, in the vendor's words, full data sovereignty, with the transcription service configurable on-premise. I found no public information on a subprocessor list with locations or on ISO 27001 certification, so sovereignty end to end is not evidenced. 1 2 3 8 9 10 11 17
The Contact Centre Lead
Contracts default to the Cyprus parent with a German company in the imprint, a data processing agreement is published with standard contractual clauses for transfers outside the EU, and a self-hosted edition on our own servers or private cloud, including an on-premise transcription engine, is documented with a full-data-sovereignty claim. Hosting regions for the managed service and a complete subprocessor list are not published, and the named cloud transcription engines are Google, OpenAI and Grok. 9 10 11 2 3 1 17 8
The Inside Sales Lead
The German imprint shows a German GmbH under an EU parent in Cyprus, a data processing agreement is published with Article 28 guarantees and standard contractual clauses for transfers, and self-hosting on-premises or in my own cloud — with transcription configurable on-premise — is documented as the full data sovereignty route. We found no public information on where the managed hosting actually runs (the providers Amazon, Google and DigitalOcean are named, their regions are not), on a subprocessor list with locations, or on a recognised security certification. 9 10 11 2 3 17 1
The Data Protection Officer
A data processing agreement is published, the German company and its Cypriot parent are identified in the imprint, and a full on-premises deployment — with the transcription engine also installable on-premise — is documented, which is how I would run patient calls. The hosting hyperscalers (Amazon, Google, Digital Ocean) and the AI transcription providers (Google, OpenAI, Grok) are named, but we found no published subprocessor list with their locations, no hosting region for the managed service, and no ISO 27001 or SOC 2 certification. 1 2 3 8 9 10 17
The Skeptic
The default contracting entity is 3CX Ltd in Nicosia, Cyprus — inside the EU — with a German 3CX GmbH in the imprint, a published data processing addendum, Article 28 processor guarantees and standard contractual clauses for transfers outside the EU, and a self-hosted edition on Windows, Linux or a private cloud documented for full data sovereignty. Against that, the hosted service runs on Amazon, Google and Digital Ocean infrastructure with no region stated, transcription can run through Google, OpenAI or Grok, and the terms allow the contracting entity to be 3CX USA Corp. under Florida law or 3CX Software FZCO; we found no public information on hosting regions, a subprocessor list with locations, or certifications. 10 9 11 3 2 8 17
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user or extension and per plan, what numbers, number blocks and porting cost, which calls are included in a flat rate (landline, mobile, international) and what the rest cost per minute, which features (call centre, recording, AI, CRM integrations, Teams calling) cost extra, device prices or rent, set-up fees, minimum term and notice period, and VAT.
0 — No public prices at all; every customer is a sales call or a partner quote.
3 — A starting price per user exists, but what numbers, minutes, porting and add-ons cost is unclear.
5 — Plans are public with their price per user and main inclusions, but at least one commonly needed piece (number blocks, porting, international minutes, call centre seats, AI or recording) is unpriced or "on request".
8 — Every plan priced publicly with its scaling rule, a per-minute price list for calls outside the flat rate, numbers, porting and devices priced, add-ons priced, set-up fees, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of users, numbers, sites and call minutes, with every add-on, device, porting and support fee and the cancellation and number-export terms published.
