Online Whiteboard
Excalidraw+
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Excalidraw s.r.o. · plus.excalidraw.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Excalidraw+ at a glance
- Vendor
- Excalidraw s.r.o.
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention United States source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Excalidraw+ 2.5/5, the mean of 6 judges. Excalidraw+ is the hosted team edition of the open-source Excalidraw whiteboard from Excalidraw s.r.o. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Excalidraw+ is the hosted team edition of the open-source Excalidraw whiteboard from Excalidraw s.r.o. of Brno, with persona-weighted totals spanning 4.6 to 5.3. Its strongest criteria are security and deployment, integrations and export and pricing transparency: judges cite a documented REST API and MCP server in public beta with export to PNG, SVG, JSON, PDF and PPTX, SOC 2 Type 1 and 2, annual penetration tests, and public prices for both purchasable plans — Free forever with one scene and unlimited collaborators, Plus at $6 a month per user — though the enterprise tier is only 'coming soon' and unpriced. Sovereignty is the weakest criterion: the captured pages give different figures for hosting — United States servers in the privacy notice and terms, EU-personnel access and non-EEA subprocessors in the 2026 agreement — and we found no public information on an EU hosting option. Facilitation and canvas and content split: diagrams, AI text-to-diagram and guest-link access are documented, while we found no public information on timers, voting, sticky notes or tables.
Speaks for it
- A documented REST API and MCP server, both in public beta, with an SDK, a CLI and export to PNG, SVG, JSON, PDF and PPTX.
- Both purchasable plans are fully priced — Free forever with one scene and unlimited collaborators, Plus at $6 a month per user, annual billing saving 14%, guests free on both plans.
- TLS in transit and AES-256 at rest are stated, with SOC 2 Type 1 and 2, annual penetration tests, and end-to-end encryption for shared scenes on the free plan.
- Guests open a scene from a link without signing in and can read and write comments, with unlimited collaborators on the free plan.
- Workspace admins can switch off scene sharing and AI usage for the whole workspace, and audit logs are retrievable through the API.
Held against it
- The captured pages give different figures for hosting: United States servers in the privacy notice and terms, EU-personnel access and non-EEA subprocessors in the 2026 agreement.
- We found no public information on an EU hosting option, and self-hosting of the Plus platform is marked in development.
- We found no public information on a timer, voting, a private or anonymous note mode, or a follow-the-facilitator view.
- We found no public information on which AI providers process board content or whether board content trains AI models.
- We found no public information on single sign-on, SCIM provisioning, retention rules or legal hold.
Best for
- You run live working sessions where guests join from a link without an account, using built-in voice chat, screensharing and frames-based presenting.
- You want boards you can automate and archive: a public REST API and open JSON export give a documented exit path.
- You want plainly published per-user pricing: Free forever with one scene and unlimited collaborators, Plus at $6 a month per user, guests free on both plans.
- You need a workspace admin able to switch sharing and AI usage off for everyone, with audit logs retrievable through the API.
Avoid if
- Your organisation requires the hosted service to run in the EU: the privacy notice and terms state servers in the United States, and we found no public information on an EU hosting option.
- You must budget the full year now: the enterprise tier is only 'coming soon' and unpriced, and the terms state prices may change at any time.
- You need the full Plus platform self-hosted today: the deployment page marks it in development, leaving only the open-source editor self-hostable now.
- You need objection rights over subprocessors: the processing agreement grants general authorization and names cancellation of the subscription as the sole remedy.
