Online Whiteboard
Miro
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by RealtimeBoard Inc. dba Miro · miro.com
Compare with Conceptboard → Compare with Mural → Compare with Microsoft Whiteboard → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Miro at a glance
- Vendor
- RealtimeBoard Inc. dba Miro
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention the EU, the US, Australia and Japan source, captured 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Starting price
- “Starter For small teams collaborating regularly with unlimited boards €8/month per member, billed yearly” (vendor’s words) source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Miro 3.5/5, the mean of 6 judges. Miro, an online whiteboard from RealtimeBoard Inc. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Miro, an online whiteboard from RealtimeBoard Inc. dba Miro of San Francisco, scores strongest on facilitation 7 to 8, access and administration 7 to 8, and security and deployment 7 to 8: guests join by QR code or link with no account, SAML single sign-on starts on the Business plan with SCIM provisioning and Enterprise audit-to-SIEM, and AI can be blocked outright by an administrator. Weakest is sovereignty 5 to 7, where the judges genuinely split — the public-sector and works-council scores sit at 5 because the contracting party is the San Francisco entity under California law and the subprocessors named on the trust page (AWS, Anthropic, Braze, ElevenLabs, Gainsight) all sit in the United States, while others credit the published data processing agreement with Dutch-law EU Standard Contractual Clauses and EU residency on every plan — followed by pricing transparency 5 to 6, where self-serve prices are public but Enterprise is 'Custom pricing—from 30 members' with unpriced add-ons. No captured page names an export format, and the captured pages give different figures for the integration count — over 160 on one, 250+ on others.
Speaks for it
- Facilitation scores run 7 to 8 on joining by QR code or link with no account or installs, plus a timer, dot voting, polls, breakout frames and Bring Everyone to Me
- Access and administration scores run 7 to 8 on SAML single sign-on from the Business plan, SCIM and just-in-time provisioning, Company/User/Content admin roles, and audit logs with SIEM integration on Enterprise
- Security and deployment scores run 7 to 8 with TLS 1.3 in transit, 256-bit AES at rest, annual independent penetration tests, and administrator control that can block Miro AI or MCP outright
- Self-serve prices are public — Free at €0, Starter at €8/month per member, billed yearly, Business at €20/month per member, billed yearly — with 50 AI credits/member/month on Business and a 14-day Business trial
- EU data residency is included on every plan, alongside a published data processing agreement with EU Standard Contractual Clauses governed by Dutch law
Held against it
- Pricing transparency scores cluster at 5 to 6, with the Enterprise tier at 'Custom pricing—from 30 members' and the classification, key-management, eDiscovery and premium-support add-ons carrying no prices
- Export is evidenced only contractually — within 30 days of term end, 'using the export features described in the Documentation' — and no captured page names a format, with webhooks and two-way Jira sync not described
- Sovereignty scores span 5 to 7 on the San Francisco contracting entity under California law, with the privacy policy warning that collected data may be transferred to and processed in the United States
- We found no public information on how guests and viewers are counted or the free plan's board limits, so the annual cost of a deployment cannot be computed from public pages
- The accessibility claim reads 'built to meet enterprise accessibility standards' with no published conformance report behind it
Best for
- You run workshops and retrospectives where external participants must join instantly by QR code or link, with no accounts or installs
- Your IT team wants SAML single sign-on with Microsoft Entra ID, SCIM provisioning and audit logs streamed to your SIEM on Enterprise
- You need governable AI use — blocking Miro AI or MCP by classification level, prompt blocking, provider choice and AI audit trails — accepting that several of these are Enterprise paid add-ons
- You need EU data residency available on self-serve plans rather than gated to the Enterprise tier
Avoid if
- Your data protection officer rejects a US-based contracting and processing chain: the contracting party is RealtimeBoard Inc. dba Miro of San Francisco under California law, and AWS, Anthropic, Braze, ElevenLabs and Gainsight are all listed as United States
- You must compute the full annual cost before signing: Enterprise is custom-priced from 30 members, the governance add-ons are marked 'Paid add-on' with no figures, and guest counting is not described