The Office Manager
The model suits a firm of ours: a low annual fee per system based on simultaneous calls, no per-user or per-agent charges, concrete euro figures published for a 24 simultaneous-call licence in the Basic, Pro and AI editions, prices exclusive of VAT, purchased for twelve months with no lock-in. But the real bill also depends on the SIP trunk carrier we must choose ourselves, and the captured pages show no per-minute call prices, no number or porting costs, no device prices and no set-up fee or notice period. 7 4 3 1
The IT Administrator
The model is public and unusual: licensing by simultaneous calls across Basic, Pro and AI editions with concrete euro figures per size (for 24SC the page lists "BASIC €785 €710 €0.49 €639 €430", "PRO €1,045 €945 €0.66 €851 €430", "AI €1,425 €1,285 €0.89 €1,157 €430"), prices stated exclusive of taxes and VAT, a 12-month purchase with no lock-in, a free tier under ten users, and a feature-per-edition list including gates such as recording from 16SC and the API requiring 8SC with AI. What I cannot compute from the captured pages: the real phone costs, number and porting costs (the trunk is bring-your-own), device prices or rent, and set-up or support fees — and some of the table columns, such as the €430 figure, appear without labels in the capture, so I would need the vendor to explain them before signing. 3 7 8 10
The Contact Centre Lead
All editions are publicly priced by simultaneous calls with a worked 24SC renewal example of €639 BASIC, €851 PRO and €1,157 AI, no per-user or per-agent fees apply, the contact centre is included, and prices are stated exclusive of taxes and subject to change at any time. Numbers, porting, per-minute call prices and devices carry no prices on these pages because calls run through the trunk provider of my choice, and set-up fees are not stated. 7 8 4 3 10
The Inside Sales Lead
Licences are priced publicly per simultaneous call across three editions plus a free tier, with no per-user or per-agent fees, a twelve-month purchase, VAT treatment stated as exclusive of taxes, and termination rules published. The 24SC price row shows several figures per edition without labels explaining what each covers, and because the vendor is not the carrier we found no public information on what numbers, porting, per-minute calls or devices cost — my real annual budget depends entirely on the trunk provider I pick. 7 8 3 1 4 10 5
The Data Protection Officer
The three editions are priced by simultaneous calls with a worked example at the twenty-four-simultaneous-call tier, feature inclusions per edition and the API licence requirement are published, and prices are stated as exclusive of taxes and VAT for a twelve-month purchase period. We found no public information on the cost of numbers and porting, devices, set-up fees or per-minute call rates. 3 4 7 8
The Skeptic
Editions BASIC, PRO and AI are publicly priced by simultaneous calls rather than users — 24SC BASIC €785, PRO €1,045, AI €1,425, with further figures in the same rows — plus no per-agent contact-centre fees, a free tier under ten users, prices stated exclusive of VAT and a twelve-month purchase with no lock-in. The captured pricing rows show five figures per edition without labels explaining what each buys, and we found no public information on number, porting or per-minute costs (these sit with the trunk provider of your choice), device prices, set-up fees or support — the terms grant no maintenance or support entitlement by default, allow price changes at any time without notice, and give no refund on termination. 7 8 3 4 1 10
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about 3CX
Is 3CX European?
Yes. whats-best.ai classifies 3CX as EU-Made.
Where does 3CX store data?
Not stated on the vendor’s pages as of 5 Nov 2026.
Does 3CX have a free plan?
Not stated on the vendor’s pages as of 5 Nov 2026.
What are the best alternatives to 3CX?
As of 6 Nov 2026, the panel rates Placetel (3.5/5), RingCentral RingEX (3/5) and Aircall (3/5) highest among the other 13 Cloud Telephony (VoIP & Cloud PBX) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Placetel (EU origin, foreign-owned). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: 3CX alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 5 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 132 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.3cx.de Checked 5 Nov 2026 Details →
- 2 Features page (phone system) www.3cx.de Checked 5 Nov 2026 Details →
- 3 Features page (hosted and self-hosted) www.3cx.de Checked 5 Nov 2026 Details →
- 4 Features page (contact centre) www.3cx.de Checked 5 Nov 2026 Details →
- 5 Features page (SIP trunks) www.3cx.de Checked 5 Nov 2026 Details →
- 6 Security / trust page www.3cx.de Checked 5 Nov 2026 Details →
- 7 Pricing page www.3cx.de Checked 5 Nov 2026 Details →
- 8 Pricing page (features per edition) www.3cx.de Checked 5 Nov 2026 Details →
- 9 Legal notice www.3cx.de Checked 5 Nov 2026 Details →
- 10 Terms of service (licence agreement) www.3cx.de Checked 5 Nov 2026 Details →
- 11 Privacy policy www.3cx.de Checked 5 Nov 2026 Details →
- 12 Calling, numbers & call routing — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 13 Calling, numbers & call routing — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 14 Apps, desk phones & Microsoft Teams — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 15 Apps, desk phones & Microsoft Teams — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 16 Call centre, analytics & AI — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 17 Call centre, analytics & AI — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 18 CRM integration, API & administration — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 19 CRM integration, API & administration — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 20 Reliability, call security & telecoms compliance — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →
- 21 Reliability, call security & telecoms compliance — found from sitemap www.3cx.de Checked 5 Nov 2026 Details →