Knowledge Base & Wiki
BookStack
UK / wider Europe Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by HTTP Functions Ltd · www.bookstackapp.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
BookStack at a glance
- Vendor
- HTTP Functions Ltd
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates BookStack 3/5, the mean of 6 judges. BookStack is free, MIT-licensed documentation software that is self-hosted only, with no per-user pricing; the support plans of HTTP Functions Ltd of Hampshire, UK, at £450 /year and £4,500 /year with VAT stated as not included, are the only priced items. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
BookStack is free, MIT-licensed documentation software that is self-hosted only, with no per-user pricing; the support plans of HTTP Functions Ltd of Hampshire, UK, at £450 /year and £4,500 /year with VAT stated as not included, are the only priced items. The scoring is clear at both ends: pricing transparency is the strongest criterion at 9, sovereignty follows at 8, and knowledge governance is the weakest at 3-4, where a recurring finding is no public information on review dates, approval workflows, read confirmations or content analytics. Authoring and search scored 6 for a word-processor-style editor with a Markdown alternative, built-in diagrams.net and deep search documentation; access control scored 7 for permission overrides from shelf down to page with SAML 2.0, OIDC, LDAP and per-role MFA at no extra charge. Spread never exceeds a point — knowledge governance 3-4, publishing and integrations 4-5, portability and hosting 7-8 — reflecting how much weight judges gave named page owners, a REST API covering import and export, and the pages' statement that there is no automated Confluence migration.
Speaks for it
- Software is free with no per-user pricing, and SAML2, LDAP and multi-factor authentication are stated as included at no extra charge.
- Only priced items anywhere are the published support plans at £450 /year and £4,500 /year, with VAT stated as not included.
- Permissions can be overridden at shelf, book, chapter and page level, with SAML 2.0, OIDC and LDAP group sync and MFA enforced per role.
- MIT-licensed source on Codeberg, with installation and update documentation and exports to HTML, PDF, text, Markdown and a re-importable Portable ZIP.
- Self-hosted model places pages, attachments and the MySQL database on infrastructure the customer chooses, with the project stating no usage-tracking or marketing-tracking systems.
Held against it
- We found no public information on review dates with reminders, approval workflows, read confirmations or stale-content analytics.
- The captured pages state there is no automated Confluence migration, only REST API assistance.
- We found no public information on SCIM provisioning, an audit log of views and permission changes, or IP restrictions.
- We found no public information on a branded help centre, Slack or Teams apps, an in-product widget, or a connector for AI assistants.
- Exports are stated not to be intended for backup, and export of page revision history is not described.
Best for
- You need software cost fully computable from public pages for any team size, with a free licence and published support prices.
- You must run documentation on your own servers behind your own firewall, with MySQL and local-filesystem or S3 storage you control.
- You administer sign-on through SAML 2.0, OIDC or LDAP and need group sync into roles with MFA enforced per role.
- Your writers have mixed skills and need a word-processor-style default editor, a Markdown alternative and deep search filters.
Avoid if
- You are migrating a large Confluence library — the captured pages state there is no automated migration, only REST API assistance.
- You want a vendor-hosted service — self-hosting is the only model and the project offers no hosted edition.
- Your compliance regime requires approval workflows or review reminders — the documented governance controls are page revisions and ownership and update-date tracking.
- You need a branded public help centre or chat-app integrations — the only public exposure described is a whole-instance visibility toggle with configurable name and logo.
The scores
| Criterion | Panel median |
|---|---|
| Editor, structure & search | 3 of 5 |
| Verification, ownership & freshness | 1.5 of 5 |
| Permissions, SSO & administration | 3.5 of 5 |
| Help-center publishing & integrations | 2 of 5 |
| Import, export & self-hosting | 4 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 4.5 of 5 |
Verification, ownership & freshness
Show reasoningHide reasoning
How this is scored
Whether the content stays true: page owners or experts named per page, verification with a review date and a reminder when it lapses, approval or publishing workflows with drafts and reviewers, read confirmations for mandatory pages, analytics on views, searches without a result and stale pages, duplicate detection, archiving rules, and an audit trail of who changed and approved what.
0 — No way to see who owns a page or when it was last checked beyond the edit date.
