Online Whiteboard
Conceptboard
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Conceptboard Cloud Service GmbH · conceptboard.com
Compare with Miro → Compare with Collaboard → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Conceptboard at a glance
- Vendor
- Conceptboard Cloud Service GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Starting price
- “5€ / user / month Starter” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Conceptboard 3/5, the mean of 6 judges. Conceptboard is an online whiteboard from Conceptboard Cloud Service GmbH of Halle (Saale). how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Conceptboard is an online whiteboard from Conceptboard Cloud Service GmbH of Halle (Saale). Its strongest category is sovereignty, scored 8 throughout, resting on a German contracting entity, hosting in Germany on named infrastructure — IONOS and AWS in the Frankfurt region, with IONOS or STACKIT as paid options — a published data processing agreement, ISO 27001, 27017 and 27018, and a self-hosted Data Center Edition that runs fully air-gapped; the captured pages still give different figures for third-country transfers, and several subprocessor locations are unstated. Security and deployment follows at 6 to 7. The weakest categories are integrations and export at 4 to 5 — full export is promised with no formats named and the API appears only as a mention of programmatic access — and canvas and content, also 4 to 5, where a template library and Kanban and Gantt views are documented without the canvas basics such as sticky notes, freehand drawing and connectors. Judges split on pricing transparency, scored 5 to 7: published tiers and concrete free-plan limits against "additional fee" add-ons and unexplained guest counting.
Speaks for it
- Sovereignty evidence runs from a German contracting entity and German hosting on named infrastructure to an air-gapped, self-hosted Data Center Edition
- Security is documented in technical detail — TLS 1.2 with AES-256 GCM in transit, AES-256 at rest, ISO 27001/27017/27018 recertified in March 2025, and penetration tests under a bug bounty
- Facilitation tools are named — live moderation, timer, voting, section-by-section presentations, and boards running inside Teams and Webex meetings
- Pricing publishes Starter at 5€ / user / month, Advanced from 10€ / user / month and Corporate & Government from 14€ / user / month, with free-plan limits of 3 active boards and 100 objects per board
- Access rights are assignable per file, board and project, with SAML 2.0 / OAuth 2.0 single sign-on and audit logs at the Corporate tier
Held against it
- Export is promised only as fully exporting or deleting your data, with no formats named and the API mentioned only as programmatic access in the terms
- We found no public information on canvas basics — sticky notes, freehand drawing, shapes and connectors — or on search across boards
- Single sign-on and the IONOS or STACKIT hosting options are marked "additional fee" without amounts, Special Plans are "on request", and guest contributor counting is unexplained
- We found no public information on SCIM provisioning, centrally enforced sharing policies, domain capture, or board transfer when a person leaves
- The accessibility audit reports partial compliance, with none of the templates marked accessible and not all PDFs accessible
Best for
- You need a German-law contracting party, hosting in Germany on named infrastructure and an air-gapped on-premises edition for a regulated or public-sector deployment
- You facilitate workshops and retrospectives inside Microsoft Teams or Webex and want a template library plus timer, voting and live moderation
- You plan work directly on the board — Kanban boards, backlogs, sprint planning and Gantt-style timelines with Jira tickets reflected on the canvas
- You buy through public-sector channels — the vendor is available via Marktplatz Deutschland Digital (formerly DVC) with EVB-IT contracting
Avoid if
- You need a structured exit path — the pages promise full export or deletion without naming any export format
- You must compute the complete annual cost before committing — add-ons such as single sign-on and the German hosting options carry unspecified "additional fee" amounts and Special Plans are "on request"
- You require accessible templates and documents today — the July 2025 audit reports partial compliance with no templates marked accessible
- You depend on a documented API or two-way Jira synchronisation — the Jira link is described as reflecting tickets on the board rather than keeping cards and issues aligned
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 2.5 of 5 |
| Workshop facilitation & participation | 3 of 5 |
| Integrations, import & export | 2 of 5 |
| Sharing, permissions & administration | 2.5 of 5 |
| Security, AI controls & deployment | 3.5 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