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 2.5 of 5 |
| Workshop facilitation & participation | 2 of 5 |
| Integrations, import & export | 3 of 5 |
| Sharing, permissions & administration | 2.5 of 5 |
| Security, AI controls & deployment | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 3 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
An infinite canvas with full editor functions, frames, image uploads up to 4k, personal libraries and four flowchart styles (process, swimlane, data, decision) are documented, plus AI text-to-diagram, wireframe-to-code and unlimited Mermaid import. For my evening-before board building, though, search in libraries and shared workspace libraries are both marked as coming, and I found no public information on workshop or retrospective template libraries, tables, or embeds of documents and video. 1 3 8 9 10
The Product Team Lead
The documented canvas has an infinite canvas, shapes, flowchart connectors, frames, image uploads up to 4k, sketch libraries and AI text-to-diagram, which covers my architecture sketches. For story maps and retros I need sticky notes, tables, kanban and a workshop template library, and we found no public information on those; workspace libraries and library search are both marked as upcoming, so the team-level template layer is not yet documented. 1 3 8 9 10
The Microsoft 365 Admin
The infinite canvas, frames, ready-made sketch libraries, 4k image uploads and Mermaid import cover my diagram-heavy engineering meetings, and AI text-to-diagram and wireframe-to-code with per-day request quotas are genuinely useful. Search in libraries is marked "coming soon", workspace libraries for organisation-wide templates are still "soon", and we found no public information on tables, kanban, mind maps, or embeds of live documents and video. 1 3 8 9 10
The Works Council Member
An infinite canvas with the full editor, named flowchart types, frames for slides and libraries of ready-to-use sketches is documented, and the AI generates diagrams from text, turns wireframes into code and converts Mermaid without limits. We found no public information on sticky notes as a content type, tables or kanban on the board, search across scenes, or stated object and participant limits; organisation-wide libraries are marked as still coming. 1 3 8 9
The Public-Sector Project Lead
The captured pages show an infinite canvas with the full editor, frames used as slides, image uploads and libraries of ready-to-use sketches, plus strong AI generation (text to diagram, Mermaid import, wireframe to code). We found no public information on sticky notes, tables, mind maps or embedded documents and video, and the pages themselves list search in libraries and workspace libraries as coming soon. 1 3 8 9 10
The Skeptic
The infinite canvas with text, shapes, frames, 4K image uploads and sketch libraries is well documented, and the AI turning text and Mermaid into diagrams and wireframes into code is real and counted per day. But we found no public information on sticky notes, tables, embeds of documents or video, search across boards (library search is only announced), or large-board limits, and team-wide workspace libraries are still 'coming soon'. 3 8 9 1 10
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
Guests open a scene from a link without signing in and can even comment, with unlimited collaborators on the free plan — exactly what my first-time participants need — and there are frames-based presentations, live real-time presenting with guests, comments, and built-in voice hangouts with screensharing. But the pages show no timer, no voting or dot voting, no anonymous note mode and no way to summon everyone to my view, which are the tools my sessions actually run on. 1 3 8 10 14
The Product Team Lead
Real-time collaboration, guests who open a link without signing in and can read and write comments, presentation mode built from frames, and built-in voice chat with screensharing are all documented — enough to run a planning session with my teams in Poland and Portugal. We found no public information on a timer, voting, anonymous brainstorming, bringing participants to the facilitator's view, object locking, participant limits or an accessibility statement. 8 9 10 14
The Microsoft 365 Admin
Guests open a scene by link without signing in and can comment, frames drive live presentations, and voice chat with screensharing is built in — enough to run a working session. We found no public information on a timer, voting, private or anonymous note mode, bringing everyone to the facilitator's view, locking objects, participant limits, or an accessibility statement. 1 3 8 10 14
The Works Council Member
