# 3CX — Cloud Telephony (VoIP & Cloud PBX)

3CX by 3CX Ltd. holds a panel rating of 3/5 from 6 AI judges (category median 3/5), as of 2026-11-05. Provenance: EU-Made; sovereignty: not determined.

- Vendor: 3CX Ltd. (https://www.3cx.de)
- Category: [Cloud Telephony (VoIP & Cloud PBX)](https://whats-best.ai/software/cloud-telephony.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/cloud-telephony/3cx
- Alternatives: https://whats-best.ai/software/cloud-telephony/3cx/alternatives ([markdown](https://whats-best.ai/software/cloud-telephony/3cx/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-05 · oldest source captured 2026-11-05

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: 3CX Ltd.
- Headquarters: Not stated on the vendor’s pages as of 5 Nov 2026
- Data hosting: Not stated on the vendor’s pages as of 5 Nov 2026
- Free plan: Not stated on the vendor’s pages as of 5 Nov 2026

## The panel's verdict

3CX is a software phone system and contact centre sold through a German imprint under 3CX Ltd of Nicosia, Cyprus, offered hosted or self-hosted. It scores highest on the contact centre, with skill-based queues, wallboards, SLA alerts, AI transcription and chat channels at no per-agent fee, and on integration and admin, with a documented REST configuration API and a separate call control API. Calling and routing holds a uniform 6. The weakest scores are apps and devices, where clients are documented but we found no public information on desk phone makers or devices for sale or rent, and network and compliance, which credits testing by Mandiant and HackerOne; we found no public information on an availability guarantee, a status page or ISO 27001. The judges split on sovereignty: the on-premises route with an on-premise transcription engine earns the top score, while hosted on Amazon, Google and Digital Ocean draws the low end. Pricing sits at 5-6, with edition prices public per simultaneous call but call costs resting on the trunk provider of your choice.

**Speaks for it:**
- Contact centre included without per-agent fees, with skill-based queues, wallboards, SLA alerts and SMS, WhatsApp and live chat beside calls
- Documented REST configuration API (OData/OpenAPI) plus a separate Call Control API with WebSocket events, both requiring at least an 8SC AI licence
- Self-hosting documented on Windows or Linux on-premises or in a private cloud, with the transcription engine configurable on-premise
- Editions priced publicly per simultaneous call (24SC: BASIC €785, PRO €1,045, AI €1,425, with further figures in the same rows), a free tier for fewer than ten users, and a twelve-month purchase with no lock-in
- Security testing evidenced by Mandiant, ReversingLabs, Coverity and HackerOne, with a downloadable Mandiant assessment

**Held against it:**
- The licence terms prohibit relying on the product as the sole means of contacting emergency services, and we found no public information on porting timelines
- We found no public information on number, porting, per-minute call or device prices, as the vendor states it is not a telecom provider and calls run through a SIP trunk provider of your choice
- We found no public information on an availability guarantee with credits, a public status page or ISO 27001 certification
- Hosted instances run on Amazon, Google and Digital Ocean infrastructure; we found no public information on hosting regions or a subprocessor list with locations
- We found no public information on desk phone makers with automatic provisioning or on devices for sale or rent

**Best for:**
- You want a contact centre with queues, wallboards and SLA alerts built into the PBX licence at no per-agent fee
- Your administrators will drive configuration and automation through the documented configuration and call control APIs
- You can run the system self-hosted on your own Windows or Linux servers or a private cloud, keeping transcription on-premise
- You are ready to choose and manage your own SIP trunk provider and port your numbers to it

**Avoid if:**
- You want one vendor for system, numbers and calls — the licence terms state 3CX is not a telecom or SIP trunk provider
- You need the phone system as your sole means of reaching emergency services — the licence terms prohibit that use
- You are a regulated financial firm expecting the standard hosted service to satisfy DORA without a separate signed addendum
- Your workplace depends on desk phones or DECT handsets — the captured pages position the web client as a desk-phone replacement

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Office Manager | The IT Administrator | The Contact Centre Lead | The Inside Sales Lead | The Data Protection Officer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Calling, numbers & call routing | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Apps, desk phones & Microsoft Teams | 2/5 | 2.5/5 | 2/5 | 2.5/5 | 2/5 | 2/5 |
| Call centre, analytics & AI | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 |
| CRM integration, API & administration | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 | 3.5/5 |
| Reliability, call security & telecoms compliance | 2/5 | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 2/5 |
| European sovereignty | 2/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 3/5 |
| Pricing transparency | 2.5/5 | 2.5/5 | 3/5 | 2.5/5 | 2.5/5 | 2.5/5 |
| **Weighted verdict** | **2.5/5** | **3/5** | **3/5** | **3/5** | **3/5** | **2.5/5** |