A pre-built template library for workshops, meetings and brainstorming, templates that can be adapted to an organisation and saved as team templates, files and documents embedded on the board, presentation sections, and kanban and timelines on the same canvas — that covers my board-building evening before a session. Object limits are stated (100 objects per board on the free plan, unlimited on paid), but we found no public information on drawing or pen input, search across boards, video embeds or any AI clustering or summarising of notes. 2 3 6 13 14
The Product Team Lead
Templates for workshops and retrospectives with a pre-built library and team templates, kanban, backlogs, sprint planning, timelines and Gantt-style views, presentation sections, and files embedded from Google Drive and OneDrive — the captured pages describe a working planning board, with concrete free limits of three active boards and one hundred objects. What my teams would still need to verify: we found no public information on sticky notes, drawing tools, shapes and connectors, mind maps, tables, search across boards, or any AI that clusters or summarises. 2 3 6 14
The Microsoft 365 Admin
The template story is genuinely strong for my users: a pre-built library for workshops and retrospectives, team templates on the higher plans, templates I can adapt to the organisation, files from Google Drive, OneDrive and Dropbox on the board, plus kanban, backlogs and Gantt-style timelines with task management. But the captured pages say almost nothing about the canvas itself — we found no public information on sticky notes, freehand drawing or pen input, an infinite canvas, frames, search across boards, or any AI that clusters or summarises — so I cannot confirm the fundamentals I would be migrating people onto. Documented limits (100 objects per board on the free plan, unlimited on paid) are the only scale statement offered. 2 4 6 13 14 5
The Works Council Member
A shared visual space with commenting and collaborative editing is documented, with a template library for workshops and meetings that can be adopted and adapted to the organisation, kanban boards, backlog and sprint planning, timelines and Gantt-style views, tasks and annotations, and file uploads with stated limits (10–100 MB per upload by tier, 100 objects per board on the free plan). We found no public information on the canvas primitives (sticky notes, shapes, connectors, freehand drawing, pen input), on search across boards, or on AI clustering and summarising of notes, so I cannot place it in the upper bands. 2 6 14 13
The Public-Sector Project Lead
Templates for workshops, meetings and retrospectives that can be adapted to the organisation, plus Kanban boards, timelines and Gantt-style views, tasks, comments and file uploads with stated per-tier limits, give me a solid workshop foundation. The captured pages never describe the basic canvas primitives — sticky notes, shapes and connectors, freehand drawing, pen input, an infinite canvas — nor search across boards, embedded documents or any AI assistance, so I cannot place it higher. 2 5 6 14
The Skeptic
A template library for workshops and retrospectives, templates adaptable to the organisation and saved as team templates, Kanban and Gantt views, sections for presentations, and files from Google Drive, OneDrive and Dropbox on the board are documented, with per-board object limits stated for the free plan. We found no public information on the canvas basics — sticky notes, freehand drawing, shapes and connectors — nor on tables, mind maps, search across boards, or any AI content features. What the pages prove is a shared workspace with templates and project views, short of the structured-data and diagramming level. 2 3 6 13 14
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
Live moderation, a timer and voting are documented, with a section-to-section presentation walk, the board running inside Teams and Webex meetings, and a genuine accessibility statement audited by Materna in July 2025 under EN 301 549 and BITV 2.0 — partially compliant, with the barriers named. Guests appear only as "temporary access for externals" with no account-free join by link described, and we found no public information on an anonymous or private mode for notes, locking objects, breakout areas or per-session participant limits. 3 6 12 13
The Product Team Lead
Live moderation, a timer and voting are named, guests get temporary external access from the Starter tier up, presentations run section by section with one click, and the board works inside Microsoft Teams and Webex calls. An accessibility statement audited by Materna in July 2025 against EN 301 549 and BITV 2.0 is published, though it reports partial compliance with no templates marked accessible. We found no public information on anonymous or private note modes, breakout areas, session agendas, stated participant limits, or object locking. 3 4 6 12
The Microsoft 365 Admin
