Business Instant Messaging
Fleep
Provenance unknown Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Fleep OÜ · fleep.io
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Fleep, a business instant messenger from Fleep OÜ, arrives at this bench with a thin public record. The captured pages evidence direct chats, group conversations, cross-company messaging when partner companies are also on Fleep, file sharing, a pinboard for announcements, task tracking, and email sent and read from within the product. Its relative strengths are pricing transparency and messaging core, resting on a public "From €5 per month" figure with a free trial; its weakest marks are deployment control, governance and discovery (1), and encryption and access. The only published security statement is that Fleep is "built with digital security in mind"; the bench found no public information on encryption mechanisms, retention and export, audit logging, self-hosting, a documented API, or where messages and metadata are hosted, and no sovereignty attributes are on record. Judges did not meaningfully split — no criterion's scores span more than a point and no flagged splits were flagged. On this evidence an annual invoice cannot be computed and custody of the archive cannot be verified from public pages.
Speaks for it
- A public starting figure of "From €5 per month" with a free trial is more pricing disclosure than a sales conversation alone.
- Direct chats, group conversations and cross-company messaging with partner companies on Fleep are evidenced.
- Email can be sent and read from within the messenger, a real interoperability signal.
- Access to information can be managed and controlled for any employee, past or present, read by the bench as offboarding control.
- The clients work on all devices regardless of make or model.
Held against it
- The only published security statement is the phrase "built with digital security in mind", which names no mechanism.
- We found no public information on retention policies, export formats, audit logging or switchable presence analytics (governance and discovery 1).
- We found no public information on self-hosting, a customer-held archive or a documented exit path.
- Extensibility is evidenced only by a general claim plus email, with no public information on an API, webhooks or a bot framework (integrations 2).
- No sovereignty attributes are on record — hosting location, subprocessors and certification are unevidenced on the captured pages.
Best for
- You need a simple hosted messenger for direct chats and group conversations, with a free trial before committing.
- You collaborate cross-company with partner companies that are already on Fleep.
- Your team wants pinboard announcements and task tracking built into chat.
- You rely on email as the primary bridge to the other tools you use.
Avoid if
- You need publicly documented security mechanisms — encryption, key handling or SSO — before adopting a messenger.
- You must show retention policies, exportable records and audit trails to a regulator or works council.
- You need to self-host, hold your own archive, or plan a documented exit from the service.
- You must verify where messages and metadata are hosted and which subprocessors can touch them before signing.
The scores
Channels, threads & search
Show reasoningHide reasoning
How this is scored
The daily surface: channel model, threading, mentions, files, and whether search can find a decision made eighteen months ago.
0 — Flat group chats with no threads; search covers recent messages only, and history is capped.
3 — Channels and direct messages with basic search, but threading is awkward or absent and file handling is a plain attachment list.
5 — Public and private channels, real threads, mentions and reactions, file sharing with previews, and full-text search across the whole history.
8 — Cross-organisation or guest channels with clear boundaries, message editing history, pinned and saved items, search with filters by channel, person and date, and a documented history limit or none at all.
10 — The archive is a working knowledge base: search that ranks well across years, threads that stay readable, channel lifecycle management (archive, rename, merge) without losing history, and export of a conversation in a form a human can read.