### The judges

- **The Office Manager** (v1.0): Runs the office of a tax advisory firm with twenty-five staff in Hanover, where the old phone box in the server cupboard is being switched off by the carrier. The firm's number has been on every letterhead for thirty years and must not change. Wants the number ported without a gap, a greeting and a queue during the tax deadline weeks, voicemail by email, the desk phones kept, and a monthly bill the partners can read without calling anyone.
- **The IT Administrator** (v1.0): IT administrator at a machine builder with 280 staff on three sites in Baden-Württemberg, with production halls on DECT handsets, the office on Microsoft Teams and a service team abroad. Wants desk and DECT phones provisioned without touching each one, Teams calling with the company numbers, users created from Entra ID with single sign-on, an API for the number plan, and an emergency call from a home office that reaches the right control centre.
- **The Contact Centre Lead** (v1.0): Leads customer support for an online shop for bicycle parts, with eighteen agents in Leipzig and a hotline in German and English. On Mondays after a sale the queue reaches forty callers. Wants skills-based queues, a wallboard, callbacks instead of hold music, listen and whisper for training new agents, reports per agent and hour, and call summaries in the helpdesk without anyone typing them.
- **The Inside Sales Lead** (v1.0): Leads twelve inside sales reps at a B2B software company in Munich who call prospects in Germany, Austria and Switzerland from HubSpot. Wants click-to-call and a power dialer in the CRM, every call and its recording logged on the contact, local numbers in each country, the mobile app showing the company number at trade fairs, and AI notes that a rep can trust before the follow-up email.
- **The Data Protection Officer** (v1.0): External data protection officer for a group of six medical practices whose patients call about appointments, results and prescriptions. Knows that call records fall under the secrecy of telecommunications and that a recorded or transcribed call can hold health data. Reads the subprocessor list, asks which AI model writes the transcripts and where, wants encryption on by default, and needs a DPA and a retention period before any call is recorded.
- **The Skeptic** (v1.0): Has seen "all calls included" that excluded mobile numbers abroad, a "five-minute setup" followed by six weeks of porting, and an "AI assistant" that sent every recorded call to a model in the US. Asks what porting the numbers back out costs and how long it takes, whether the desk phones still work after leaving, who carries the calls, what the SLA pays when the platform is down — and what the second year costs.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Article28 processors: yes [S11]
- Cookie consent: yes · yes [S11]
- Coverity source scanning: detect source-level vulnerabilities · yes [S6]
- Data sale: no [S11]
- Dora hosted not compliant: yes [S10]
- DPA reference: yes [S10]
- GDPR: yes [S11]
- Hackerone bug bounty: yes [S6]
- International transfers: SCCs · adequacy decisions · other Chapter V GDPR mechanisms [S11]
- Mandiant report: yes [S6]
- Marketing consent: via unsubscribe link or contact form · yes [S11]
- Marketing profiling: no · no [S11]
- No access encrypted comm: no [S11]
- Pbx content monitoring: customer-enabled recording/transcription or legal requirement · no [S11]
- Reversinglabs binary scanning: detect hidden malware · yes [S6]
- Security measures: encryption · access controls · attack detection · log monitoring · vulnerability management · regular security reviews [S11]
- Special categories: no [S11]
- Third party sharing: only_as_described_in_policy [S11]
- Voicemail security recommendations: GDPR-compliant processing, EU server locations, TLS email encryption, encrypted storage, role-based access, retention policies [S13]

**Data**
- Deletion after termination: from active systems then backups per documented retention plan [S10]
- Export on termination: common available format · yes [S10]
- Integration storage: no [S11]
- Log retention: only as long as necessary for purposes and per retention policies [S11]
- Scope: public websites only; PBX/Cloud/AI data governed by separate DPA/privacy notices [S11]

