# Excalidraw+ — Online Whiteboard

Excalidraw+ by Excalidraw s.r.o. holds a panel rating of 2.5/5 from 6 AI judges (category median 3/5), as of 2026-11-01. Provenance: EU-Made; sovereignty: not determined.

- Vendor: Excalidraw s.r.o. (https://plus.excalidraw.com)
- Category: [Online Whiteboard](https://whats-best.ai/software/online-whiteboard.md)
- Provenance (editorial classification): EU-Made
- Canonical page: https://whats-best.ai/software/online-whiteboard/excalidraw-plus
- Alternatives: https://whats-best.ai/software/online-whiteboard/excalidraw-plus/alternatives ([markdown](https://whats-best.ai/software/online-whiteboard/excalidraw-plus/alternatives.md))
- Data as of: 2026-11-06 · evaluated 2026-11-01 · oldest source captured 2026-11-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Excalidraw s.r.o.
- Headquarters: Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting: Default not stated; pages mention United States [S6]
- Free plan: Yes, per the vendor’s own page [S10]

## The panel's verdict

Excalidraw+ is the hosted team edition of the open-source Excalidraw whiteboard from Excalidraw s.r.o. of Brno, with persona-weighted totals spanning 4.6 to 5.3. Its strongest criteria are security and deployment, integrations and export and pricing transparency: judges cite a documented REST API and MCP server in public beta with export to PNG, SVG, JSON, PDF and PPTX, SOC 2 Type 1 and 2, annual penetration tests, and public prices for both purchasable plans — Free forever with one scene and unlimited collaborators, Plus at $6 a month per user — though the enterprise tier is only 'coming soon' and unpriced. Sovereignty is the weakest criterion: the captured pages give different figures for hosting — United States servers in the privacy notice and terms, EU-personnel access and non-EEA subprocessors in the 2026 agreement — and we found no public information on an EU hosting option. Facilitation and canvas and content split: diagrams, AI text-to-diagram and guest-link access are documented, while we found no public information on timers, voting, sticky notes or tables.

**Speaks for it:**
- A documented REST API and MCP server, both in public beta, with an SDK, a CLI and export to PNG, SVG, JSON, PDF and PPTX.
- Both purchasable plans are fully priced — Free forever with one scene and unlimited collaborators, Plus at $6 a month per user, annual billing saving 14%, guests free on both plans.
- TLS in transit and AES-256 at rest are stated, with SOC 2 Type 1 and 2, annual penetration tests, and end-to-end encryption for shared scenes on the free plan.
- Guests open a scene from a link without signing in and can read and write comments, with unlimited collaborators on the free plan.
- Workspace admins can switch off scene sharing and AI usage for the whole workspace, and audit logs are retrievable through the API.

**Held against it:**
- The captured pages give different figures for hosting: United States servers in the privacy notice and terms, EU-personnel access and non-EEA subprocessors in the 2026 agreement.
- We found no public information on an EU hosting option, and self-hosting of the Plus platform is marked in development.
- We found no public information on a timer, voting, a private or anonymous note mode, or a follow-the-facilitator view.
- We found no public information on which AI providers process board content or whether board content trains AI models.
- We found no public information on single sign-on, SCIM provisioning, retention rules or legal hold.

**Best for:**
- You run live working sessions where guests join from a link without an account, using built-in voice chat, screensharing and frames-based presenting.
- You want boards you can automate and archive: a public REST API and open JSON export give a documented exit path.
- You want plainly published per-user pricing: Free forever with one scene and unlimited collaborators, Plus at $6 a month per user, guests free on both plans.
- You need a workspace admin able to switch sharing and AI usage off for everyone, with audit logs retrievable through the API.

**Avoid if:**
- Your organisation requires the hosted service to run in the EU: the privacy notice and terms state servers in the United States, and we found no public information on an EU hosting option.
- You must budget the full year now: the enterprise tier is only 'coming soon' and unpriced, and the terms state prices may change at any time.
- You need the full Plus platform self-hosted today: the deployment page marks it in development, leaving only the open-source editor self-hostable now.
- You need objection rights over subprocessors: the processing agreement grants general authorization and names cancellation of the subscription as the sole remedy.