- Your handover workflow needs named export formats or webhooks — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 3 of 5 |
| Workshop facilitation & participation | 3.5 of 5 |
| Integrations, import & export | 3.5 of 5 |
| Sharing, permissions & administration | 4 of 5 |
| Security, AI controls & deployment | 3.5 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
The infinite canvas, sticky notes, frames and 7,000+ templates cover everything I build the evening before a session, and the diagram page (flowcharts, ERDs, UML), the mind-map templates and video/audio walkthroughs embedded on the board go well beyond basics. What holds me back from the top band is that search across boards, tables and kanban on the board, and stated limits for large boards are not described on the pages I read. 2 13 14 16
The Product Team Lead
The infinite canvas carries sticky notes, frames, video and audio walkthroughs, and technical diagramming with named notations — flowcharts, ERDs, UML class and sequence diagrams — all described as living on a single board, backed by 7,000+ templates. That covers our story maps, planning and architecture sketches. The captured pages don't describe tables and kanban on the board, search across boards, centrally managed organisation templates, or documented limits for large boards, so I stop short of the top. 2 13 16 7
The Microsoft 365 Admin
The captured pages describe an infinite canvas with sticky notes, 7,000+ templates, flowcharts, ERDs and UML and sequence diagrams on one board, embedded video and audio walkthroughs, and comments with tagging on any element. We found no public information on tables, kanban, mind maps, search across boards, large-board limits, or AI clustering with its data use stated. 2 13 16
The Works Council Member
An infinite canvas with sticky notes, 7,000+ templates, frames with a presentation mode, and technical diagramming — flowcharts, ERDs, UML class and sequence diagrams — edited live by several people with comments, tagging and Talktrack video walkthroughs on the same board is well documented. We found no public information on search across boards, stated limits for large boards, own templates for the organisation, or AI that clusters or summarises notes with its data use stated, which keeps this below the top levels. 2 13 16
The Public-Sector Project Lead
An infinite canvas, sticky notes, a library of 7,000+ templates and serious diagramming — flowcharts, ERDs, UML class and sequence diagrams on a single board, with video and audio walkthroughs embedded — cover our workshop and process-mapping needs well. We found no public information on search across boards, documented limits for large boards, or AI clustering and summarising of notes with its data use stated. 2 13 16 7
The Skeptic
An infinite canvas with sticky notes and frames, 7,000+ templates, flowcharts through UML and sequence diagrams on a single board, and AI-generated slides are all on the record. We found no public information on search across all boards, documented object or participant limits for large boards, tables and kanban on the same board, or templates managed centrally for the organisation. 2 13 14 16
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
This is nearly my whole kit list: people join by QR code or link with no installs and no account, there is a timer, dot voting, polls anyone can answer from a phone, a private anonymous mode, Bring Everyone to Me, live reactions and breakout frames, plus presentation mode through frames and locking of sections. The gaps to the next band are real for me: a voting-results export, a session agenda or facilitator panel and a published accessibility report are not described, and the only stated participant figure is Engage activities up to 50 participants on Business and Enterprise. 2 13 15 16 7 4
The Product Team Lead
Guests join by QR code or link with no account, and there is a timer, dot voting, polls, a private anonymous mode, breakout frames, Bring Everyone to Me and a frames-based presentation mode — everything my retros and quarterly plannings need, with participant limits stated for the engagement activities (50 on Business and Enterprise). Accessibility is addressed as a claim to meet enterprise standards. We found no public information on a published accessibility conformance report, a facilitator agenda panel, or export of voting results. 2 15 16 7 4
The Microsoft 365 Admin
Guests join by QR code or link with no account and no installs, there is a private and anonymous mode, a timer, dot voting and polls with instant results, breakout frames, bring-everyone-to-me, presentation mode through frames, locking of diagram sections, and boards running inside Teams meetings, with participant limits stated (up to 50 for Engage activities) and an accessibility claim. A published conformance report and session summaries with their data use stated would be needed to go higher. 2 4 7 13 15 16 18