**Hosting**
- Managed: yes [S3]
- Providers: Amazon · Google · Digital Ocean [S3]
- Self hosting option: yes [S3]

**Integrations**
- Also related APIs: Call Control API für Windows und Linux, Configuration API und Endpoints als verwandte Dokumente [S19]
- API: yes [S8]
- API key once: API-Schlüssel wird nur einmal angezeigt [S19]
- Call control API: Call Control APIs for Windows and Linux also available [S18]
- Config admin console: API-Integration wird in der Verwaltungskonsole unter Integrationen > API konfiguriert [S19]
- CRM: yes [S8]
- Data connectors: PostgreSQL · Google BigQuery · Grafana [S8]
- Docs availability: yes [S9]
- Example apps: Beispielanwendungen: IVR, Outbound-Kampagne, Dialer (Node.js) [S19]
- Google microsoft: yes · Google · Microsoft 365 [S2]
- Google workspace: full integration · user sync only [S8]
- Listed software: Microsoft 365, Google Workspace, Microsoft Teams, CRM, Helpdesk, ERP, Zapier, Make [S13]
- Microsoft teams direct routing: yes [S8]
- Ms365: full integration · user sync only [S8]
- Multi tenant: yes [S8]
- Oauth: OAuth or other secure mechanisms · yes [S11]
- Provider byo allowed: yes [S5]
- Sip trunk: yes [S12]
- Sip trunks: SIP-Trunks [S1]
- Sms mms: yes [S8]
- Third party: SSO · calendar/contact sync · Google · Microsoft [S11]
- Twilio supported: Twilio [S5]
- Voice apps: Voice Apps erstellen [S1]
- Websocket events: Server sendet WebSocket-Ereignisse (Benachrichtigungskanal), EventType-Enum mit Upsert, Remove, DTMFstring, Response [S19]
- Websocket request format: WebSocketRequest mit RequestID, Path, RequestData (z.B. makecall, divert) [S19]
- Whatsapp: yes [S12]
- Whatsapp: yes [S8]
- Wordpress chat plugin: WordPress Chat Plugin [S1]
- Xapi auth endpoint: POST · client_credentials · /connect/token [S18]
- Xapi bearer auth: Bearer token in Authorization header [S18]
- Xapi client id API key: API integration configured in Admin Console > Integrations > API; client application with client ID and one-time shown API key [S18]
- Xapi github example: XAPI example application in a GitHub tutorial repository [S18]
- Xapi json openapi: JSON · yes [S18]
- Xapi token validity minutes: 60 [S18]

**Legal**
- Address: Nicosia · 4, Markou Drakou · Cyprus · 2409 [S9]
- Assignment requires consent: yes [S10]
- Bank details: GENODEF1WOB · Volksbank Braunschweig Wolfsburg · DE95269910661670000000 [S9]
- Company founded: 2005 [S18]
- Company trust claim: 350000 [S3]
- Contracting entities: 3CX Ltd · 3CX USA Corp. · 3CX Software FZCO [S10]
- Controller: 3CX · 4 Markou Drakou, Engomi, Nicosia 2409, Zypern [S11]
- Default jurisdiction: courts of Nicosia, Cyprus · Cypriot law · 3CX Limited [S10]
- Entity name: 3CX GmbH · 3CX Ltd. [S9]
- Eula version records: yes [S10]
- Founded: 2005 [S3]
- Founding year: 2005 [S13]
- Last updated: 2026-01-30 [S11]
- Priority order: signed order form / negotiated agreement · jurisdiction-specific annex · product terms · DPA · EULA · other policies [S10]
- Register: Amtsgericht Hannover · HRB 214860 [S9]
- Related documents: https://www.3cx.de/unternehmen/datenverarbeitung/ · https://www.3cx.de/unternehmen/hipaa-richtlinie/ · https://www.3cx.de/unternehmen/dsgvo-statement/ [S11]
- US annex: 82-0633256 · 3CX USA CORP. · One Urban Center, Suite 600, 4830 West Kennedy Blvd. Tampa, FL 33609 [S10]
- US governing law: Florida, USA [S10]
- VAT id: DE287631697 [S9]

**Pricing**
- Base editions: BASIC · PRO · AI [S7]
- Business use only: yes [S10]
- Call control license requirement: 8SC+ AI-Lizenz erforderlich für Call Control [S19]
- Free hosted suspension: yes [S10]
- Free trial: yes [S13]
- Free trial: yes [S16]
- Free trial: yes [S7]
- Free trial available: yes [S8]
- Liability cap paid: fees paid in prior 12 months [S10]
- License metric: simultaneous calls (SC), internal and external [S7]
- No contract lock in: no · 12 [S3]
- No user fees: no [S1]
- Per agent: annual fee per system · no [S4]
- Per user fees: annual · no [S3]
- Renewal 24sc example: 24 · 1157 · 851 · 639 [S7]
- Savings claim: 80 [S1]
- Termination no refund: no [S10]
- VAT: no · yes · yes [S7]
- Xapi license requirement: 8SC with AI [S18]