Live moderation to guide the audience through content, a timer, voting, presenting section by section, guest contributors with temporary access for externals, and the board running inside Microsoft Teams and Webex — that covers most of running a session from our Teams calls. An external audit by Materna in July 2025 against EN 301 549 and BITV 2.0 found the application partially compliant (not all PDFs accessible, no templates marked accessible), which is more accessibility evidence than most vendors publish. We found no public information on anonymous or private brainstorming modes, breakout areas, participant limits per session, or voting results export. 2 3 4 6 12 13
The Works Council Member
Live moderation, a timer, voting, sections that carry a presentation from section to section, and temporary guest access for externals are documented, the board runs inside Microsoft Teams and Webex meetings, and there is an accessibility statement backed by an external audit against EN 301 549 and BITV 2.0 that reports partial compliance. We found no public information on an anonymous or private mode for notes, on participant limits per session, on locking objects or breakout areas — precisely the items I would need documented before a retrospective format goes live. 6 3 13 12
The Public-Sector Project Lead
Live moderation with a timer and voting, presentation sections, temporary guest access for externals, and boards running inside Teams and Webex meetings cover the core of my sessions with municipalities — and there is a real accessibility statement, audited by Materna in July 2025 against EN 301 549 and BITV 2.0, though only partially compliant with no templates marked accessible. I found no public information on an anonymous or private note mode, breakout areas, stated participant limits, or whether guests join without an account, which is a requirement I cannot yet confirm for guests from other authorities. 3 6 12 13
The Skeptic
Timer, voting, live moderation that guides the audience through the content, presentation sections clicked through in order, and guest contributor access for externals are documented, with boards running inside Teams and Webex meetings. An external audit against EN 301 549 and BITV 2.0 from July 2025 is published — partially compliant, with none of the templates marked accessible and not all PDFs accessible. We found no public information on anonymous or private note modes, breakout areas, participant limits per session, or the locking of objects. 2 3 6 12 13
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
More than a few named integrations: Microsoft Teams, Webex, Confluence with boards embedded by iFrame, Jira tickets reflected directly on the board, and file import from Google Drive, Dropbox and OneDrive. Export is described only as the option to "fully export or delete your data" with no formats named, the API appears in the terms solely as "programmatic access (e.g., APIs)", and we found no public information on Slack or Zoom apps, webhooks, import from other whiteboards or an editable export format. 2 4 7 11 13
The Product Team Lead
Jira tickets, statuses and documentation are integrated directly on the board, boards embed into Confluence via iFrame, and Microsoft Teams, Webex, Google Drive, Dropbox and OneDrive are named — the connections my teams in Poland and Portugal would actually use. What the pages do not establish: the Jira link is described as reflecting content on the board rather than a two-way sync keeping cards and issues aligned, an API is mentioned in passing but not documented, full data export is promised with no formats named, and we found no public information on webhooks, imports from other whiteboards, or an app marketplace. 2 4 7 11
The Microsoft 365 Admin
Teams, Webex, Google Drive, OneDrive, Dropbox and Confluence embedding are named, and a Jira integration reflects tickets and status directly on the board — workable for a Microsoft estate, though the Jira link is not described as a two-way sync. Export is described only as the option to fully export or delete my data, either automatically or on request, with no format named, and the API appears only as a passing mention of programmatic access in the terms of use. We found no public information on Slack or Zoom apps, PDF, image or CSV export formats, imports from other whiteboards, webhooks, or a documented REST API. 2 4 7 11 13
The Works Council Member
Named integrations cover Microsoft Teams, Webex, Confluence via iFrame embedding, Google Drive, Dropbox, OneDrive and a Jira integration that reflects tickets and status on the board, and the terms mention interfaces for programmatic access such as APIs; full export and deletion of data is offered automatically or on request. We found no public information on export formats (PDF, image, CSV of notes), a two-way Jira sync, webhooks, or imports from other whiteboards, so a structured exit cannot be planned from the captured pages alone. 4 2 11 7
The Public-Sector Project Lead
