Online Whiteboard
Bluescape
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Bluescape Buyer LLC · www.bluescape.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Bluescape at a glance
- Vendor
- Bluescape Buyer LLC
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Bluescape 2.5/5, the mean of 6 judges. Bluescape, a web-based collaborative visual workspace from Bluescape Buyer LLC, drew persona-weighted totals from 4.5 to 4.9. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Bluescape, a web-based collaborative visual workspace from Bluescape Buyer LLC, drew persona-weighted totals from 4.5 to 4.9. Its strongest mark is access and administration, a flat 6: external sharing disabled by default, view-only visitor links, visitor approval with allowed and blocked domains, and documented Okta SCIM provisioning. Security and deployment scores 5 to 6 on FedRAMP Moderate, DoD IL4/IL5 for controlled unclassified information, ISO 27001, SOC 2 Type II and a documented on-premises edition. Canvas and content sits at a flat 4: we found no public information on sticky notes, shapes, connectors or freehand drawing. Sovereignty scores 3 to 4 — data submitted from outside the United States is transferred to and processed in the United States under California law, and we found no public information on EU hosting. Facilitation is the only two-point spread, 4 to 6: the workshop-facilitator judge found the built-in meetings, breakout groups and 60-minute edit grant built for live sessions, while others, at 4 and 5, weighed missing timers, voting and accessibility statements. We found no public per-user prices; each price is set forth in the applicable Order.
Speaks for it
- Access and administration scored a flat 6, on external sharing disabled by default, view-only visitor links, visitor admin approval with allowed and blocked domains, and documented Okta SCIM provisioning
- Security and deployment scored 5 to 6, with ISO 27001, SOC 2 Type II, FedRAMP Moderate and DoD IL4/IL5 for controlled unclassified information stated on the trust page
- An on-premises edition is documented with its own deployment guide and feature toggles across Commercial, BluescapeGov and On-Premises segments
- The v3 API is generally available with REST and GraphQL, OpenAPI reference files and a workspace presence API
- Built-in meetings carry host controls — waiting room, mute one or all, camera controls, raise hand, remove attendee — with a breakout group template and a 60-minute edit grant
Held against it
- Sovereignty scored 3 to 4 — data is stored in the United States with storage in other, unnamed countries possible, and we found no public information on an EU hosting option
- Canvas and content scored a flat 4, with no public information on sticky notes, shapes, connectors, freehand drawing or performance limits on large boards
- Export is described only as a variety of formats dependent on what you are exporting, and we found no public information on import from other whiteboards or on webhooks
- We found no public information on encryption in transit and at rest, an administrative switch for the AI features, whether board content trains models, or which AI providers process it
- We found no public information on audit logs, retention rules, legal hold or what happens to a person's boards when they leave
Best for
- You are a US government or defense-adjacent team that must show FedRAMP Moderate and DoD IL4/IL5 for controlled unclassified information, both stated on the trust page
- You need to govern sharing centrally across a large organization — access and administration scored a flat 6 on default-off external sharing, view-only links and domain blocklists
- You want the option to run the workspace on your own infrastructure — an on-premises edition with a deployment guide is documented
- You run Scaled Agile Framework planning or host meetings inside the board — the template library includes SAFe templates and meetings carry waiting rooms, mute-all and breakout groups
Avoid if
- Your boards must remain in the EU — the privacy policy states data submitted from outside the United States will be transferred to and processed in the United States, and we found no public information on EU hosting
- Your works council cannot accept the privacy policy's statement that aggregated, statistical non-personally-identifying information may be sold, or needs to know who sees board content — we found no public information on which AI providers process it or on an administrative switch for the AI features
- Your workflow depends on a Jira or Azure DevOps sync, Teams, Zoom or Slack apps, or named export formats — we found no public information on these, and the terms state integrations may be disabled at any time without notice
- Your workshops are built on sticky notes, voting and timers — canvas and content scored a flat 4 and facilitation spans 4 to 6, with no public information on those primitives
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 2 of 5 |
| Workshop facilitation & participation | 2.5 of 5 |
| Integrations, import & export | 2 of 5 |
| Sharing, permissions & administration | 3 of 5 |
| Security, AI controls & deployment | 2.5 of 5 |
| European sovereignty | 2 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