The Works Council Member
People join by QR code or link with no account and no installs, and the pages document a timer, dot voting and polls, a private anonymous mode for notes, breakout frames, 'Bring Everyone to Me', presentation mode, per-member permissions with section locking, and a stated cap of 50 participants for Engage activities. The accessibility claim reads 'built to meet enterprise accessibility standards' with no conformance report behind it, and export of voting results is not described. 2 7 13 15 16
The Public-Sector Project Lead
This is close to what my workshops with other authorities need: people join by QR code or link from any device with no installs and no account required, and there is a timer, dot voting, polls, private anonymous mode, breakout frames, Bring Everyone to Me, presentation mode through frames, live reactions and locking of sections. The interactive activities are capped at up to 50 participants on Business and Enterprise, and while the vendor says the platform is built to meet enterprise accessibility standards, we found no published accessibility statement or conformance report. 15 2 16 13 7 4
The Skeptic
Joining by QR code or link without an account, a timer, dot voting and polls, a private anonymous mode, Bring Everyone to Me, presentation mode through frames, breakout frames, locking of sections and a statement about enterprise accessibility standards are all documented. We found no published accessibility conformance report, no participant limit beyond 'up to 50 participants' for Engage activities on paid plans, and no export of vote results. 2 4 7 13 15 16
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
The REST API, Web SDK, live iFrame embed, a marketplace with private apps and a documented Visio and Lucidchart import give this a real ecosystem, with named Jira, Confluence, Slack and Microsoft 365 integrations. But no page I read names the export formats — only that customers may export their content using the export features in the documentation — and a Jira two-way sync and webhooks are not described, which matters when a client wants the workshop output handed over. 17 6 18 7 11 13
The Product Team Lead
A documented REST API, a JavaScript Web SDK, Live Embed and an MCP server give my developers what they need for automation, and the Atlassian integration brings Jira tasks, dependency visualisation and Confluence embeds onto the board alongside 250+ tools and a marketplace; Visio and Lucidchart import is documented for Starter upward. The captured pages don't state that the Jira link is a two-way sync keeping cards and issues aligned, don't mention webhooks, and name no export formats — only that export is possible during the subscription term and 30 days after it. 4 17 18 7 11
The Microsoft 365 Admin
A documented REST API, a JavaScript web SDK, Live Embed via iFrame, oEmbed, a marketplace with private apps, over 250 corporate tools, Jira and Confluence, Microsoft 365 with Teams, and Visio and Lucidchart import are all shown. Export is thin in the capture: the terms promise export "using the export features described in the Documentation" within 30 days of term end, but no PDF, image or CSV export, no editable-format export and no webhooks are described. 4 6 7 11 17 18
The Works Council Member
A REST API, Web SDK, MCP server, Live Embed via iFrame, oEmbed, a marketplace and 250+ integrations including Jira, Confluence, Teams and Slack are documented, with import from Visio and Lucidchart from the Starter plan. Export is evidenced only contractually — customers may export their content 'using the export features described in the Documentation' — with no formats, no webhooks and no two-way Jira sync described, so how content leaves the platform stays open. 4 6 7 11 17 18
The Public-Sector Project Lead
Connections for over 250 tools including Slack, Confluence, Jira, Teams and Google Workspace, a REST API, Web SDK, Live Embed via iFrame, a marketplace and documented Visio and Lucidchart import give a ministry room to wire this into its landscape. The terms confirm export features exist during the term and 30 days after, but we found no public information on export formats, webhooks, or a two-way Jira sync. 17 18 13 7 11
The Skeptic
Named apps for Slack, Confluence, Jira and Google Workspace (the captured pages give different figures for the count — over 160 on one, 250+ on others), a REST API, Web SDK, Live Embed by iFrame, a marketplace, and documented Visio and Lucidchart import. The exit path is the weak link: the terms allow export 'using the export features described in the Documentation' within 30 days of term end and no captured page names a format, and we found no public information on two-way sync with Jira or webhooks. 6 7 11 13 17 18