3 — Page history and last-edited dates; owners, verification, approvals and content analytics are basic or not described.
5 — An owner or verifier per page, a review interval with reminders, a draft and publish step, page view statistics, and archived pages kept out of search.
8 — Approval workflows with several reviewers, read confirmations for mandatory pages, analytics on failed searches and stale content, duplicate or outdated content flagged automatically, and an exportable audit trail of changes and approvals.
10 — Governance that a regulated organisation runs on: controlled documents with versioned approvals that meet a named standard (ISO 9001, GxP), expiry and review enforced per space, knowledge gaps reported from searches and AI questions, and every published statement traceable to an approved version.
The Operations Lead
Pages keep revisions, and content carries created-by, updated-by and owner information that search filters and the "Own" permission option can act on, so a person can effectively be named per page. We found no public information on review dates with reminders, draft-and-publish approval steps, read confirmations for mandatory pages, stale-content analytics or an audit trail of who approved what, which is what would move it up. 1 13 14
The IT Administrator
Page revisions and last-updated dates are evidenced, and an owned-by search filter plus an "own" permission option show items carry owners, but that is where it stops. I found no public information on review dates, verification or approval workflows, read confirmations, stale-page or failed-search analytics, or an exportable audit trail of approvals — a gap for a regulated operation like mine. 1 13 14
The Support Knowledge Manager
Page revisions, an ownership concept with own-scoped permissions, and search filters by updated-after dates and updated-by users give me a manual way to surface stale content. We found no public information on review dates with reminders, approval workflows, read confirmations, or view and failed-search analytics — freshness for my twenty-five agents would rest on running manual searches rather than the system nagging the right expert. 1 13 14
The Engineering Lead
Page revisions are described and search can filter by who created, updated or owns a page, so change history and authorship are trackable. We found no public information on review dates with reminders, approval workflows, read confirmations or content analytics, which is the freshness loop a regulated fintech runbook needs. 1 13 14
The Quality Manager
Page revisions and last-updated dates are evidenced, and an owned-by search filter plus an 'Own' permission option give a light sense of who holds an item. We found no public information on approval workflows with named reviewers, review dates that expire pages, read confirmations for mandatory content, stale-page analytics or an exportable audit trail of changes and approvals — exactly the controls our ISO 9001 certifier asks about — so this stays at the basic level. 1 13 14
The Skeptic
Page revisions are listed as a feature, and search can filter by owner, creator and last-updated date, which gives history and a weak form of ownership. But I found no public information on verification cycles, review reminders, approval workflows, read confirmations or content analytics — the machinery that keeps a wiki true. 1 13
Permissions, SSO & administration
Show reasoningHide reasoning
How this is scored
Who may see and edit what, and how the administrator keeps control: roles and permissions per space and per page, restricted or private pages, guest and external access, groups synced from Azure AD/Entra ID, Google Workspace or LDAP, single sign-on (SAML, OIDC), SCIM provisioning, two-factor authentication enforced, an audit log of access and permission changes, and admin controls over sharing and public links. Where the data is hosted and certifications are scored under sovereignty.
0 — Everyone in a workspace sees and edits everything; no permissions of any kind.
3 — Admins, members and guests, or private and shared pages; per-space or per-page rights, SSO and an audit log are basic or not described.
5 — Permissions per space and per page, guest access with limits, single sign-on through Google or Microsoft, two-factor authentication, groups, and admin control over public sharing.
8 — SAML or OIDC single sign-on with any identity provider, SCIM provisioning or LDAP and directory group sync, enforced 2FA, an audit log of views, edits and permission changes, IP or domain restrictions, and permissions honoured by search and AI answers.
10 — Access control an enterprise auditor accepts as documented: granular roles with inheritance explained, just-in-time and external access with expiry, every access and permission change logged and exportable to a SIEM, and the permission model published with its limits.