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price, or the judge found no public information on that criterion.

| Criterion | The Workshop Facilitator | The Product Team Lead | The Microsoft 365 Admin | The Works Council Member | The Public-Sector Project Lead | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Canvas, templates & content | 2.5/5 | 2/5 | 3/5 | 3/5 | 2/5 | 2/5 |
| Workshop facilitation & participation | 2/5 | 2/5 | 2/5 | 2/5 | 3/5 | 2/5 |
| Integrations, import & export | 2.5/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| Sharing, permissions & administration | 2/5 | 2/5 | 2.5/5 | 3/5 | 2.5/5 | 2/5 |
| Security, AI controls & deployment | 3/5 | 2.5/5 | 3/5 | 3/5 | 3/5 | 3/5 |
| European sovereignty | 2/5 | 2/5 | 2/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | 3.5/5 | 3/5 | 3/5 | 3/5 | 3/5 | 2.5/5 |
| **Weighted verdict** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** | **2.5/5** |

### The judges

- **The Workshop Facilitator** (v1.0): Freelance facilitator and agile coach who runs three to four remote workshops a week for clients from car suppliers to city utilities, most of them with participants who have never used the tool and will not create an account. Builds the board the evening before from their own templates. Needs guests in by link, a timer, anonymous brainstorming, dot voting and a way to pull twenty people to the same frame, and a client who asks where the board is stored before the session starts.
- **The Product Team Lead** (v1.0): Leads three product teams at a logistics software company in Hamburg, with developers in Poland and Portugal. The board is where story maps, quarterly planning, architecture sketches and retrospectives happen, and the outcome has to land in Jira without anyone retyping it. Wants diagrams and sticky notes on one board, a two-way sync with the tickets, an API for the team's own automation, and an export that still makes sense when the company switches tools.
- **The Microsoft 365 Admin** (v1.0): Runs Microsoft 365 and Teams for a machine builder with 2,400 staff and found 600 free whiteboard accounts on company addresses, boards shared publicly by link among them. Has to decide between the whiteboard that comes with Teams and a licensed one. Wants single sign-on, SCIM, domain capture of the existing accounts, sharing rules set once for everyone, audit logs in the SIEM, retention rules, and an AI that can be switched off until legal has read the terms.
- **The Works Council Member** (v1.0): Sits on the works council of an insurance company and leads its IT committee, which has to agree before any tool that could show who did what goes live (§87(1) no. 6 BetrVG). Reads the admin documentation before the feature page: whether contributions and time on board are tracked per person, what a manager can see, how long logs are kept, what the AI does with retrospective notes, and where the boards are stored and by whom.
- **The Public-Sector Project Lead** (v1.0): Leads the digitalisation programme of a state ministry and runs workshops with municipalities, agencies and external consultants. The data protection officer has ruled out US-hosted boards, and procurement asks for BSI C5 or an on-premises installation in the state data centre. Needs guests from other authorities without accounts, a board that works in the browser on locked-down machines, an accessibility statement, and a contract the procurement office can sign.
- **The Skeptic** (v1.0): Has seen a free plan with "unlimited members" that locks every board after the third, "EU data residency" that covers the database but not the AI, and an export that turns two years of workshops into a stack of PNGs. Reads that a product is "enterprise-grade" and asks who can open a board shared by link, whether the boards train anyone's model, what the export keeps — and what leaving would cost.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Hosting location | Not determined | — | — |
| Hosting options | Not determined | — | — |
| Open source | Not determined | — | — |
| Data processing agreement | Not determined | — | — |
| Transfer impact assessment | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Analytics privacy: GDPR-compliant SimpleAnalytics · self-hosted Umami [S4]
- Application level encryption: Access tokens and keys encrypted at application level before DB storage [S4]
- Application level encryption: yes [S16]
- Audit conditions: yes [S7]
- Breach notification: without undue delay [S7]
- Ci key scanning: Service role keys scanned during CI; build env vars filtered [S4]
- Cookies used: yes [S5]
- Dnt not honored: no [S5]
- Dora addendum: yes [S1]
- Dora addendum: yes [S16]
- Dora addendum: yes [S9]
- DPA available: yes [S1]
- DPA available: yes · Data Processing Agreement (DPA) · DORA Addendum [S4]
- DPA available: yes [S9]
- DPA available: yes · yes [S3]
- DPA laws covered: EU GDPR · UK GDPR · Swiss data protection law [S7]
- DPA link: Auftragsdatenvereinbarungsvertrag (DPA) [S16]
- E2e encryption free: yes [S16]
- Eea UK rights: access · rectification · erasure · restriction · portability · objection · EEA · UK [S5]
- Encryption: AES-256 · TLS [S16]
- Encryption: yes · yes [S3]
- Encryption at rest: Excalidraw+ customer data · yes · yes [S4]
- EU only personnel access: yes [S7]
- Free e2e encryption: yes · yes [S4]
- GDPR analytics: SimpleAnalytics · Umami (self-hosted) · yes [S16]
- Github security integration: GitHub used for security updates & vulnerability scanning [S4]
- HIPAA fisma not supported: no · no [S6]
- Marketing cookies shared: yes [S5]
- Marketing opt out: yes [S5]
- Minors policy: 18 [S5]
- No data selling: no [S5]
- Non EU no access: no [S7]
- Opt out processing deadline days: 15 [S5]
- Payment processor stripe: Stripe · no [S4]
- Penetration testing: yearly [S4]
- Penetration testing: annual [S16]
- Privacy notice last updated: 2021-04-29 [S5]
- Scc on request: yes [S5]
- Scc transfers: https://plus.excalidraw.com/standard-contractual-clauses-sccs [S7]
- Security measures: access controls, encryption, monitoring, incident response, secure development practices [S7]
- SOC 2: yes · yes · Trust Center [S4]