Named apps for Microsoft Teams and Webex, a Jira integration that puts tickets and status on the board, Confluence embedding, and file import from Google Drive, OneDrive and Dropbox are a workable landscape, and the terms mention interfaces for programmatic access. A full data export is promised automatically or on request, but no export formats, no import from other whiteboards, no webhooks and no documented API are described, so my procurement office cannot verify structured exit. 2 4 7 11 13
The Skeptic
Named integrations run to Teams, Webex, Confluence embedding via iFrame, Jira on the board, and file imports from Google Drive, Dropbox and OneDrive; the terms of use mention APIs for programmatic access without documenting them. Export appears only as the promise to "fully export or delete your data, either automatically or on request" — no format, no structure, no import path into another tool — so the exit cost of two years of workshops cannot be answered from public pages. We found no public information on Slack, two-way Jira sync, webhooks, imports from other whiteboards, or export as PDF, image or CSV. 2 4 7 11 13
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
Access rights can be assigned individually per file, board and project with role-based permissions, guest contributors get temporary external access, SAML 2.0 / OAuth 2.0 single sign-on is offered at an additional fee, and Corporate & Government adds audit logs, admin controls and unlimited storage. We found no public information on SCIM provisioning, domain capture, link sharing with expiry or password, retention rules or legal hold, or how boards transfer when a person leaves. 3 6 7 16
The Product Team Lead
Individual access rights per file, board and project with role-based permissions are stated, SAML 2.0 single sign-on is offered for an additional fee, guest contributors get temporary external access, and audit logs plus advanced admin controls arrive at the Corporate tier. We found no public information on link sharing with expiry or password, SCIM provisioning, domain capture, centrally set sharing policies, retention rules, or what happens to boards when a person leaves. 5 6 7 16
The Microsoft 365 Admin
Single sign-on via SAML 2.0 and OAuth 2.0 is offered (shown as an additional fee, with Entra ID explicitly named among the identity providers for the self-hosted edition), permissions are role-based down to individual files, boards and projects, guest contributors are tiered, and audit logs plus advanced admin controls arrive with the Corporate plan. What I need to absorb our 600 shadow accounts is not on these pages: we found no public information on SCIM provisioning, domain capture of existing accounts, centrally enforced sharing rules such as banning public links, exporting audit logs to a SIEM, retention rules or legal hold. Audit log retention of up to 180 days appears in the privacy policy, which is a start but not an administration story. 3 5 6 7 10
The Works Council Member
Individual access rights per file, board and project with role-based permissions, SAML 2.0 / OAuth 2.0 single sign-on, two-factor authentication, advanced admin controls and audit logs in the Corporate tier are documented, and the privacy policy states server log retention of generally 28 days with audit logs up to 180 days — a figure my committee would anchor in the agreement. We found no public information on SCIM provisioning, centrally enforced sharing policies, domain capture, transfer of boards when a person leaves, or export of audit logs to a SIEM. 7 6 16 10
The Public-Sector Project Lead
Individual rights per file, board and project with role-based permissions, SAML 2.0 single sign-on, two-factor authentication, LDAP in the self-hosted edition, and audit logs on the Corporate tier with a stated 180-day log retention give me an administrable picture. I found no public information on link-sharing expiry or passwords, SCIM provisioning, domain capture, central sharing policies, or what happens to a person's boards when they leave. 3 5 6 7 10
The Skeptic
Granular role-based access rights per file, board and project, guest contributors, single sign-on with SAML 2.0 and OAuth 2.0, and audit logs and admin controls named at the paid tiers are documented, with LDAP support in the self-hosted edition. We found no public information on link-sharing expiry and passwords, centrally set guest or sharing policies, SCIM provisioning, domain capture, retention rules and legal hold, or the transfer of boards when a person leaves. Who can open a given board is answerable; what the organisation controls centrally is not described. 3 5 6 7 16
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
Encryption is stated precisely (TLS 1.2 with 256-bit AES in GCM in transit, AES256 at rest), a bug bounty with automated and manual penetration tests runs with a summary report available on request, and deployment ranges from a dedicated German server to an on-premises Data Center Edition that runs air-gapped on Kubernetes with customer-controlled updates. Data can be exported or deleted automatically or on request, but the captured pages give no deletion period, and we found no public information on customer-managed keys, data loss prevention, AI controls or a works council statement. 5 7 8 17