The Operations Lead
Permissions can be set and overridden at shelf, book, chapter and page level with documented cascade, specificity and stacking rules, and the admin role retains all permissions; SAML 2.0 and OIDC sign-on with LDAP and SAML group syncing into roles are built in at no extra charge, with multi-factor authentication enforced per role. We found no public information on an audit log of views, edits and permission changes, SCIM provisioning or IP restrictions, which is what separates it from the higher level. 1 8 14 15 18
The IT Administrator
SAML2 and OIDC are documented in depth with group sync to roles and role-enforced MFA, so my Entra ID requirement reads as met, and the permission model is published with its specificity, cascade and stacking rules — exactly what an auditor wants to read. I found no public information on SCIM provisioning, IP restrictions, or an audit log of views and permission changes, which is what keeps this out of the top band. 1 14 15 8 7
The Support Knowledge Manager
Permissions are documented with real depth: three specificity levels, overrides at shelf, book, chapter and page, cascading to child content, role stacking with grants winning, plus SAML 2.0, OIDC and LDAP with group sync and multi-factor authentication enforceable per role, all at no extra charge. We found no public information on SCIM provisioning, an audit log of views, edits and permission changes, or IP and domain restrictions, which is what an enterprise auditor would expect to see documented. 1 8 14 15 18
The Engineering Lead
Granular role permissions with overrides at shelf, book, chapter and page level, documented cascade and specificity rules, SAML2, OIDC and LDAP with group sync, and MFA enforceable per role — all stated as built in without extra charge — is a strong model we could map our teams onto. We found no public information on SCIM provisioning, an audit log of views and permission changes, or IP restrictions. 1 7 14 15 18
The Quality Manager
Permissions can be set and cascaded at shelf, book, chapter and page level with three specificity levels and stacking roles, and SAML 2.0 with group sync, OIDC, LDAP and per-role enforced MFA are all built in with no extra charge. We found no public information on an audit log of views, edits and permission changes, IP or domain restrictions, or SCIM provisioning. 1 7 8 14 15
The Skeptic
The permission model is documented to a depth I rarely see: overrides at shelf, book, chapter and page level with cascading, three levels of specificity, role stacking, an "Own" option, and an admin role that cannot be stripped. Single sign-on runs SAML 2.0, OIDC and LDAP with group sync, and multi-factor authentication is enforced per role — but an audit log of views and edits, SCIM provisioning, and IP or domain restrictions are not described. 1 7 8 14 15
Help-center publishing & integrations
Show reasoningHide reasoning
How this is scored
How knowledge reaches people outside the editor: public or password-protected sites and help centers with a custom domain, branding and SEO controls, an in-app widget or contextual help, ticket deflection in a help desk, multilingual publishing, integrations with Slack, Microsoft Teams, Jira, Google Drive, help desks and CRMs, a browser extension, a documented REST or GraphQL API, webhooks, and an MCP server or connector for AI assistants.
0 — Content cannot be shared beyond the editor and nothing connects to it.
3 — Sharing a page by public link and a few integrations such as Slack; a branded help center, an API and webhooks are basic or not described.
5 — A published site or help center with custom domain and branding, integrations with Slack or Teams and Google Drive or Microsoft 365, a documented API, and embeds of common tools.
8 — A help center with SEO controls, multilingual publishing, access for logged-in customers and analytics, a widget or contextual help inside the customer's product, help desk integration with ticket deflection, webhooks, and a connector or MCP server for AI assistants.
10 — Knowledge delivered wherever it is needed from one source: internal and public audiences served from the same pages with per-audience rules, a complete API with SDKs and rate limits stated, a marketplace of integrations, and every channel measured in one report.