**Data**
- Account deletion available: yes [S5]
- Accounts not auto deleted: no [S7]
- Backup practice: yes · yes [S6]
- Cancellation no deletion: no [S7]
- Daily backups: all customer databases · daily [S4]
- Deletion on request: yes [S7]
- Deletion or anonymization: delete · anonymize [S5]
- Ownership: yes [S6]
- Point in time recovery: yes · 14 [S4]
- Retention after account termination: 1 [S5]

**Hosting**
- Region: United States [S6]
- Self hosting oss: Open-source Excalidraw editor can be self-hosted [S2]
- Self hosting plus: Excalidraw Plus can be self-hosted on own infrastructure [S2]
- Server location: United States [S5]
- US subprocessors: yes · yes [S7]

**Integrations**
- API access values: lets them edit it · turns the link off · lets them view it · none · view · edit [S14]
- API auth: Bearer token in Authorization header [S14]
- API auth bearer: Bearer token · Authorization header [S12]
- API base URL: https://api.excalidraw.com/api/v1 [S12]
- API collection crud: POST · yes [S11]
- API collection soft delete: DELETE · soft-delete to trash · yes [S11]
- API collections endpoints: GET collections · Retrieve a paginated list of all collections visible to the API key. [S11]
- API endpoints: Collections · Invites · Logs · Scene Content · Scenes · Users · Workspace [S12]
- API feature flags: public beta · public beta [S12]
- API invites endpoints: workspace invites endpoints (get, get by ID, create, update, delete) [S11]
- API key creation: workspace settings · yes [S12]
- API key shown once: yes [S12]
- API link sharing admin restriction: 403 error when link sharing is disabled at workspace level · yes [S14]
- API link sharing endpoint: https://api.excalidraw.com/api/v1/scenes/{sceneId}/link-sharing · PUT · Turn the scene's public link on or off and return the link. [S14]
- API link sharing error codes: 400 · 401 · 403 · 404 [S14]
- API link sharing response: 200 · yes [S14]
- API logs endpoints: GET · yes [S11]
- API pagination: pagination used across list endpoints [S11]
- API pagination: yes [S12]
- API public beta: public beta · yes [S12]
- API rate limiting: yes [S12]
- API scene content: get, patch (merge), and PUT (replace) scene content including all drawing elements and files [S11]
- API scene share presentation: API can toggle shared presentation link for slides [S11]
- API scene share public link: API can toggle scene public link sharing [S11]
- API scene soft delete: scenes soft-deleted to trash via API [S11]
- API server URL: https://api.excalidraw.com [S14]
- API status: yes · public beta [S14]
- API status: public beta · yes [S11]
- API users endpoints: workspace users endpoints: get list, get by ID, update metadata, remove user [S11]
- API workspace endpoints: workspace endpoints: get/update workspace data, users, invites [S11]
- Cli available: yes · yes [S1]
- Github stars: 135000 [S10]
- Mcp available: public beta · yes [S11]
- Mcp bearer auth: Key sent as Authorization: Bearer <API_KEY>; missing or invalid keys return 401 [S13]
- Mcp keys workspace scoped: yes [S13]
- Mcp permission model: MCP tools map to public API routes; access granted only when route is allowed for key [S13]
- Mcp plus only: yes · yes [S1]
- Oss sdk: Open Source SDK with technical docs, architecture guides, and integration examples [S2]
- Rest API: RESTful API to create, manage, and automate scenes, collections, and workspaces [S2]
- Rest API: public_beta [S8]