The Product Team Lead
Encryption in transit (TLS 1.2 with AES-256 GCM and forward secrecy) and at rest, two-factor authentication, ISO 27001, 27017 and 27018 recertified in March 2025, and a bug bounty with automated and manual penetration tests are all documented. Deployment is unusually strong: dedicated servers in a German data centre and a self-hosted Data Center Edition that even runs air-gapped, physically separated from the internet. No AI features are described anywhere, so their controls cannot be assessed, and we found no public information on customer-managed keys, data loss prevention, or stated deletion periods for boards and accounts. 5 7 8 16
The Microsoft 365 Admin
Encryption is stated concretely (TLS 1.2 with 256-bit AES GCM, elliptic curve cryptography and forward secrecy in transit; symmetric AES256 at rest), full deletion of data is offered with stated log retention periods, penetration tests run under a bug bounty programme with a summary report available on request, and deployment is the strong suit — a dedicated server option and a self-hosted, fully air-gapped Data Center Edition delivered as a Kubernetes bundle with customer-controlled updates. However, we found no public information on customer-managed encryption keys, data loss prevention, or any AI features whatsoever — so I have nothing to evaluate against our rule that AI stays switched off until legal has read the terms, and no statement on whether board content trains models. 5 7 8 10 16 17
The Works Council Member
Encryption is stated with technical detail (TLS 1.2 with AES-256 GCM, elliptic curve cryptography and forward secrecy in transit, AES-256 at rest), backups, network segmentation, pseudonymised user IDs and logged admin access are documented, and the deployment ladder runs from a managed German cloud to a dedicated single-tenant server to an on-premises Data Center Edition that even operates fully air-gapped with customer-controlled update timing. We found no public information on AI features and whether an administrator can switch them off, on what managers can see of individual contributions and time on board, or on a statement or template for works council agreements — for a Betriebsvereinbarung that documentation gap is what holds my score below the top band. 8 5 16 7 10
The Public-Sector Project Lead
AES-256 in transit and at rest with forward secrecy, detailed technical measures from network segmentation to daily encrypted backups and disaster recovery, and penetration tests with a summary report on customer request are documented — and decisively for us, an on-premises Data Center Edition runs containerised on Kubernetes, even fully air-gapped in a closed network, with customer-controlled updates. The captured pages say nothing about AI functions or their controls, customer-managed keys, data loss prevention, or how individual activity is shown to managers, so those stay unassessed rather than judged. 5 7 8 16
The Skeptic
Encryption in transit and at rest with stated ciphers, ISO 27001/27017/27018 recertified in March 2025, regular penetration tests under a bug bounty, and deployment that goes deep — a dedicated server and a Data Center Edition shipped as an OCI bundle on Kubernetes that can run fully air-gapped — are documented. Deletion is offered "automatically or on request" with no period stated, and the penetration test summary is available only on customer request. We found no public information on AI features and their controls, customer-managed keys, data loss prevention, or what individual activity is tracked and shown to managers. 4 5 7 8 16
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
The contracting entity is Conceptboard Cloud Service GmbH in Halle (Saale), registered at Amtsgericht Stendal HRB 29184, under German law, with the whiteboard hosted in Germany on named infrastructure (IONOS and AWS in the Frankfurt region, or STACKIT), a data processing agreement linked in the footer, ISO 27001, 27017 and 27018 stated, and an on-premises edition documented down to fully air-gapped operation on the customer's own servers. Subprocessors are listed by purpose but not all with their locations, and the captured pages give different pictures on third-country transfers — one states none occur while the privacy policy names some third-country website providers under EU standard contractual clauses. 4 5 7 8 9 10 16
The Product Team Lead
The contracting entity is a German GmbH in Halle (Saale) with a commercial register entry, hosting runs in Germany on named infrastructure — IONOS, AWS Frankfurt, or STACKIT — a data processing agreement is published, ISO 27001, 27017 and 27018 are stated with recertification in 2025, and a subprocessor list with purposes is published, with email provider Brevo hosted at OVH in France and Germany and Google Cloud in Belgium. The documented Data Center Edition runs entirely on the customer's own servers, optionally with no internet connection. The privacy policy names some website-side providers based in third countries under standard contractual clauses, and we found no public information on the company's ownership structure. 5 9 10 15 16