The Operations Lead
The integration side is documented: a REST API with in-instance documentation, and outgoing webhooks with Slack-compatible data format, examples and an async option, plus diagrams.net and embeddable iframe sources in pages. We found no public information on a branded help center or published site with a custom domain, Slack or Teams apps, help-desk or drive integrations, or a connector for AI assistants; only a whole-instance public-visibility toggle with configurable name and logo is described. 1 3 7 10 16
The IT Administrator
A documented REST API with in-instance docs, outgoing Slack-compatible webhooks and embedded diagrams cover the developer side, and the whole instance can be made publicly viewable. I found no public information on a branded help center with SEO controls, multilingual publishing, a customer-facing widget, ticket deflection, or an MCP connector for AI assistants. 4 10 16 1 3
The Support Knowledge Manager
The documented pieces are a REST API with in-instance API docs, outgoing webhooks with Slack-compatible payloads and worked examples, embedded diagrams.net, email over SMTP or sendmail, and a system-wide public-visibility toggle with configurable name and logo — on our own hosting that could serve a public site on our own domain. We found no public information on help-centre SEO controls, an in-product widget, help-desk ticket deflection, Slack or Teams apps, a browser extension, or a connector for AI assistants; the webhook is notification, not a chat integration. 1 3 4 10 16
The Engineering Lead
The REST API is documented inside the instance and covers both import and export, and outgoing webhooks come with Slack-compatible payloads, an example format and an optional background queue — enough to generate pages from our pipeline. We found no public information on help-center publishing with custom domains, Jira, Google Drive or help-desk integrations, or a connector for AI assistants. 4 10 16 17
The Quality Manager
A documented REST API with in-instance documentation, outgoing webhooks in a Slack-compatible format, and embedded diagrams.net and iframe content give developers real hooks. We found no public information on a branded help center, custom domain, SEO controls, a widget inside the customer's product or help-desk integration; the only public exposure described is making the whole instance publicly viewable, which is not per-audience publishing. 1 3 10 16
The Skeptic
There is a documented REST API served from your own instance, outgoing webhooks with Slack-compatible payloads and an optional async queue, embedded diagrams.net, and a whole-system public-visibility toggle with configurable name and logo. I found no public information on a branded help center, custom domains, Slack or Teams apps, Google Drive or Microsoft 365 integrations, an in-product widget, or an MCP server for AI assistants. 1 3 4 10 16
Import, export & self-hosting
Show reasoningHide reasoning
How this is scored
What arriving and leaving would cost: import from Confluence, Notion, Google Docs, Word and Markdown with structure, attachments and links kept, a full export of every space in an open format (Markdown, HTML, XML, PDF) with attachments and history, an API that reaches all content, a stated migration path from Confluence Server or Data Center, open-source code under a named licence, and a self-hosted or on-premise edition with its own documentation.
0 — Content cannot be imported or exported; it can only be read in the vendor's interface.
3 — Single pages export to PDF or Word and some files can be imported; a full export, a Confluence import and self-hosting are basic or not described.
5 — Import from Confluence or Notion and from Word or Markdown, a full workspace export to Markdown or HTML with attachments, a documented API covering pages, and a stated retention of data after cancellation.
8 — A Confluence migration tool or service that keeps hierarchy, permissions and attachments, a full export with history in an open format, a self-hosted or on-premise edition with installation and update documentation, and data returned or deleted on termination under stated terms.
10 — The customer owns the content end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete export another tool can import without loss, and the deletion of every copy on termination documented.
The Operations Lead
Self-hosting is the only model, under the MIT licence, with installation scripts, requirements and update documentation, and content can be exported per book, chapter or page to HTML, Markdown, plain text, PDF or a re-importable ZIP containing attachments and images, in a deliberately standardised HTML format for migrating away. The captured pages state plainly that there is no automated Confluence migration, only REST-API assistance, and we found no public information on exports that include page history — that gap holds it below the higher level. 1 3 6 17 18
The IT Administrator
Self-hosting is the product itself: MIT licence, source on Codeberg, installation and update documentation, and content kept in a flat HTML layer so a future migration away stays possible. Against that, the project states plainly there is no automated Confluence migration yet — only REST-API assistance — import takes portable ZIP files only, and export of revision history is not described, so my twelve years of pages would be a scripting project. 17 3 6 18 1
The Support Knowledge Manager
Self-hosting is the product itself: MIT-licensed source on Codeberg, install scripts for in-support Ubuntu LTS releases, an update path, backup and restore documentation, and content in the customer's own MySQL database with uploads on local storage or S3. Export covers HTML, PDF, text, Markdown and a Portable ZIP with attachments that re-imports into BookStack; the vendor's own pages say there is not yet an automated way to migrate content directly from Confluence (REST API assistance instead), import is limited to Portable ZIP, and we found no public information on exports including page revision history. 1 3 6 9 17
The Engineering Lead
MIT-licensed and self-hosted only, with Ubuntu installation scripts, requirements and an update channel documented, exports to HTML, Markdown, PDF, plain text and a portable ZIP that re-imports into another instance, plus backup and restore instructions. The captured pages state there is no automated Confluence migration (REST API assisted only), and export including page history is not described. 3 6 9 17 18