Guests open a scene by public link without signing in and can read and write comments, voice hangouts and screensharing are built in, and frames drive live presentations with guests free on both plans. For a retrospective under co-determination we found no public information on a timer, voting, a private or anonymous mode for notes, locking objects or bringing everyone to one view, and no stated participant limits or accessibility statement. 8 9 10 14
The Public-Sector Project Lead
For my workshops the essentials are documented: guests open a link without signing in and can even comment, collaborators are unlimited on the free plan, and voice chat, screensharing and real-time presentations through frames are built in. We found no public information on a timer, voting, a private or anonymous mode, follow-the-facilitator or locked objects, and no accessibility statement appears on the captured pages. 1 3 8 10 14
The Skeptic
Real-time collaboration, guests opening a scene by link without an account, comments, presentations built from frames and built-in voice hangouts with screensharing are documented. We found no public information on a timer, voting, private or anonymous notes, following the facilitator's view, locking objects, participant limits per session or an accessibility statement. 1 3 9 10 14
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
A documented REST API in public beta reads and writes scenes, scene content, collections, users and workspace data, there is an MCP beta, an open-source SDK, a CLI, exports to PNG, SVG, JSON, PDF and PPTX, Mermaid import and embeddable read-only links. I found no public information on apps for Teams, Zoom or Slack, a Jira or Azure DevOps sync, webhooks, an import from other whiteboards, or a CSV export of the notes. 2 3 8 11 12
The Product Team Lead
The documented REST API in public beta can read, merge and replace full scene content plus collections, users, invites and workspace data, with rate limiting, an SDK, a CLI, an MCP server, and exports to PNG, SVG, JSON, PDF and PPTX on a documented scene format — good for automation and for surviving a tool switch. The bridge to ticketing that my teams need is absent from the captures: we found no public information on a Jira or Azure DevOps sync, webhooks, an import from other whiteboards, or apps for Teams, Zoom or Slack, with Notion and Obsidian the only named integrations. 2 3 8 11 12
The Microsoft 365 Admin
The documented REST API in public beta reads and writes full scene content plus users, invites and workspace audit logs, MCP lets agents automate diagrams, and export covers PNG, SVG, JSON, PDF and PPTX. We found no public information on apps for Teams, Zoom or Slack, a Jira or Azure DevOps sync, webhooks, or import from Miro or Mural — Notion and Obsidian are the only named integrations. 1 3 10 11 12
The Works Council Member
A REST API and an MCP server, both in public beta, are documented down to scene content, users, invites and workspace logs, with export to PNG, SVG, JSON, PDF and PPTX plus Mermaid import and embeddable read-only links. We found no public information on apps for Teams, Zoom or Slack, a Jira or Azure DevOps sync, webhooks, or import from other whiteboards. 2 8 11 12
The Public-Sector Project Lead
A documented REST API in public beta reads and writes complete scene content plus workspace users, invites and audit logs, with an MCP server, an open-source SDK and a CLI alongside export to PNG, SVG, JSON, PDF and PPTX — the open JSON format is a real exit path for our archives. We found no public information on webhooks, two-way sync with Jira or Azure DevOps, import from other whiteboards, or apps for Teams, Zoom or Slack; the named integrations are Notion and Obsidian. 2 3 10 11 12 13
The Skeptic
A documented REST API in public beta reads and writes complete scene content plus collections, users, invites and audit logs, with an MCP server, CLI and open-source SDK beside export to PNG, SVG, JSON, PDF and PPTX. We found no public information on webhooks, apps for Teams, Zoom or Slack, a Jira sync, or import from other whiteboards — the Mermaid import is a notation, not a migration. 11 12 10 3 2 14
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
There is a workspace with user management, role-based access to specific resources, admins who control access, sharing and AI usage for the whole workspace, link sharing an admin can switch off entirely (link rights are view, edit or none), and audit logs retrievable through the API. I found no public information on single sign-on, SCIM provisioning, domain capture, retention policies or what happens to a person's boards when they leave. 4 8 11 14 16
The Product Team Lead
Members can be authorised for specific resources, admins control access, sharing and AI usage for the whole workspace, and an admin switching off scene link-sharing for the workspace is enforced by the API, with user management, collections and audit logs retrievable through the API. We found no public information on single sign-on, SCIM provisioning, link expiry or password protection, central sharing policies beyond the workspace toggle, or how boards transfer when a person leaves. 4 8 11 14