The Microsoft 365 Admin
The contracting entity is Conceptboard Cloud Service GmbH in Halle (Saale), registered at Amtsgericht Stendal, with German law governing, the software developed in Germany, boards hosted in German data centres on named infrastructure (IONOS and AWS in the Frankfurt region, with IONOS CLOUD or STACKIT as choices), a data processing agreement linked in the legal footer, ISO 27001, 27017 and 27018 stated, and a documented on-premises edition that keeps every board on our own servers. The privacy policy lists subprocessors by name and discloses third-country providers such as Vimeo, Meta, Google, Twitter/X and YouTube with EU Standard Contractual Clauses or adequacy decisions as the safeguard, and self-hosted Matomo with truncated IPs for analytics. That is a properly evidenced European chain — the third-country website-side providers with stated safeguards are what keeps it shy of an end-to-end European one. 1 7 8 9 10 11 15 16
The Works Council Member
The contracting entity is Conceptboard Cloud Service GmbH in Halle (Saale), German law governs, boards are hosted in Germany on named infrastructure (IONOS and AWS in the Frankfurt region, optionally IONOS CLOUD or STACKIT), ISO 27001/27017/27018 certifications are stated, a data processing agreement is published, and the privacy policy lists the subprocessors with EU locations given for some (email via OVH in France and Germany and Google Cloud in Belgium) and standard contractual clauses as the safeguard for providers in third countries. An on-premises edition that keeps every board on the customer's own servers is documented as well; we found no public information on locations for several other named subprocessors such as the help-centre and applicant-management providers. 9 16 8 15 10
The Public-Sector Project Lead
A German contracting entity under German law, hosting in Germany on named infrastructure (IONOS, StackIT, AWS Frankfurt), a published data processing agreement, ISO 27001/27017/27018, a C5 attestation described for the IONOS CLOUD infrastructure of the public-sector offering, a published subprocessor list, and a documented air-gapped self-hosting edition that keeps every board on the customer's own servers — this is what my data protection officer and procurement ask for. The security page states there is no transfer to third countries while the privacy policy names third-country-connected providers for the website (Vimeo, Meta, Google, Twitter/X, YouTube) under standard contractual clauses, so the captured pages give different figures for third-country transfers. 5 8 9 10 15 16
The Skeptic
A German contracting entity in Halle with a commercial register entry, boards hosted in Germany on named infrastructure — IONOS and AWS in the Frankfurt region, with IONOS or STACKIT as paid options — a published data processing agreement, ISO certifications, and a self-hosted edition that keeps every board on the customer's own servers. The privacy policy lists the subprocessors and covers website-embedded providers based in third countries under standard contractual clauses, but locations are stated only for some, such as the email provider, and unstated for the help-centre, payment and applicant-management providers. We found no public information on the parent company or ownership. 5 8 9 10 15 16
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
Tiers are public with per-user prices — Starter at 5€ / user / month from 1 user with monthly or yearly billing, Advanced from 10€ / user / month on a 12-month contract for 10+ users, Corporate & Government from 14€ / user / month on 24 months for 100+ users — and the free plan's limits, VAT treatment, payment methods and cancellation terms are all stated. Single sign-on and IONOS or StackIT hosting are listed only as "additional fee" without amounts, Special Plans are "on request", and how guest contributors are counted is not explained, so a full annual cost cannot be computed from the public pages alone. 6 11
The Product Team Lead
The pricing page publishes Starter at 5€ / user / month, Advanced from 10€ / user / month and Corporate & Government from 14€ / user / month, with minimum users per tier, twelve- and twenty-four-month terms, VAT treatment, monthly or yearly billing, and concrete free-plan limits of three active boards, one hundred objects and 250 MB storage, while the terms spell out cancellation, auto-renewal and annual inflation adjustment. What I cannot yet compute: the single sign-on and Germany-hosting options are flagged only as an additional fee without amounts, guest counting is not explained, and special plans including on-premises are on request. 4 6 11
The Microsoft 365 Admin