**Product**
- Acd capabilities: ACD features: Digital Receptionists (IVR), routing options like Round Robin and Skill Based Routing, DID/caller-number-based routing, ring groups [S16]
- Acd distribution models: Round Robin · Longest Idle · Least Occupied · Skill-Based [S16]
- Additional features: up to 80% phone bill reduction · 3CX managed hosting · self-hosting · mobile apps · live chat · SMS · WhatsApp · free video conferencing · call center reports [S2]
- Adhoc conference: yes [S14]
- Admin console: yes · yes [S2]
- Agentic AI features: Anrufweiterleitung · Anrufprüfung · 24/7-Support [S1]
- AI agent features: boss secretary · personal assistant · reception [S8]
- AI features: call transcription · call summaries · call sentiment [S8]
- AI features: Speech-to-text, summarization, key info detection, prioritization, translation, intent analysis [S13]
- AI features: AI agents · transcription · summarization · sentiment analysis · suggested replies · knowledge source processing [S10]
- AI features: AI features mentioned: Predictive Routing, Sentiment Analysis [S16]
- AI integration whisper: KI-Integration via Sprachmodelle wie Whisper API [S19]
- AI not for emergency: yes [S10]
- AI providers: Google · OpenAI [S8]
- AI server: 3CX AI Server introduced in Update 10 [S16]
- AI tools: call transcription, sentiment analysis, automated summaries [S4]
- AI transcription summary: AI transcription and summarization of voicemails [S13]
- Anti hacking feature: 3CX PBX anti-hacking feature documented [S21]
- API restful: RESTful API Endpunkte für Anrufoperationen [S19]
- API websocket: WebSocket als Echtzeit-Kommunikationskanal für ereignisgesteuerte Anrufsteuerung [S19]
- Bring own sip trunk: Bring your own SIP trunk, switch providers, choose from supported providers [S5]
- Business hours ivr routing: yes · yes · yes · yes [S12]
- Byo sip trunk: yes · yes [S3]
- Call center: yes · yes · yes · yes [S2]
- Call center reports: yes [S3]
- Call center reports: yes [S4]
- Call control API purpose: programmgesteuerte Anrufverwaltung, PBX-Anruffunktionalität in Drittanbieter-Anwendungen integrierbar [S19]
- Call control use cases: Externe Anrufsteuerung, CRM-Integration, Outbound-Kampagnen, KI-Integration, Helpdesk-Automatisierung [S19]
- Call flow designer: Call Flow Designer ermöglicht visuelles Erstellen von Warteschleifen, Call Groups und IVRs [S12]
- Call flow designer: Complex scenarios such as phone banking and customer service can be built via call scripts and the Call Flow Designer (CFD) [S16]
- Call recording: yes [S4]
- Call recording: yes [S14]
- Call recording onboard 16sc: 16SC+ [S8]
- Call transfer modes: blind transfer · announced transfer [S14]
- Callcenter features: skill-based routing · SLA alerts · recording start/stop · switchboard · wallboard [S8]
- Capabilities list: up to 80% phone bill reduction · 3CX managed & hosted option · self-hosting · mobile apps · live chat, SMS, WhatsApp · free video conferencing · call center reports [S5]
- Capabilities summary: enterprise AI phone system / software PBX [S9]
- Capacity limit enforcement: require reduction, purchase license, or terminate/suspend [S10]
- Channels: live chat · WhatsApp · SMS · voice [S4]
- Click to call: Click-to-call from CRM and website via right-click [S15]
- Clients: Web client and desktop app available [S13]
- Company founded: 2005 · 20 [S7]
- Company founded: 2005 [S21]
- Company founded 2005: 2005 [S8]
- CRM integration: CRM integration with caller ID matching, automatic customer record creation, call logging [S15]
- CRM integration: Salesforce · HubSpot · Microsoft Dynamics [S16]
- CRM integration: Anrufe aus CRM starten, Anrufdetails protokollieren [S19]
- CRM lookup: yes · yes [S4]
- CRM names: MS 365 · Salesforce [S15]
- Customer count: more than 350,000 worldwide [S6]
- Customer count: 350000 [S2]
- Desk phone control: yes [S14]
- Doc last updated: 2026-05-25 [S21]
- Docs update date: 2026-07-27 [S14]
- Editions listed: 3CX AI · 3CX PRO · 3CX BASIC · 4SC FREE · 3CX SMB [S8]

**Support**
- Docs guides: VOIP FAQs · Konfigurationsanleitungen [S1]
- Faq reference: yes [S7]
- Free trial: yes [S4]
- No default entitlement: no [S10]
- Notice period cure: 30 [S10]
- Trial: yes [S3]

125 more facts on the canonical page: https://whats-best.ai/software/cloud-telephony/3cx

## Questions

### Is 3CX European?

Yes. whats-best.ai classifies 3CX as EU-Made.