A real collaborative canvas is documented: nestable, duplicable canvases with editable titles, backgrounds and links, searchable and sortable, a large template library with savable and shareable custom templates including Scaled Agile Framework sets, and content pulled onto the board from OneDrive, Google Drive, Box, Dropbox and local files. AI appears as document summarising, AI storyboards and geo-data visuals. We found no public information on sticky notes, shapes and connectors, freehand drawing or pen input, tables, or performance limits on large boards. 3 8 9 15
The Product Team Lead
The captured pages show a real-time visual workspace with canvases that can be nested, duplicated, restored after deletion and searched, a template library that includes Scaled Agile Framework planning templates plus custom templates we can save and share, and content addable from local files, OneDrive, Google Drive, Dropbox, Box and the web, with AI features to summarize document data and build storyboards. We found no public information on sticky notes, shapes, connectors, freehand or pen input, mind maps or table objects, or how the workspace performs on very large boards. 7 8 9 15 3
The Microsoft 365 Admin
This is a shared real-time visual workspace built around canvases you can nest, link, duplicate and sort by name, date or colour, with a template library described as a "vast collection" including Scaled Agile Framework planning templates, custom templates users save and share, and content added from OneDrive, Box, Dropbox, Google Drive and the web; AI can summarise document data and build storyboards. I found no public information on sticky notes, shapes, connectors or freehand drawing — the everyday whiteboard primitives — nor on performance limits for large boards. 7 8 9 15 3
The Works Council Member
A real-time visual workspace with canvases that nest, duplicate and can be searched, a template library including SAFe plus savable and shareable own templates, and content added from OneDrive, Box, Dropbox or Google Drive. The advertised AI that summarises document data says nothing about what happens to the notes it reads, and for sticky notes, shapes, pen input and large-board limits we found no public information. 3 7 8 9 15
The Public-Sector Project Lead
The web-based canvas is real, with nesting of canvases, search and sort within a workspace, content brought in from OneDrive, Google Drive, Dropbox and local files, and a template library that includes SAFe templates and lets our staff save and share their own. What the captured pages do not show are the everyday workshop primitives I need with municipalities — sticky notes, shapes, connectors, freehand drawing — nor search across all workspaces or stated limits for large boards. The AI functions (summarising documents, storyboards, geo-data) are described without any statement of their data use. 7 8 9 3 15
The Skeptic
Canvases can be nested, linked, searched and restyled, files land on the workspace from Box, Dropbox, Google Drive and OneDrive, and there is a template library with SAFe sets plus savable, shareable templates of your own. But we found no public information on sticky notes, freehand drawing, connectors, pen input or board behaviour at scale, and the AI that summarises document data and builds storyboards says nothing about what it does with the content. 7 8 9 15 3
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
This is built for live sessions: meetings inside the product with manual dial-in, waiting room, auto-admit, raise hand, mute one or all, remove attendee, host camera controls and a host grant that opens workspace editing to all participants for sixty minutes, plus a breakout group template for private sub-teams and a facilitator role that hides and reveals canvas content for presenting. Visitors join governed: admin approval, allowed and blocked domains, link sharing always view-only. We found no public information on a timer, voting or dot voting, an anonymous note mode, pulling everyone to the facilitator's view, participant limits, or accessibility for participants. 9 10 11 14
The Product Team Lead
There is a Facilitator workspace role that can hide and reveal canvas content for presentation, a breakout group template that assigns teams into private breakout groups, and built-in meetings with a waiting room, auto-admit, mute-all, camera controls, raise hand and participant removal, plus an edit-access grant for participants limited to 60 minutes. Visitors can join by link view-only, with admin approval and allowed or blocked domains configurable centrally. We found no public information on a timer, voting, an anonymous brainstorming mode, follow-the-facilitator, object locking or accessibility conformance. 9 10 11 14
The Microsoft 365 Admin
The meeting layer is real: waiting room with host approval, raise hand, mute-one or mute-all, camera controls, remove attendee, manual dial-in, hosting from a blank or existing workspace, and a 60-minute grant of workspace editing to participants. Breakouts come via a Breakout Group template, and owners or Facilitator-role collaborators can hide and reveal canvas content for presentations. I found no public information on voting, timers, a private or anonymous note mode, stated participant limits, or an accessibility statement. 11 10 9 7
The Works Council Member