The Microsoft 365 Admin
An admin can control access, sharing and AI usage for the whole workspace, public scene sharing can be switched off centrally — API calls then fail with a 403 — and workspace audit logs are retrievable through the API, which I could feed toward my SIEM. We found no public information on single sign-on with SAML, SCIM provisioning, domain capture of the free accounts on company addresses, retention rules, legal hold, or board transfer when someone leaves. 3 4 11 14 16
The Works Council Member
Resource-level rights for organisation members, workspace admins controlling access, sharing and AI usage, a hard workspace-wide switch for scene sharing, and audit logs retrievable through the API are documented. What those logs record per person and how long they are kept is not described — the first question our committee asks — and we found no public information on single sign-on, SCIM provisioning, retention rules or legal hold. 4 10 11 14 16
The Public-Sector Project Lead
Role-based access for members, workspace teams with user management, and admin control over access, sharing and AI usage for the whole workspace are documented; a workspace admin can switch public scene links off entirely, and audit logs are retrievable through the API. We found no public information on single sign-on with SAML, SCIM provisioning, domain capture, retention rules, legal hold, or transfer of scenes when a member leaves — all things my procurement office will ask about. 4 8 10 11 14 16
The Skeptic
Role-based access to specific resources, link sharing set to view, edit or off, an admin who can disable sharing and AI use workspace-wide, and audit logs retrievable through the API are documented. We found no public information on single sign-on, SCIM provisioning, link expiry or passwords, retention rules, legal hold, or transfer of a leaver's boards — thin for governing access centrally. 4 16 14 8 11 10
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
TLS in transit and AES-256 at rest are stated, end-to-end encryption protects shared scenes in the free version, admins can switch AI usage off workspace-wide, accounts are deleted on request with retention capped at one month past termination, and annual penetration tests, SOC 2 Type 1 and 2 and a documented self-hosting guide for the open-source editor are described (Plus self-hosting is marked in development). I found no public information on which AI providers process board content, a no-training statement, customer-managed keys or works council material. 4 5 15 16
The Product Team Lead
AES-256 at rest and TLS in transit are stated, with application-level encryption of tokens and keys, end-to-end encryption for shared free-plan scenes, daily backups and 14-day point-in-time recovery, SOC 2 Type 1 and 2, annual penetration tests, and admins able to switch AI usage off for the workspace. For a works-council conversation I would need more: we found no public information on a statement that customer content does not train AI models, customer-managed keys, which AI providers process board content, or individual activity tracking; the deployment page describes self-hosting the full Plus platform on own infrastructure but marks it as in development, while the open-source editor can be self-hosted today. 4 5 15 16
The Microsoft 365 Admin
TLS and AES-256 are stated, sensitive tokens are encrypted at application level, SOC 2 Type 1 and 2 conformance and annual penetration tests are published, and AI usage can be switched off at workspace level — my legal team's precondition. But we found no public information on which AI providers process board content or whether boards train models, the self-hosted Plus edition is marked in development, and the captured pages give different figures for deletion after termination (one month in the privacy notice, internal retention policies in the data processing agreement). 2 3 4 5 7 15 16
The Works Council Member
TLS and AES-256, application-level encryption of tokens and keys, end-to-end encryption for shared free scenes, and admin control over AI usage are stated, with annual penetration tests and a trust centre. For an agreement under §87(1) no. 6 BetrVG the open points weigh heaviest: no named AI providers and no statement that board content does not train models, cancellation does not delete data and retention follows unpublished internal policies, and there is no description of what managers can see of individual activity; Plus self-hosting is documented but still marked in development. 4 5 7 15 16
The Public-Sector Project Lead