### Where does 3CX store data?

Not stated on the vendor’s pages as of 5 Nov 2026.

### Does 3CX have a free plan?

Not stated on the vendor’s pages as of 5 Nov 2026.

### What are the best alternatives to 3CX?

As of 6 Nov 2026, the panel rates [Placetel (3.5/5)](https://whats-best.ai/software/cloud-telephony/placetel), [RingCentral RingEX (3/5)](https://whats-best.ai/software/cloud-telephony/ringcentral) and [Aircall (3/5)](https://whats-best.ai/software/cloud-telephony/aircall) highest among the other 13 Cloud Telephony (VoIP & Cloud PBX) products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Placetel](https://whats-best.ai/software/cloud-telephony/placetel) (EU origin, foreign-owned). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [3CX alternatives](https://whats-best.ai/software/cloud-telephony/3cx/alternatives).

## What this page leaves out

- 132 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 15 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.

## Sources

- [S1] Vendor homepage: https://www.3cx.de/ (checked 2026-11-05)
- [S2] Features page (phone system): https://www.3cx.de/telefonanlage/ (checked 2026-11-05)
- [S3] Features page (hosted and self-hosted): https://www.3cx.de/telefonanlage/cloud/ (checked 2026-11-05)
- [S4] Features page (contact centre): https://www.3cx.de/contact-center/ (checked 2026-11-05)
- [S5] Features page (SIP trunks): https://www.3cx.de/telefonanlage/sip-trunks/ (checked 2026-11-05)
- [S6] Security / trust page: https://www.3cx.de/telefonanlage/sicherheit/ (checked 2026-11-05)
- [S7] Pricing page: https://www.3cx.de/kaufen/preise/ (checked 2026-11-05)
- [S8] Pricing page (features per edition): https://www.3cx.de/kaufen/preise/funktionen/ (checked 2026-11-05)
- [S9] Legal notice: https://www.3cx.de/unternehmen/impressum/ (checked 2026-11-05)
- [S10] Terms of service (licence agreement): https://www.3cx.de/unternehmen/eula/ (checked 2026-11-05)
- [S11] Privacy policy: https://www.3cx.de/unternehmen/datenschutz/ (checked 2026-11-05)
- [S12] Calling, numbers & call routing — found from sitemap: https://www.3cx.de/voip-sip/ivr/ (checked 2026-11-05)
- [S13] Calling, numbers & call routing — found from sitemap: https://www.3cx.de/voip-sip/voicemail-to-email/ (checked 2026-11-05)
- [S14] Apps, desk phones & Microsoft Teams — found from sitemap: https://www.3cx.de/benutzerhandbuch/windows-softphone-app/ (checked 2026-11-05)
- [S15] Apps, desk phones & Microsoft Teams — found from sitemap: https://www.3cx.de/ip-telefonanlage/softphone-webclient/ (checked 2026-11-05)
- [S16] Call centre, analytics & AI — found from sitemap: https://www.3cx.de/voip-sip/acd-automatic-call-distribution/ (checked 2026-11-05)
- [S17] Call centre, analytics & AI — found from sitemap: https://www.3cx.de/docs/enabling-transcription/ (checked 2026-11-05)
- [S18] CRM integration, API & administration — found from sitemap: https://www.3cx.de/docs/konfiguration-rest-api/ (checked 2026-11-05)
- [S19] CRM integration, API & administration — found from sitemap: https://www.3cx.de/docs/call-control-api/ (checked 2026-11-05)
- [S20] Reliability, call security & telecoms compliance — found from sitemap: https://www.3cx.de/voip-sip/srtp/ (checked 2026-11-05)
- [S21] Reliability, call security & telecoms compliance — found from sitemap: https://www.3cx.de/docs/pbx-sicherheit-zugangsdaten/ (checked 2026-11-05)

---

Cite as: whats-best.ai, "3CX — Cloud Telephony (VoIP & Cloud PBX)", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/cloud-telephony/3cx

Corrections: https://whats-best.ai/correct/1534?target=page