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
SAML single sign-on on Business and Enterprise, SCIM with just-in-time provisioning, company/user/content admin roles, organisation-wide audit logs with SIEM integrations, sensitivity classification and automated retention are all documented, and departing employees lose access immediately. Domain capture, link expiry or password rules on shares, and what happens to a leaver's boards are not described on the captured pages. 21 7 19 4 5 11 13
The Product Team Lead
SCIM and just-in-time provisioning, SAML single sign-on from Business upward, admin roles split into company, user and content scopes, audit logs feeding a SIEM, sensitivity classification labels and automated retention are all documented — an admin story I could hand to our IT. Guardrails that block public sharing of highly classified boards also exist. We found no public information on domain capture, link sharing with expiry and password, guest-domain rules, or transfer of boards when a person leaves. 7 19 21 5 4
The Microsoft 365 Admin
SCIM and just-in-time provisioning, SAML single sign-on demonstrated with Microsoft Entra ID, Company/User/Content admin roles, central internal and external sharing controls, guardrails that stop high-sensitivity boards being shared publicly, audit logs with SIEM integration, automated retention, eDiscovery and classification labels are all evidenced, with single sign-on from the Business plan and audit-to-SIEM Enterprise-only. The captured pages do not show domain capture of existing shadow accounts, nor transfer of boards when a person leaves. 3 4 5 7 19 21
The Works Council Member
SCIM and just-in-time provisioning, SAML SSO, admin roles split into Company, User and Content Admins, audit logs that 'track every action across your organization — from board creation to sharing permission changes' with SIEM export, automated classification and retention, an eDiscovery API and guardrails that block public sharing of high-sensitivity boards are all documented. What is missing for our sign-off is a stated retention period for those audit logs and any word on domain capture of existing accounts. 4 5 7 19 21
The Public-Sector Project Lead
Administration reaches the depth procurement asks for: SAML single sign-on, SCIM and just-in-time provisioning, audit logs with SIEM integration, admin roles split into company, user and content scopes, data classification with guardrails that stop high-sensitivity boards being shared publicly, retention automation and a Discovery API. Most of this, including the audit logs, sits in the Enterprise plan, and we found no public information on domain capture or transferring a leaver's boards. 21 7 5 13
The Skeptic
SAML SSO from the Business plan up, SCIM and just-in-time provisioning, Company/User/Content admin roles, classification labels, audit logs with SIEM integration on Enterprise, and Intelligent Guardrails that stop high-sensitivity boards being shared publicly are all on the record. We found no public information on domain capture, link expiry and password controls, or the transfer of a leaver's boards. 4 5 7 19 21
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
TLS 1.3 in transit and 256-bit AES at rest are stated, encryption keys can sit in the customer's own AWS account as a paid add-on, and AI is genuinely controllable — administrator switch-off, choice of model providers, prompt blocking and AI audit logging — with Anthropic in the United States named as an AI subprocessor and a note that AI features may share limited data with Microsoft. Deletion is promised but without a stated period, and an on-premises or private-cloud edition, what managers can see of individual activity, and a works-council statement are not described. 21 8 7 11 12
The Product Team Lead
TLS 1.3 in transit and 256-bit AES at rest, customer-managed keys hosted in the customer's own AWS account, admin control over AI with model-provider choice, prompt blocking and named AI providers with their locations, plus annual penetration tests and deletion or return on termination give a strong picture. We found no public information on a dedicated, private-cloud or on-premises edition, on what managers can see of individual activity, or on a statement for works-council agreements — the last one matters for a rollout here in Germany. 20 21 8 11 12
The Microsoft 365 Admin