The Team Lead
The confirmed surface is direct chats, group conversations, file sharing, a pinboard for announcements and tasks, plus cross-company messaging when partners are also on Fleep. We found no public information on threading, mentions, search across history, or any history limit — for a tool my team must mine for last spring's decision, that silence decides the score. 1
The Security Officer
Direct chats, group conversations, cross-company messaging and file sharing are the only evidenced surfaces; we found no public information on threading, mentions, reactions, search, or how far message history reaches. A pinboard and a task list exist, but nothing on the captured pages says whether a decision made eighteen months ago can be found again. 1
The Works Council Advocate
Direct chats and group conversations are evidenced, with file sharing, a pinboard for announcements, and cross-company messaging when partner companies are on Fleep. We found no public information on threads, mentions, reactions, or search of any kind, and nothing on how far back history reaches — so whether a decision from eighteen months ago can be found again stays an open question. 1
The Compliance Counsel
Group conversations and direct chats are shown, with cross-company messaging when partner companies are on the service, a pinboard for announcements, and file sharing accessible later on any device. But I found no public information on threading, mentions, or whether search reaches anything beyond recent messages — nothing here evidences that a decision made eighteen months ago could be found again. 1
The Platform Engineer
Direct chats and group conversations carry the product, with file sharing, a pinboard for announcements and task tracking shown on the captured page. We found no public information on threading, message search, mentions, or any history limit, so the daily surface reads as a basic conversation model rather than a channel platform. 1
The Skeptic
The captured page names direct chats and group conversations, file sharing with later access, and a pinboard for announcements, but we found no public information on threads, mentions, reactions or search. Nothing on the page says how far message history reaches, so whether a decision from eighteen months ago is findable is entirely unevidenced. A flat conversation model with pinned highlights sits just above the floor. 1
Encryption & access control
Show reasoningHide reasoning
How this is scored
What is encrypted and against whom, plus who can reach which room. Judged on documented mechanism, since "encrypted" in this category usually means the vendor holds the keys.
0 — Transport encryption only, undocumented; no role model beyond admin, guests indistinguishable from members.
3 — TLS and encryption at rest with vendor-held keys, basic roles, and guest access that mostly works.
5 — The above plus configurable roles per channel, SSO, guest accounts with scoped visibility, and a clear statement of what the vendor can read.
8 — Optional end-to-end encryption for direct messages or private rooms with the trade-offs named, device verification, session management an admin can revoke, and documented key handling.
10 — End-to-end encryption as a first-class mode — documented or open cryptography, cross-device key management that ordinary users survive, identity verification, and the vendor stating plainly what it cannot decrypt.
The Team Lead
The entire security statement is that Fleep is "built with digital security in mind" — a posture, not a mechanism — alongside a claim that access to information can be managed for any employee, past or present. We found no public information on encryption at rest or in transit, end-to-end encryption, configurable roles, SSO, or how guest and partner access is scoped. 1
The Security Officer
The only security statement is a slogan — built with digital security in mind — with no named mechanism for transport, at-rest or end-to-end encryption and no statement of what the vendor can or cannot read. Access control gets one sentence about managing employee access, past or present, which reads like account offboarding rather than documented roles, device verification, or sessions an admin can revoke. 1
The Works Council Advocate
The only security statement is that Fleep is "built with digital security in mind", which names no mechanism, and this criterion is judged on documented mechanism. We found no public information on transport or at-rest encryption, key handling, roles per conversation, SSO, or what the vendor itself can read; the one relevant line is that access can be managed and controlled for any employee, past or present. 1
The Compliance Counsel
The only security statement is the marketing phrase that the product is built with digital security in mind, which names no mechanism at all; I found no public information on encryption at rest, key handling, SSO, or what the vendor itself can read. The one concrete control is managing access to information for any employee, past or present, which suggests departed staff can be cut off but says nothing about key custody. 1
The Platform Engineer
The security story is one phrase — built with digital security in mind — plus a claim that access to information can be managed for any employee, past or present. We found no public information on the encryption mechanism, role model, SSO, or how cross-company participants are scoped, and this category is judged on documented mechanism, which puts it just above the floor. 1
The Skeptic
The only security statement anywhere is the phrase "built with digital security in mind", which names no mechanism — no encryption scheme, no key handling, no statement of what the vendor can read. One sentence claims access control over information for any employee past or present, but we found no public information on roles, SSO, or how cross-company participants are scoped. A tagline is not a documented mechanism. 1
Retention, discovery & co-determination
Show reasoningHide reasoning
How this is scored
The archive as a legal object: retention policies, export for discovery, audit, and the monitoring features a works council will ask to have switched off.