TLS in transit and AES-256 at rest are stated, along with application-level encryption of tokens and keys, daily backups with 14-day point-in-time recovery, annual penetration tests, SOC 2 Type 1 and 2, a trust centre, admin control of AI usage, bring-your-own-key, and deletion of personal information no later than one month after account termination or on written request. We found no public information on customer-managed keys, which AI providers process board content, data loss prevention or a statement for works councils, and the self-hosted Excalidraw Plus edition is documented as still in development — the open-source editor can be self-hosted today. 4 5 7 10 15 16
The Skeptic
TLS and AES-256, application-level encryption of tokens, admins able to switch AI use off workspace-wide with bring-your-own-key, SOC 2 Type 1 and Type 2, annual penetration tests and deletion or return on written request are stated. But we found no public information on whether board content trains AI models or which AI providers process it, no customer-managed keys or dedicated tenant, no activity-tracking disclosure, and the Plus self-hosting edition is still in development. 4 16 7 15 10
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
The vendor is Excalidraw s.r.o. of Brno under a data processing agreement governed by Czech law, with access to customer data limited to personnel in the EU and Standard Contractual Clauses for transfers. But the captured pages state that the servers are in the United States and the DPA acknowledges subprocessors outside the EEA; no EU hosting option is described, the subprocessor list's entries and locations are not shown, and self-hosting the Plus platform is still in development. 5 6 7 15 16
The Product Team Lead
The contracting entity is Excalidraw s.r.o. in Brno under Czech law, with a published data processing agreement, standard contractual clauses, a subprocessor list at the trust centre, and a commitment that personnel outside the EU have no access to customer personal data. The captured privacy notice and terms place the servers in the United States and the processing agreement acknowledges subprocessors outside the EEA including in the US, and we found no EU hosting option for the hosted product on the captured pages; self-hosting the open-source editor on own European servers is documented, though it is the free editor rather than the Plus workspace. 5 6 7 15
The Microsoft 365 Admin
The contracting entity is Excalidraw s.r.o. in Brno under Czech law with a published data processing agreement and a sub-processor list, and access to customer personal data is restricted to staff in the EU. However, the privacy notice and terms state servers in the United States, the data processing agreement acknowledges sub-processors outside the EEA, and we found no EU hosting option; only the open-source editor can be self-hosted today, with the self-hosted Plus edition still in development. 2 5 6 7 15 16
The Works Council Member
The vendor is Excalidraw s.r.o. of Brno under Czech law, with a published data processing agreement, standard contractual clauses and a subprocessor list. The captured pages give different figures for where boards are hosted: the 2021 privacy notice states servers in the United States, while the 2026 DPA limits access to EU personnel and acknowledges subprocessors outside the EEA without naming a European hosting option. Self-hosting the open-source editor on our own servers is documented today; the Plus platform's self-hosting edition is still in development. 2 5 6 7 16
The Public-Sector Project Lead
The contracting entity is Excalidraw s.r.o. in Brno under Czech law with a published data processing agreement, standard contractual clauses for non-EEA subprocessors and a maintained subprocessor list — but the captured pages give different figures for where the hosted service runs: the privacy notice and terms state United States servers while the 2026 agreement restricts access to EU personnel. We found no public information on an EU hosting option for the hosted service or on BSI C5 or ISO 27001; the open-source editor can be self-hosted today with a deployment guide, and self-hosting of the full Plus platform is in development, which for my DPO is not yet a signable chain. 2 5 6 7 15 16
The Skeptic
The contracting entity is Excalidraw s.r.o. in Brno under Czech law with a published DPA, SCCs and a subprocessor list, yet the captured privacy notice and terms state servers are located in the United States and the DPA acknowledges US subprocessors under general authorisation where the customer's sole remedy is cancelling. We found no EU hosting option for the hosted edition; only self-hosting the open-source editor keeps boards in the customer's own chain. 5 6 7
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