**Legal**
- Address: 639 00 · Brno · Pražákova 1008/69 · Czech Republic [S6]
- Address: 639 00 · Brno · Pražákova 1008/69 · Czech Republic [S5]
- Arbitration seat: English · Brno, Czech Republic [S6]
- Dora addendum: yes [S6]
- DPA annexes: description-of-processing · technical-and-organizational-measures-toms · subprocessors [S7]
- DPA available: yes [S6]
- DPA available: yes [S5]
- DPA entity: Excalidraw s.r.o. [S7]
- DPA version: 2026-01-13 [S7]
- Entity: Excalidraw s.r.o. [S5]
- Entity name: Excalidraw · Excalidraw s.r.o. [S6]
- Governing law: Czech Republic [S6]
- Governing law: Czech Republic [S7]
- Liability cap: amount paid in prior 1 month [S6]
- Terms effective date: 2022-06-01 · 2022-05-30 [S6]

**Pricing**
- Annual discount: annual billing saves 14% · USD · 14 [S10]
- Annual discount: 14 [S8]
- Annual discount: 14 [S3]
- Currency: USD [S8]
- Currency: USD [S6]
- Currency: USD [S3]
- Free AI: 10 [S3]
- Free e2ee: yes [S3]
- Free editor: 1 · yes [S3]
- Free export: png, svg, save to file [S3]
- Free integrations: Notion, Obsidian and other integrations [S3]
- Free plan: Free · 0 [S3]
- Free tier: Free forever [S10]
- Free tier: yes [S8]
- Payment methods: Visa · Mastercard [S6]
- Plus: USD · monthly · 6 [S10]
- Plus AI: yes · 100 [S3]
- Plus features: unlimited cloud workspace · enhanced sharing and access options · presentation tool [S1]
- Plus price: 6 [S8]
- Plus price: USD · monthly · 6 [S3]
- Plus trial: yes · 14 [S3]
- Plus trial days: 14 [S1]
- Price change rights: yes [S6]
- Recurring billing: yes [S6]
- Refund policy: no · end of current paid term [S6]
- Tax treatment: yes [S6]
- Trial: 14 [S8]
- Trial days: 14 · yes [S6]

**Product**
- Admin controls: workspace-wide · access · sharing · AI usage · yes [S4]
- Advanced sharing: yes [S10]
- Advanced sharing: yes [S8]
- AI available free: yes [S1]
- AI capabilities: unlimited · yes · yes [S3]
- AI flowchart generation: yes [S9]
- AI requests: 10 · 100 [S8]
- AI requests plus: 10 · 100 [S10]
- AI text to diagram: yes [S1]
- AI wireframe to code: yes [S1]
- API mcp beta: API & MCP are in public beta [S2]
- API mcp beta: API & MCP in public beta [S15]
- Backups: 14 · yes [S16]
- Byok: yes [S10]
- Byok: yes [S8]
- Byok: yes [S3]
- Cloud saving: cloud saving · 100 AI requests/day [S8]
- Collaboration sharing: invite by link, view-only access [S8]
- Collaborative workspace: yes [S10]
- Comments: yes [S10]
- Comments: yes [S8]
- Comments: yes [S9]
- Content private by default: yes [S6]
- Custom API: coming_soon [S8]
- Dashboard: yes [S10]
- Dashboard: yes [S8]
- Deployment choice: Users choose between self-hosting Excalidraw Plus or the open-source editor [S15]
- DPA not for special categories: yes [S7]
- DPA scope hosted only: DPA applies solely to hosted Excalidraw+ Services, not open-source editor [S7]
- Dsr assistance: yes [S7]
- Embed readonly links: yes [S8]
- Enterprise availability: demnächst verfügbar [S16]
- Enterprise coming soon: Excalidraw Enterprise coming soon [S4]
- Export formats: PNG · SVG · JSON [S10]
- Export formats: PNG · SVG · JSON [S8]
- Export pptx pdf: yes [S10]
- Flowchart types: Process, Swimlane, Data, Decision [S9]
- For education: yes [S1]
- Free tier: yes · yes [S1]
- Github stars: 135000 [S1]