0 — No retention policy, no export beyond a manual copy, no audit log, and presence or activity analytics that cannot be disabled.
3 — Manual export of some data and a global history limit, but no per-channel retention, no audit log and no admin control over analytics.
5 — Configurable retention per channel or workspace, admin export in a documented format, an audit log of administrative actions, and status or presence that a user can control.
8 — Legal-hold and eDiscovery export including edits and deletions, retention executed per policy and evidenced, full admin audit trail, and activity analytics switchable off organisation-wide.
10 — Built to pass a works agreement and a subpoena on the same day: granular retention with documented deletion, discovery export a lawyer can use, complete audit, and no individual-level productivity scoring anywhere in the product.
The Team Lead
We found no public information on retention policies, admin export in a documented format, audit logging, or whether presence and activity analytics can be switched off. The one adjacent claim — controlling access to information for past and present employees — reads as offboarding control, not retention or discovery, and nothing here would survive a works council conversation. 1
The Security Officer
We found no public information on retention policies, admin export formats, audit logging, or any presence and activity analytics and whether they can be switched off. The closest fact is employee access management for past and present staff, which is deprovisioning rather than governance of the archive. 1
The Works Council Advocate
For a chat log as a record of who spoke to whom at what hour, I found no public information on retention policies, export in a documented format, an audit log, or whether presence and activity analytics can be switched off. The sole governance-adjacent fact is per-employee access control, including for past employees. 1
The Compliance Counsel
I found no public information on retention policies, export in a format a lawyer could work from, legal hold, or any administrative audit trail — the facts I would one day need to produce to a regulator simply are not published. The nearest item is access management for past employees, which is credential hygiene, not records governance. 1
The Platform Engineer
Managing access to information for departed employees is the only governance gesture visible. We found no public information on retention policies, admin export in a documented format, audit logging, or presence and activity analytics and whether they can be switched off — everything a works council would ask about is unevidenced. 1
The Skeptic
We found no public information on retention policies, export formats, audit logs, or whether any analytics exist and can be switched off. The single adjacent claim — managing access to information for past and present employees — is offboarding, not retention or discovery, so none of the archive-as-legal-object controls are evidenced. 1
Deployment & data custody
Show reasoningHide reasoning
How this is scored
Whether the customer can hold their own archive: self-hosting, private cloud, open source, federation, and what an exit actually looks like.
0 — Cloud-only, proprietary, with export limited to a partial archive.
3 — Cloud-only, but with a documented full export in an open-ish format.
5 — A private-cloud or dedicated-instance option, or a self-hosted edition that lags the cloud significantly; full export documented.
8 — A genuine self-hosted edition close to feature parity, or open-source core with a documented upgrade path, plus complete export including files and metadata.
10 — Custody is the customer's: open-source or source-available server, self-hosting supported as a first-class deployment, open protocol or federation, and a migration path in and out that the vendor documents rather than resists.
The Team Lead
We found no public information on self-hosting, a private-cloud or dedicated-instance option, open-source licensing, export of the archive, or federation. Working "on all devices regardless of make or model" describes the clients, not custody — nothing published shows a customer can hold their own archive or plan an exit. 1
The Security Officer
Everything captured describes a hosted subscription service, and we found no public information on self-hosting, a dedicated-instance option, open-source licensing, or a documented export for leaving the service. Nothing on the captured pages evidences that the customer can hold their own archive. 1
The Works Council Advocate
The free trial and monthly price read as a hosted service, and we found no public information on self-hosting, a private-cloud or dedicated-instance option, open source, federation, or a documented export and migration path. Whether the customer can hold their own archive is a question the captured pages never address. 1
The Compliance Counsel
The captured pages describe a service usable on all devices; I found no public information on self-hosting, dedicated instances, open-source code, or a documented export of the full archive including files and metadata. On this evidence, custody of the record cannot be shown to sit with the customer in any form, and an exit path is undocumented. 1
The Platform Engineer
Everything captured describes a hosted service with a free trial and apps on all devices; we found no public information on self-hosting, an open-source or source-available edition, export of the archive, or federation. For a buyer who would rather run it than rent it, there is no deployment path or exit story to evaluate here. 1
The Skeptic
The page describes clients that work on all devices, which is not custody: we found no public information on self-hosting, a private-cloud option, open source, or what export and exit look like. With nothing evidencing a customer-held deployment, absence earns the bottom of this scale. 1
Integrations & extensibility
Show reasoningHide reasoning
How this is scored
Bots, webhooks, app framework, identity — whether the chat becomes the place work is noticed, and whether that is buildable without a partner agreement.