Host controls for the built-in meetings are well documented — waiting room, admission approval, mute, cameras off, raise hand, remove attendee — alongside a breakout-group template, facilitators hiding canvas content for presentation, and visitors joining by view-only link with a 60-minute edit grant. For a timer, voting, an anonymous note mode and an accessibility statement we found no public information. 9 10 11 14
The Public-Sector Project Lead
Meeting host controls are genuinely documented — waiting room, auto-admit, mute one or all, turn off cameras, raise hand, remove attendee, dial-in info — plus a breakout-group template and a Facilitator role that hides and reveals canvas content for presentation. Visitor access is governable (admin approval, domain blocklists, view-only links), which helps our guests from other authorities. We found no public information on a timer, voting, a private or anonymous mode for notes, follow-the-facilitator, or an accessibility statement — and the last one my procurement office will not waive. 10 11 9 14
The Skeptic
Meetings run inside the product with waiting rooms, raise-hand, mute and camera controls and manual dial-in numbers, a Breakout Group template splits teams into private areas, a Facilitator role can hide and reveal canvas content for presentation, and visitors join by link view-only under optional admin approval. We found no public information on a timer, voting, an anonymous or private note mode, comments, stated participant limits or any accessibility statement for participants. 10 11 9 14
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
The API is properly documented — REST and GraphQL, current v3, OpenAPI reference files, a workspace presence API — with named integrations around it (Okta SCIM provisioning, an Outlook plugin for meetings, ShotGrid, cloud-storage add-content) and an invitation to build custom ones. Export is described only as content downloadable "in a variety of formats, dependent on what you are exporting", with no format named, and we found no public information on Teams, Zoom or Slack apps, a Jira or Azure DevOps sync, webhooks, or import from other whiteboards. The terms also state integrations may be disabled at any time without notice. 3 11 12 13 15 17
The Product Team Lead
The API is genuinely documented — REST and GraphQL, version 3 generally available, OpenAPI references and a workspace presence API — and there are named integrations for Outlook meetings, Okta SCIM provisioning and content from Box, Dropbox, Google Drive, OneDrive and ShotGrid. For my teams the dealbreakers are unevidenced: we found no public information on a Jira or Azure DevOps sync in either direction, webhooks, or import from other whiteboards, and the export documentation only says content downloads in a variety of formats without naming them. 12 13 11 15 17 3
The Microsoft 365 Admin
There is a documented, generally available v3 API with both REST (OpenAPI files published) and GraphQL plus a workspace presence API, an Outlook plugin for meetings, Okta SCIM provisioning, a ShotGrid integration, and export of single or grouped assets in "a variety of formats" the pages do not name. Azure AD integration is called feasible but "requires a special setup to use your own Azure app registrations". I found no public information on a Teams, Zoom or Slack app, a Jira sync, imports from other whiteboards, or webhooks. 12 13 11 15 17 3
The Works Council Member
A genuinely documented API set — REST and GraphQL with OpenAPI reference and a presence API — alongside Okta SCIM, Azure AD via special setup, an Outlook plugin, ShotGrid, and export of single or multiple assets in a variety of formats. For import from other whiteboards, webhooks and export formats beyond images we found no public information, and the terms reserve the right to disable integrations at any time without notice. 7 11 12 13 15 17
The Public-Sector Project Lead
The documented REST and GraphQL APIs with an OpenAPI reference and a presence API are strong, alongside Okta SCIM provisioning, an Azure Active Directory integration, an Outlook plugin for meetings, and content import from Box, Dropbox, Google Drive and OneDrive. Export is described only as "a variety of formats, dependent on what you are exporting" with an image download button; we found no public information on PDF or CSV export, webhooks, import from Miro or Mural, or apps for Teams, Zoom or Slack. 12 13 15 17 11 3
The Skeptic
The REST and GraphQL API is genuinely documented with OpenAPI files and a presence API, and Okta SCIM, an Outlook meeting plugin, ShotGrid and the cloud-drive connectors are named. The exit story is thin: export is described as downloading single or multiple assets in a variety of formats dependent on what you are exporting, and we found no public information on import from other whiteboards, webhooks, a Jira sync or an editable whole-board export — so two years of workshops leave as assets, not as structure. 12 13 15 11 17
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
Organisation admins hold real levers: link sharing and org-wide sharing default to off, external sharing is disabled by default, visitors can be required to pass admin approval with allowed and blocked domains, workspace roles show their exact permissions in the Config Center, and Okta SCIM plus an Azure Active Directory integration (via special setup) are referenced. Canvas links hold to collaborator lists. We found no public information on single sign-on with SAML as such, audit logs, retention rules or legal hold, link expiry or passwords, or how boards transfer when someone leaves. 9 14 15 17