**Subprocessors**
- General authorization: yes [S7]
- List URL: https://trust.excalidraw.com/subprocessors [S7]
- No objection rights: no [S7]
- Notification method: email notification and list update [S7]
- Payment data stored by stripe: Stripe · payment processing [S5]
- Stripe: Stripe · payment processing · PCI Service Provider Level 1 [S16]
- Third party categories: Cloud Computing Services · Communication & Collaboration Tools · Data Analytics Services · Data Storage Service Providers · Payment Processors · Performance Monitoring Tools · User Account Registration & Authentication Services · Website H… [S5]

**Support**
- Privacy policy URL: https://plus.excalidraw.com/privacy-policy [S6]
- Status page: yes · yes [S16]

77 more facts on the canonical page: https://whats-best.ai/software/online-whiteboard/excalidraw-plus

## Questions

### Is Excalidraw+ European?

Yes. whats-best.ai classifies Excalidraw+ as EU-Made.

### Where does Excalidraw+ store data?

The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention United States as hosting location, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13625).

### Does Excalidraw+ have a free plan?

Yes. Excalidraw+ has a free plan, per [the vendor’s page captured 1 Nov 2026](https://whats-best.ai/evidence/13644).

### What are the best alternatives to Excalidraw+?

As of 1 Nov 2026, the panel rates [Miro (3.5/5)](https://whats-best.ai/software/online-whiteboard/miro-whiteboard), [Collaboard (3.5/5)](https://whats-best.ai/software/online-whiteboard/collaboard-whiteboard) and [Klaxoon (3/5)](https://whats-best.ai/software/online-whiteboard/klaxoon) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Collaboard](https://whats-best.ai/software/online-whiteboard/collaboard-whiteboard) (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Excalidraw+ alternatives](https://whats-best.ai/software/online-whiteboard/excalidraw-plus/alternatives).

## What this page leaves out

- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://plus.excalidraw.com/ (checked 2026-11-01)
- [S2] Documentation: https://plus.excalidraw.com/docs (checked 2026-11-01)
- [S3] Pricing page: https://plus.excalidraw.com/pricing (checked 2026-11-01)
- [S4] Security / trust page: https://plus.excalidraw.com/security-and-compliance (checked 2026-11-01)
- [S5] Privacy policy: https://plus.excalidraw.com/privacy-policy (checked 2026-11-01)
- [S6] Terms of service (with company details): https://plus.excalidraw.com/terms-of-service (checked 2026-11-01)
- [S7] Data processing agreement (dpa): https://plus.excalidraw.com/data-processing-agreement-dpa (checked 2026-11-01)
- [S8] Canvas, templates & content — found from sitemap: https://plus.excalidraw.com/plus-ai (checked 2026-11-01)
- [S9] Canvas, templates & content — found from sitemap: https://plus.excalidraw.com/use-cases/flowchart (checked 2026-11-01)
- [S10] Workshop facilitation & participation — found from sitemap: https://plus.excalidraw.com/plus-presentations (checked 2026-11-01)
- [S11] Integrations, import & export — found from sitemap: https://plus.excalidraw.com/docs/api/endpoints (checked 2026-11-01)
- [S12] Integrations, import & export — found from sitemap: https://plus.excalidraw.com/docs/api/getting-started (checked 2026-11-01)
- [S13] Sharing, permissions & administration — found from sitemap: https://plus.excalidraw.com/docs/mcp/auth-and-permissions (checked 2026-11-01)
- [S14] Sharing, permissions & administration — found from sitemap: https://plus.excalidraw.com/docs/api/scenes/sceneId-link-sharing-put (checked 2026-11-01)
- [S15] Security, AI controls & deployment — found from sitemap: https://plus.excalidraw.com/docs/self-hosting (checked 2026-11-01)
- [S16] Security, AI controls & deployment — found from sitemap: https://plus.excalidraw.com/de/security-and-compliance (checked 2026-11-01)
- [S17] Code repository (open-source licence) — found from the homepage: https://github.com/excalidraw/excalidraw (checked 2026-11-01)

---

Cite as: whats-best.ai, "Excalidraw+ — Online Whiteboard", AI panel analysis, as of 2026-11-06. https://whats-best.ai/software/online-whiteboard/excalidraw-plus

Corrections: https://whats-best.ai/correct/1240?target=page