The Quality Manager
The software is MIT-licensed and self-hosted only, with installation scripts for Ubuntu releases, a documented update process and command-line backup guidance; books, chapters and pages export to HTML, PDF, plain text, Markdown and a re-importable Portable ZIP, with the REST API available for both export and import. The captured pages state plainly that there is no automated Confluence migration, and we found no public information on exports carrying page history. 3 6 9 17 18
The Skeptic
This is the part I care about most, and it holds up: MIT-licensed code on Codeberg, self-hosted only, with installation scripts for three Ubuntu versions, a documented update channel, and backup and restore instructions naming every file path. Books, chapters and pages export to HTML, Markdown, text, PDF and a re-importable Portable ZIP containing data, attachments and images, with the REST API covering both directions — though the pages state plainly that there is no automated Confluence migration and that these exports are not intended for backup. 1 3 6 9 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where pages, attachments and search indexes are stored and processed, and who the subprocessors are (hosting, CDN, search, email, support, payment, and the AI model provider that reads pages for answers and summaries, with whether content is used for training). Independently sourced by the sovereignty pipeline; a wiki holds internal processes, customer data and trade secrets, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU data residency available and an EU contracting entity or EU representative, but parts of the chain (CDN, search, email, support, AI model) run through non-EU providers without a stated safeguard, or EU residency is limited to the higher tiers.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations including the AI model provider, no training on customer content stated, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every page on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Operations Lead
The software is self-hosted open source that we would run on our own servers, with files on our own filesystem or our S3 and documentation behind our firewall, and the vendor states no usage-analytics or marketing-tracking systems are included — on our machines in Baden-Württemberg the whole chain is ours. The paid support contract sits with a UK company, and we found no public information on security certifications or a data processing agreement, which keeps it from the top level. 3 6 7 11 18
The IT Administrator
Every page stays on our own servers: the software is self-hosted only with no hosted edition, the captured pages state documentation can sit behind our firewall with local or S3 storage of our choosing, and no usage analytics or marketing tracking systems are included — for a utility data centre that is the chain I control end to end. The support vendor is a named Hampshire, UK company with a published company number; I found no public information on security certifications or a data processing agreement. 18 3 6 11 1
The Support Knowledge Manager
The documented model keeps every page on the customer's own servers: code supplied to run in your own environment or a location you trust, documentation behind your own firewall, with MySQL and local-filesystem or S3 storage on infrastructure we choose — for our EU-hosted instance that is the whole chain, which is the strongest position a knowledge tool can take for my multilingual customer base. The commercial seat is HTTP Functions Ltd in Hampshire, UK, selling only optional support plans; we found no public information on a data processing agreement, certifications, or subprocessors for the support relationship. 1 3 6 11 18
The Engineering Lead
Exclusively self-hosted MIT-licensed software means our pages, attachments and MySQL database stay on infrastructure we choose behind our own firewall, and the project states the software ships without usage-tracking or marketing-tracking systems — the whole chain is ours. The support vendor is HTTP Functions Ltd of Hampshire, UK; we found no public information on security certifications or a data processing agreement for the support relationship. 3 6 11 18
The Quality Manager
There is no hosted edition at all: the code is supplied to run on your own systems and behind your own firewall, which places the entire chain — pages, attachments and search — on the customer's own servers, with data export documented. The support vendor is HTTP Functions Ltd of Hampshire, UK; we found no public information on security certifications, and since the vendor handles no content in a self-run instance a processing agreement is not evidenced on the captured pages. 3 11 17 18
The Skeptic
Every page lives on your own servers — a Raspberry Pi behind your firewall or AWS, your choice — under an MIT licence, with the project supplying code to run in your own environment and stating it includes no usage-tracking or marketing systems in the software; that makes the whole chain the customer's, whatever the UK support vendor's seat. What the captured pages do not describe is the support vendor's own processing: no data processing agreement or subprocessor list, so I stop short of full marks. 1 3 17 18
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, readers or guests free or charged, minimum seats, which features (SSO, SCIM, audit log, verification, help-center publishing, custom domain, AI answers, EU data residency) cost extra, the free tier and its limits, storage limits, the self-hosted edition's licence and support price, minimum term and setup or migration fees.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with users, readers or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, AI, readers or guests, EU residency, the self-hosted edition) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (editors, readers, guests, storage), add-ons priced, the self-hosted edition's licence and support cost stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given number of editors and readers and a feature set, with every add-on, AI credit, setup, migration and support fee and the cancellation and data-return terms published.