Starter at 5€ / user / month, Advanced from 10€ / user / month on a 12-month contract for 10+ users, Corporate & Government from 14€ / user / month on 24 months for 100+ users, free-plan limits spelled out (3 active boards, 100 objects per board, 250 MB storage), and VAT treatment, monthly-versus-yearly billing, auto-renewal, the 90-day notice period and even the yearly inflation adjustment are all public. What blocks a full cost computation: single sign-on is listed only as an additional fee with no amount, the IONOS and STACKIT hosting options carry unspecified additional fees, Special Plans are on request, the self-hosted Data Center Edition has no public price, and how guest contributors are counted against licences is not explained. 4 6 11 15
The Works Council Member
All three paid tiers are public with per-user prices ("5€ / user / month Starter", "From 10€ / user / month Advanced", "From 14€ / user / month Corporate & Government"), free-plan limits are stated (3 active boards, 100 objects per board, 250 MB storage), as are minimum users per tier, contract terms of 12 and 24 months, VAT treatment, payment methods and the 90-day cancellation notice. Single sign-on and the IONOS or STACKIT hosting options are marked "additional fee" without amounts and Special Plans are "on request", so the full annual cost of a regulated deployment is not computable from public pages alone. 6 11
The Public-Sector Project Lead
Three tiers are public at "5€ / user / month Starter", "From 10€ / user / month Advanced" and "From 14€ / user / month Corporate & Government", with free-plan limits, VAT treatment, monthly and yearly billing, minimum users and terms, EVB-IT contracting, and cancellation terms in the terms of use. Single sign-on and the IONOS or StackIT hosting options are marked as "additional fee" without amounts, the on-premises and dedicated Special Plans are "On request", and how guest contributors are counted toward the price is not stated, so my budget office can price the tiers but not the sovereign add-ons. 4 6 11 15
The Skeptic
Free-plan limits are unusually concrete — 3 active boards, 100 objects per board, 250 MB storage, 10 MB per upload — and three tiers carry prices: 5€ / user / month for Starter from 1 user, From 10€ / user / month for Advanced at 10+ users on a 12-month term, From 14€ / user / month for Corporate & Government at 100+ users on 24 months, with VAT treatment stated. Single sign-on and the IONOS or STACKIT hosting options are marked "additional fee" without amounts, Special Plans are "On request", the dedicated and on-premises editions are unpriced, and we found no public information on how guest contributors are counted. The terms add a 90-day cancellation notice outside card payments, an annual inflation-based price adjustment, and the vendor's right to delete anonymous free content at intervals without indicating a reason. 6 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined ⚠ unverified | — | uncited Report an error |
Questions about Conceptboard
Is Conceptboard European?
Yes. whats-best.ai classifies Conceptboard as EU-Made.
Where does Conceptboard store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 1 Nov 2026.
Does Conceptboard have a free plan?
Yes. Conceptboard has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Conceptboard?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Conceptboard alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Transfer impact assessment, Hosting location, Legal entity, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 31 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage conceptboard.com Checked 1 Nov 2026 Details →
- 2 Features page conceptboard.com Checked 1 Nov 2026 Details →
- 3 Features page (meetings and workshops) conceptboard.com Checked 1 Nov 2026 Details →
- 4 Features page (enterprise) conceptboard.com Checked 1 Nov 2026 Details →
- 5 Features page (on-premises edition) conceptboard.com Checked 1 Nov 2026 Details →
- 6 Pricing page conceptboard.com Checked 1 Nov 2026 Details →
- 7 Security / trust page conceptboard.com Checked 1 Nov 2026 Details →
- 8 Security / trust page (technical measures) conceptboard.com Checked 1 Nov 2026 Details →
- 9 Legal notice conceptboard.com Checked 1 Nov 2026 Details →
- 10 Privacy policy conceptboard.com Checked 1 Nov 2026 Details →
- 11 Terms of service conceptboard.com Checked 1 Nov 2026 Details →
- 12 Workshop facilitation & participation — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 13 Workshop facilitation & participation — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 14 Sharing, permissions & administration — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 15 Sharing, permissions & administration — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 16 Security, AI controls & deployment — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 17 Security, AI controls & deployment — found from sitemap conceptboard.com Checked 1 Nov 2026 Details →
- 18 Data processing agreement (dpa) — found from the homepage conceptboard.com Checked 1 Nov 2026 Details →