The Product Team Lead
Organization administrators get a Config Center with central sharing policy: external sharing disabled by default, link sharing off by default and always view-only for visitors, admin approval for visitors with allowed and blocked domains, plus workspace roles whose exact permissions can be inspected. Okta SCIM provisioning is documented and Azure Active Directory is feasible with a special setup using our own app registrations. We found no public information on audit logs, retention or legal hold, link expiry or passwords, or transferring a leaver's boards. 14 15 17 9
The Microsoft 365 Admin
Centrally this is close to what I need for 2,400 staff: sharing outside the organisation is disabled by default, link sharing is view-only and can be switched off organisation-wide, visitors can be forced through admin approval with an allowed-domain bypass and a domain blocklist, workspace roles publish their exact permissions, and Okta SCIM provisioning is documented. Single sign-on into my Microsoft world is the weak spot — Azure AD is "feasible" but needs a special setup arranged through the account rep. I found no public information on domain capture of the free accounts I would need to absorb, audit logs flowing to a SIEM, or retention rules and legal hold. 14 15 17 7
The Works Council Member
The admin documentation is the strongest part: external sharing off by default, link sharing switchable per organisation, visitor admission approval with domain block and allow lists, workspace roles with their exact permissions viewable, and feature toggles for organisation admins across the commercial, government and on-premises editions. For audit logs, retention rules, legal hold and what happens to a person's boards when they leave we found no public information — the first thing my committee asks for. 14 15 17
The Public-Sector Project Lead
Central policy control is well documented: an organisation-level configuration centre where administrators switch off public links and organisation-wide sharing, require admin approval for visitors, and set blocked or allowed domains — shown identically for the commercial, government and on-premises segments. Workspace roles with exact permissions, SCIM via Okta and Azure AD integration complete the picture. We found no public information on audit logs, retention rules, legal hold, or what happens to a person's workspaces when they leave, which our administration would need in writing before signing. 14 15 17 9
The Skeptic
Central controls are real: sharing outside the organisation is disabled by default, link sharing can be switched off or kept view-only, visitors can be held for admin approval with allowed and blocked domains, canvas links only work for designated collaborators, and organisation admins see exact role permissions and per-segment feature toggles. But we found no public information on audit logs, retention rules, legal hold or transferring boards when a person leaves, and single sign-on appears only as an Azure setup requiring your own app registrations alongside an Okta SCIM guide. 14 15 9 17
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
The trust page is heavyweight — FedRAMP Moderate, DoD IL4/IL5 for controlled unclassified information, ISO 27001, SOC 2 Type II — and there is a documented on-premises edition with its own deployment guide and feature table, secure destruction of customer data within 90 days of termination, and a vulnerability disclosure program. Encryption appears only as a clause that Bluescape processes customer data in an encrypted state with written consent needed for unencrypted access; we found no plain statement of encryption in transit and at rest. We found no public information on switching AI features off, whether AI trains on board content, which AI providers process it, or works council statements, and the privacy policy says aggregated, statistical non-personally-identifying information may be sold. 3 5 6 7 15 16
The Product Team Lead
An on-premises edition is documented with its own deployment guide and feature toggles across commercial, government and on-premises segments, the terms commit to secure destruction of all customer data within 90 days of termination, to promptly notifying customers of security issues, and to processing customer data in an encrypted state, and a security page and vulnerability disclosure program exist. We found no public information on encryption in transit and at rest stated plainly, an administrator switch for the AI features the vendor leads its marketing with, which AI providers process board content, or a works-council statement. 5 7 14 15 16
The Microsoft 365 Admin
On-premises is documented in the terms ("utilizes the Bluescape Services on-premises, rather than through a Bluescape hosted environment") with a deployment guide and a feature-toggle table covering on-premises clients; destruction of all customer data within 90 days of termination is stated, and ISO 27001, SOC 2 Type II and FedRAMP Moderate are listed on the security page. For the AI features — document summarising, "multiplayer AI" — I found no public information on an admin switch to disable them, on whether customer content trains models, or on which providers process board content, and encryption in transit and at rest is not stated in what I read. 7 14 15 5 3 16