0 — No API, no webhooks, no bots.
3 — Incoming webhooks and a handful of native integrations; no bot framework, no documented limits.
5 — Documented REST API, incoming and outgoing webhooks, slash commands, a bot account model, and SSO.
8 — A proper app framework with interactive components, event subscriptions with retries, SCIM provisioning, documented rate limits and a sandbox.
10 — A platform: versioned API with a deprecation policy, an app directory or plugin system with permissions a customer can audit, and integrations the vendor maintains rather than lists.
The Team Lead
The vendor states Fleep "can be made to work with other tools" and points at a help centre, which confirms intent and nothing else. We found no public information on a documented API, webhooks, slash commands, a bot account model, SCIM or rate limits — "works with other tools" is a sentence, not a platform. 1
The Security Officer
The vendor states Fleep can be made to work with other tools, and email can be sent and read from within the product. We found no public information on a documented API, webhooks, a bot framework, or single sign-on, so none of this is buildable on stated terms. 1
The Works Council Advocate
The page says Fleep "can be made to work with other tools that you may use", and email can be sent and read from within it, which is a real interoperability signal. We found no public information on an API, webhooks, a bot or app framework, SSO, or documented limits, so a buyer cannot tell from public pages what is buildable without a partner agreement. 1
The Compliance Counsel
Integrations are asserted generically — it can be made to work with other tools — and email can be sent and read through the product, which is a genuine interop capability. But I found no public information on a documented API, webhooks, a bot account model, or their limits; that is a claim of extensibility, not evidence of one a customer could build against. 1
The Platform Engineer
'Fleep can be made to work with other tools' and the ability to send and read e-mail inside the messenger are the entire extensibility story. We found no public information on an API, webhooks, a bot framework, or rate limits, so what is visible amounts to a small set of native hooks rather than something a customer could build on. 1
The Skeptic
The page claims Fleep "can be made to work with other tools" and shows sending and reading e-mails, which is more than nothing. But we found no public information on an API, webhooks, a bot framework, or even a named integration list — a vague sentence plus e-mail interoperability does not evidence an extensible platform. 1
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the archive and its metadata live, who the contracting entity is, which subprocessors touch it. Independently sourced by the sovereignty pipeline; scored here as this buyer weighs it.
0 — Non-EU vendor and contracting entity, hosting unstated or non-EU, subprocessors unnamed.
3 — EU data residency offered for message content while metadata, search indexes or support tooling remain non-EU, or the contracting entity sits outside the EU.
5 — EU hosting as standard and an EU contracting entity, but parts of the chain — notifications, AI features, analytics — are non-EU without an explained safeguard.
8 — EU hosting on named infrastructure, EU contracting entity, full subprocessor list published, any non-EU processing named with its legal basis.
10 — Sovereign end to end and evidenced: vendor, entity, hosting and every subprocessor European, certification published, and a self-hosted option that removes the question.