Both public tiers are fully priced — Free forever with one scene, unlimited collaborators and 10 AI requests a day, Plus at $6 a month per user with annual billing saving 14% and guests free on both plans — plus a 14-day trial, cancellation at the end of the paid term and stated sales tax treatment. What keeps it from the top is that the enterprise tier is only 'coming soon' and no price is published for a self-hosted edition, so a larger client cannot yet compute its complete annual cost. 3 4 6 8 10
The Product Team Lead
I can compute a real annual cost from the public pages alone: "Free forever" with one infinite scene and 10 AI requests a day, Plus at "$6 a month per user" with "Annually save 14 %", 100 AI requests a day or bring your own key, guests free on both plans, "14 days of free trial", all purchases non-refundable and sales tax added as required. What I cannot compute is minimum seats, the contract term, VAT treatment for an EU buyer, or any price for the Enterprise tier and the self-hosted licence, both of which the captured pages mark as coming soon. 3 6 8 10
The Microsoft 365 Admin
Free and Plus are priced plainly — Free forever with one scene, unlimited collaborators and 10 AI requests a day; Plus at "$6 a month per user" with 100 AI requests, guests free on both plans, a 14% annual saving, a 14-day trial and sales tax treatment stated. The Enterprise tier is only "coming soon" and unpriced, we found no public information on the cost of the self-hosted edition, and no minimum seats or term are stated. 3 4 6 8 10
The Works Council Member
Free and Plus are fully public: Free forever with one infinite scene, unlimited collaborators and 10 AI requests a day; Plus at $6 a month per user in USD with 100 AI requests a day or your own key, guests free on both plans, a 14% annual saving, a 14-day trial, and non-refundability and sales tax treatment stated. The enterprise tier is announced only as coming soon, so its price and any licence for self-hosting are not published. 3 6 8 10
The Public-Sector Project Lead
The two purchasable plans are fully public — the free plan with one infinite scene, unlimited collaborators and ten AI requests a day, and Plus at $6 a month per user in USD with 100 AI requests a day, bring-your-own-key, a 14-day trial and 14% saved on annual billing — and guests are free on both plans. The enterprise tier is listed only as coming soon without a price, and we found no public information on the cost of the self-hosted edition, minimum seats or European VAT treatment; the terms state all purchases are non-refundable and that prices may change at any time. 3 4 6 8 10
The Skeptic
Two tiers are fully public: free forever with one scene, unlimited collaborators and ten AI requests a day; Plus at $6 a month per user with 100 AI requests a day or bring-your-own-key, guests free, annual billing saving 14%, a 14-day trial, non-refundable purchases and sales tax added as required. The enterprise tier is only 'coming soon' and unpriced, and we found no minimum seats or term stated. 3 8 10 6
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Excalidraw+
Is Excalidraw+ European?
Yes. whats-best.ai classifies Excalidraw+ as EU-Made.
Where does Excalidraw+ store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention United States as hosting location, per the vendor’s page captured 1 Nov 2026.
Does Excalidraw+ have a free plan?
Yes. Excalidraw+ has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Excalidraw+?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Excalidraw+ alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (17)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage plus.excalidraw.com Checked 1 Nov 2026 Details →
- 2 Documentation plus.excalidraw.com Checked 1 Nov 2026 Details →
- 3 Pricing page plus.excalidraw.com Checked 1 Nov 2026 Details →
- 4 Security / trust page plus.excalidraw.com Checked 1 Nov 2026 Details →
- 5 Privacy policy plus.excalidraw.com Checked 1 Nov 2026 Details →
- 6 Terms of service (with company details) plus.excalidraw.com Checked 1 Nov 2026 Details →
- 7 Data processing agreement (dpa) plus.excalidraw.com Checked 1 Nov 2026 Details →
- 8 Canvas, templates & content — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 9 Canvas, templates & content — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 10 Workshop facilitation & participation — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 11 Integrations, import & export — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 12 Integrations, import & export — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 13 Sharing, permissions & administration — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 14 Sharing, permissions & administration — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 15 Security, AI controls & deployment — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 16 Security, AI controls & deployment — found from sitemap plus.excalidraw.com Checked 1 Nov 2026 Details →
- 17 Code repository (open-source licence) — found from the homepage github.com Checked 1 Nov 2026 Details →