The Works Council Member
Certifications (ISO 27001, SOC 2 Type II, FedRAMP Moderate, DoD IL4), a stated destruction of all customer data within 90 days of termination, prompt notice of security issues, and a documented on-premises edition. But for an admin switch-off of the AI features, a training statement, named AI providers and encryption in transit and at rest we found no public information — and, decisive for us, no public information on whether contributions or time on board are tracked per person or what a manager can see. 3 5 7 14
The Public-Sector Project Lead
An on-premises edition is documented with a deployment guide and a feature-availability table per segment, which is the route our state data centre would take, and ISO 27001, SOC 2 Type II and FedRAMP Moderate attestations are stated on the trust page. Customer data is securely destroyed within 90 days of termination and a vulnerability disclosure programme exists. However, we found no public information stating encryption in transit and at rest, no way to switch the AI functions off administratively, no naming of the providers that process board content for the AI features, and no BSI C5, which procurement asked for specifically. 5 7 14 15 16 17
The Skeptic
On the table: a security page, secure destruction of all customer data within 90 days of termination, an encrypted-processing clause, a vulnerability disclosure program, and an on-premises edition that carries the same feature toggles as the cloud. The questions I always ask go unanswered — we found no public information on encryption in transit and at rest, on an admin switch for the AI, on whether boards train anyone's model, or on which AI providers see board content — while the privacy policy reserves the right to sell aggregated, statistical usage information. 5 7 6 15 16
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
For the client who asks where the board is stored, the captured pages answer: the United States — the service is "designed and maintained within the United States" and data from other countries "will be transferred to and processed in the United States", while storage in other, unnamed countries is reserved. The contracting entity is Bluescape Buyer, LLC under California law; the subprocessor list is published (AWS, Docusign, Hubspot, Outreach, Salesforce, Snowflake, Stripe, Tableau) but without locations, and we found no public information on an EU hosting option. GDPR processing terms and individual rights are published, and ISO 27001 and SOC 2 Type II are stated. 5 6 7
The Product Team Lead
The contracting entity is Bluescape Buyer LLC of Chicago under California law, and the privacy policy states data is stored in the United States, may be stored in other countries it does not name, and is transferred to and processed in the US for anyone using the service from abroad — we found no EU hosting option. Subprocessors are listed by name (AWS, Docusign, Hubspot, Outreach, Salesforce, Snowflake, Stripe, Tableau), GDPR processing terms are published, and ISO 27001, SOC 2 Type II and FedRAMP Moderate are stated. For a Hamburg company the one escape hatch is the documented on-premises edition on our own servers. 6 7 5 15
The Microsoft 365 Admin
The contracting entity is Bluescape Buyer LLC of Chicago under California law, the service is "designed and maintained within the United States", data from non-US users "will be transferred to and processed in the United States", and storage "in other countries" is reserved without naming any — I found no EU hosting option. Credit where due: sub-processors are listed by name (AWS, Stripe, Salesforce, Snowflake and others), GDPR processing terms are published, and ISO 27001 and SOC 2 Type II are claimed, which is more disclosure than many US vendors give. 7 6 16 5
The Works Council Member
The contracting entity is a US LLC under California law and the privacy policy states data is transferred to and processed in the United States, possibly in unnamed other countries, with no EU hosting option anywhere in the captured pages. The subprocessor list is published (AWS, Salesforce, Stripe among others) but without locations, GDPR processing terms exist, and an on-premises edition could bring boards onto our own servers, though the pages do not state it keeps every board there. 6 7 14
The Public-Sector Project Lead
The contracting entity is Bluescape Buyer LLC in Chicago, all data is "transferred to and processed in the United States" with storage in other countries possible, the governing law is California, and the named subprocessors (AWS, Salesforce, Stripe and others) form a wholly US-shaped chain; no EU hosting option appears anywhere in the captured pages. GDPR processing terms and GDPR rights are honoured, and an on-premises deployment guide exists — the only route our data protection officer could accept — but nothing evidences that the on-premises edition keeps every board on the customer's own servers. The hosted service, as documented, is not signable for us. 6 7 14 16
The Skeptic
The chain is named but American end to end: Bluescape Buyer LLC under California law, data transferred to and processed in the United States, storage possible in unnamed other countries, and eight subprocessors from AWS to Stripe listed without locations — we found no public information on an EU hosting option. GDPR processing terms, the right of erasure and the ISO 27001, SOC 2 and FedRAMP badges exist, and an on-premises edition is documented, but the captured pages do not state that it keeps every board off the vendor's own infrastructure. 6 7 5 14