The Operations Lead
The software carries no per-user pricing at all — it is free and open source, and SAML2, LDAP and multi-factor authentication are included at no extra charge — so the workshop getting read access costs nothing more, which answers my main pricing fear outright. The only costs are public support plans, quoted as "Professional Support Plan £450 /year" and "Enterprise Support Plan £4,500 /year", with VAT stated as not included; we found no public information on the cancellation terms, which sit behind a linked terms page. 1 4 5 18
The IT Administrator
The software is free with no per-user pricing, and features like SAML2, LDAP and multi-factor authentication are stated as baked in, so the only numbers to budget are the public support plans at £450/year and £4,500/year, with VAT treatment stated outright. What keeps it shy of a perfect score: the support terms are referenced rather than shown, and there is no migration or setup service to price because the project offers none. 5 18 1 4
The Support Knowledge Manager
The software itself is free with no per-user pricing and the vendor states features are not paywalled — SAML2, LDAP and multi-factor authentication are baked in — while the optional support plans are published at exactly £450 /year and £4,500 /year, with VAT stated as not included. With support plans the only priced items on the captured pages, the real annual cost is fully computable; we found no public information on cancellation or data-return terms, though self-hosting makes them largely moot. 4 5 18
The Engineering Lead
The software is free with no per-user pricing, and features like SAML2, LDAP and multi-factor authentication are stated as included at no charge, so the licence cost for any team size is zero. Support is publicly priced at '£450 /year' Professional and '£4,500 /year' Enterprise, with the captured pages stating 'VAT is not included in current pricing although may be chargeable in the future'; only the full support terms sit behind a link. 4 5 18
The Quality Manager
The software is free with no per-user pricing and features such as SAML2, LDAP and multi-factor authentication are stated as included at no extra charge, while the two support plans are published at £450 /year and £4,500 /year with VAT stated as not included. A buyer can compute the annual cost from public pages alone; paid feature implementation and pre-sales calls are stated as not offered, and we found no public information on setup or migration fees. 4 5 18
The Skeptic
The software is free with no per-user pricing at all, SAML2, LDAP and multi-factor authentication are stated as baked in at no charge, and the only money on the table is two published support plans — £450/year Professional and £4,500/year Enterprise — with VAT treatment stated. A buyer can compute the real annual cost from public pages alone; the one gap is that the support terms are referenced rather than shown, so cancellation conditions are not confirmed. 1 4 5 18
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about BookStack
Is BookStack European?
Yes, though not from the EU. whats-best.ai classifies BookStack as UK / wider Europe.
Where does BookStack store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does BookStack have a free plan?
Yes. BookStack has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to BookStack?
As of 1 Nov 2026, the panel rates Document360 (3.5/5), XWiki (3/5) and Docmost (3/5) highest among the other 13 Knowledge Base & Wiki products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Document360 (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: BookStack alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting options, Open source. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 3 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (19)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.bookstackapp.com Checked 1 Nov 2026 Details →
- 2 Features page www.bookstackapp.com Checked 1 Nov 2026 Details →
- 3 Features page (Confluence alternative) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 4 Project FAQ (funding, services, editions) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 5 Pricing page (support plans) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 6 Documentation (installation) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 7 Security page www.bookstackapp.com Checked 1 Nov 2026 Details →
- 8 Documentation (single sign-on) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 9 Documentation (backup and export) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 10 Documentation (API and customisation) www.bookstackapp.com Checked 1 Nov 2026 Details →
- 11 Support vendor homepage www.httpfunctions.com Checked 1 Nov 2026 Details →
- 12 Editor, structure & search — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 13 Editor, structure & search — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 14 Permissions, SSO & administration — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 15 Permissions, SSO & administration — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 16 Help-center publishing & integrations — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 17 Import, export & self-hosting — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 18 Import, export & self-hosting — found from sitemap www.bookstackapp.com Checked 1 Nov 2026 Details →
- 19 Code repository (open-source licence) — found from the homepage codeberg.org Checked 1 Nov 2026 Details →