The Team Lead
The contracting entity's name, Fleep OÜ, suggests an Estonian company, but nothing on record confirms hosting location, subprocessors, or certification. We found no public information on where messages and metadata are processed, and unstated hosting with unnamed subprocessors sits at the bottom of this criterion. 1
The Security Officer
The contracting entity is named in a form associated with Estonia, but the captured pages state nothing about where messages or metadata are hosted, which subprocessors touch them, or any certification, and no independently sourced sovereignty attributes are on record. A buyer cannot place the archive geographically from public information. 1
The Works Council Advocate
We found no public information on hosting location, a subprocessor list, or certification; the sovereignty record for this vendor is empty. The contracting entity is named as Fleep OÜ, which reads as an Estonian company, but with hosting unstated and no subprocessors named, this buyer cannot verify where the archive and its metadata live. 1
The Compliance Counsel
The vendor is named Fleep OÜ, which points to an Estonian contracting entity, but the sovereignty record is otherwise empty. I found no public information on hosting location, infrastructure, subprocessors, or certification, so I cannot confirm from the published pages where the archive or its metadata would sit or who else would touch it. 1
The Platform Engineer
The one European signal is the Estonian company named as the vendor. We found no public information on where message content or metadata is hosted, which subprocessors touch it, or any certification, so the chain behind the entity is completely unevidenced. 1
The Skeptic
No sovereignty attributes are on record: the captured page states nothing about where message content or metadata is hosted, and we found no public information on a subprocessor list. The contracting entity is named as Fleep OÜ, but its seat, the hosting region and certification are all unevidenced on these pages. 1
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the annual invoice for their headcount — including the retention, compliance and guest features they actually need — from public pages alone.
0 — No public prices at all; every tier is a sales conversation.
3 — A per-user headline exists, but the tier where retention control, SSO or compliance export begins is unstated.
5 — Per-user prices public with billing period stated, but at least one commonly needed capability (unlimited history, SSO, eDiscovery) sits in an unpriced enterprise tier.
8 — Every tier priced publicly with per-user maths, history and storage limits, feature boundaries, minimum term and VAT treatment stated; self-hosted licensing priced too where offered.
10 — Complete price computability: annual invoice derivable for a given headcount and deployment choice, including guest users, storage and any per-instance licence.
The Team Lead
The single public figure is "From €5 per month" alongside a free trial, and that is the whole of it. We found no public information on tiers, billing period, per-user maths, storage or history limits, VAT treatment, or where compliance and retention capabilities begin — no buyer could compute an annual invoice from these pages. 1
The Security Officer
One headline figure is public — "From €5 per month" — alongside a free trial, but the captured pages do not state what the €5 covers, whether it is per user, or in which tier retention, compliance, or guest-access capabilities would sit. An annual invoice cannot be computed from this. 1
The Works Council Advocate
The single public price is "From €5 per month" with a free trial offered, and it does not state whether that is per user, what the billing terms are, or what the price includes. We found no public information on tier boundaries, history or storage limits, guest pricing, minimum term or VAT treatment, so an annual invoice cannot be computed from public pages. 1
The Compliance Counsel
A public headline of "From €5 per month" and a free trial exist, but the per-user basis is not stated, and I found no public information on tier structure or where retention control, SSO, or compliance export would begin. A buyer cannot compute an annual invoice from these pages alone, let alone price the compliance features they actually need. 1
The Platform Engineer
A single public starting figure — from €5 per month — plus a free trial is all the page gives. The per-user basis, billing period, tier structure and feature boundaries are unstated, and we found no public information on where admin, retention or compliance capabilities begin, so an annual invoice cannot be computed from public pages. 1
The Skeptic
A starting figure quoted as "From €5 per month" and a free trial are public, which is more than a pure sales conversation. But the page states no unit behind the price, no tiers, and we found no public information on where SSO, retention control or compliance export begin, nor on billing period, minimum term or VAT — no annual invoice is computable from this. 1
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in EE | 3/3 pts | 2 Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | Not determined ⚠ unverified | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 22 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency, Subprocessors. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 8 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (4)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor page fleep.io Checked 22 Sep 2026 Details →
- 2 Terms of service — found from the homepage fleep.io Checked 30 Sep 2026 Details →
- 3 Privacy policy — found from the homepage fleep.io Checked 30 Sep 2026 Details →
- 4 Channels, threads & search — found from sitemap fleep.io Checked 1 Oct 2026 Details →