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
A free tier exists — "Freemium Users" with "a more limited set of features" — and a pricing page URL is referenced, but no per-user or tier price, guest and viewer counting, or free-plan limits appear on the captured pages; additional users are priced "in the applicable Order", pro-rated. The commercial mechanics are public: twelve-month auto-renewing terms, thirty days' non-renewal notice, net thirty payment in US dollars, fees exclusive of taxes, 1.5% monthly late charges, nonrefundable fees. The numbers a buyer needs to compute a year's cost are not. 7
The Product Team Lead
The terms confirm a freemium tier exists with 'a more limited set of features' than paid plans but never say which, and every price is 'set forth in the applicable Order' — we found no public per-user figures, tier prices, free-plan limits, or pricing for single sign-on, AI or the on-premises edition. The contract mechanics are public: payment in U.S. Dollars, net 30, credit-card billing annually or monthly, a one-year auto-renewing term with 30 days' non-renewal notice, 60 days' notice of renewal price increases, prorated additional users, and fees exclusive of taxes. That is not enough for me to compute an annual cost for teams in three countries. 7
The Microsoft 365 Admin
The terms confirm a free tier with "a more limited set of features", annual licences auto-renewing yearly with 30 days' non-renewal notice, billing in US dollars net 30 with monthly or annual card charges, fees exclusive of taxes, and additional users pro-rated at pricing "set forth in the applicable Order". I found no public information on per-user prices per tier, free-plan limits, how guests are counted, or what single sign-on, SCIM or the on-premises edition cost. 7
The Works Council Member
A free tier and paid subscriptions exist with public billing mechanics — twelve-month auto-renewing terms, thirty days' non-renewal notice, sixty days' notice of fee increases, net-thirty payment, prorated additional users, fees exclusive of taxes. But we found no public information on price per user or tier, and user pricing is set forth in the applicable order. 7
The Public-Sector Project Lead
A freemium tier and paid subscriptions exist, and the contract terms are unusually explicit for a procurement file: twelve-month auto-renewing terms with thirty-day non-renewal notice, sixty-day notice of fee increases, pro-rated additional users, annual or monthly credit-card billing, ninety-day evaluation licences, and all fees exclusive of taxes including VAT. But no per-user price for any tier appears, the freemium limits are not itemised, guest counting is not described, and everything is in USD at the pricing set in the applicable order. I cannot compute our annual cost from the public pages. 7
The Skeptic
A free tier and a pricing page address exist, and the terms are precise on mechanics: twelve-month auto-renewing licences, thirty-day non-renewal notice, payment in U.S. Dollars net thirty, pro-rated added users, sixty days' notice of renewal increases, taxes exclusive. Not a single price figure, free-plan limit or rule for counting guests and viewers appears in the captured pages, so a buyer can read the contract but cannot compute the cost. 7
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Bluescape
Is Bluescape European?
No. whats-best.ai classifies Bluescape as Rest of world.
Where does Bluescape store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Bluescape have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Bluescape?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Bluescape alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 11 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 pricing fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.bluescape.com Checked 1 Nov 2026 Details →
- 2 Features page www.bluescape.com Checked 1 Nov 2026 Details →
- 3 Integrations page www.bluescape.com Checked 1 Nov 2026 Details →
- 4 Features page (enterprise) www.bluescape.com Checked 1 Nov 2026 Details →
- 5 Security / trust page www.bluescape.com Checked 1 Nov 2026 Details →
- 6 Privacy policy www.bluescape.com Checked 1 Nov 2026 Details →
- 7 Terms of service www.bluescape.com Checked 1 Nov 2026 Details →
- 8 Canvas, templates & content — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 9 Canvas, templates & content — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 10 Workshop facilitation & participation — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 11 Workshop facilitation & participation — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 12 Integrations, import & export — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 13 Integrations, import & export — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 14 Sharing, permissions & administration — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 15 Sharing, permissions & administration — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →
- 16 Security, AI controls & deployment — found from sitemap www.bluescape.com Checked 1 Nov 2026 Details →
- 17 Security, AI controls & deployment — found from sitemap community.bluescape.com Checked 1 Nov 2026 Details →