256-bit AES at rest and TLS 1.3 in transit, customer-managed encryption keys hosted in the customer's own AWS account, AI an administrator can block completely on boards at chosen classification levels, prompt blocking and moderation filters, AI providers named with locations (Anthropic and ElevenLabs in the United States), AI data handling and training restrictions, discovery of PII, PCI and PHI on boards, and permanent deletion on account deletion are all stated. We found no public information on an on-premises or private-cloud edition, on what managers can see of individual activity, or on works council materials. 5 8 10 20 21
The Works Council Member
Encryption in transit and at rest, customer-hosted keys in the customer's own AWS account, admin control to block Miro AI or MCP entirely, prompt blocking, provider choice, AI audit trails, data-loss controls and annual penetration tests are documented, and the AI subprocessors are named with their locations. But we found no public information on a dedicated-tenant or on-premises option, deletion follows unstated 'data deletion timelines and policies', and nothing describes what a manager can see of an individual's contributions or offers a works council statement. 8 10 12 20 21
The Public-Sector Project Lead
Encryption in transit and at rest, customer-hosted keys via AWS Key Management Service, annual independent penetration tests, sensitive-data discovery and unusually granular AI governance — administrator blocking, provider and model choice, own API keys, AI audit trails streamed to our security tools — are documented. But the key AI controls and key management are paid Enterprise add-ons, and we found no public information on an on-premises or private-cloud edition, a stated deletion period, or a statement for works councils. 21 8 20 11 7
The Skeptic
TLS 1.3 in transit and 256-bit AES at rest are stated, with bring-your-own keys hosted in the customer's AWS account, AI subprocessors named with their region (Anthropic, United States), admin controls that can block Miro AI or MCP outright, annual independent penetration tests, and deletion on account closure stated as permanent. No on-premises or private-cloud edition appears anywhere we read, no works-council statement, and several of these controls — key management, classification, prompt blocking — are Enterprise paid add-ons. 7 8 11 20 21
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
The contracting entity is RealtimeBoard Inc. dba Miro in San Francisco under California law, with an EU representative in Amsterdam and a Berlin-registered Miro DACH GmbH imprint; boards run on named AWS infrastructure with EU data residency included on every plan, though no page states which region hosts a new account by default. The subprocessor list is published and every provider named on the trust page — AWS, Anthropic, Braze, Gainsight, ElevenLabs — is in the United States, with the published data processing agreement relying on EU Standard Contractual Clauses under Dutch law plus Data Privacy Framework certification, and ISO 27001 and SOC 2 stated. European hosting is available and the chain is transparent, but the contracting party and the named processing chain sit on the US side, so this is the answer I would hand a client who asks where the board is stored: EU possible, US by company. 11 10 9 7 8 12 21
The Product Team Lead
EU data residency is included on every plan with boards in AWS EU data centers, a data processing agreement is published under Dutch law, and subprocessors are listed with locations alongside ISO 27001, SOC 2 and GDPR badges. But the contracting entity is RealtimeBoard Inc. of San Francisco, and the named subprocessors for AI (Anthropic), captions (ElevenLabs), email (Braze) and support (Gainsight) sit in the United States, with transfers to the US acknowledged in the privacy policy. A Berlin affiliate (Miro DACH GmbH) and an Amsterdam EU representative exist alongside the US entity, which is why I land above the middle rather than at it. 7 12 8 9 10 21
The Microsoft 365 Admin
The contracting entity is RealtimeBoard Inc. of San Francisco, with a Berlin affiliate named in the imprint that an order may identify and an EU representative in Amsterdam; EU data residency is on every plan on named AWS infrastructure, and a published data processing agreement with Standard Contractual Clauses, Data Privacy Framework certification and audit rights covers transfers. The listed subprocessors for AI, captions, email and support — Anthropic, ElevenLabs, Braze and Gainsight — are all United States, and the privacy policy warns that data may be transferred to and processed in the US, which keeps this short of the top levels. 7 8 9 10 11 12 21
The Works Council Member
The contracting party and data importer is RealtimeBoard Inc. of San Francisco under California law — the EU representative in Amsterdam and the German imprint company Miro DACH GmbH do not change that — while boards can live in AWS EU regions on every plan, though no page states which region hosts new accounts by default. The DPA with Dutch-law SCCs is published and twelve subprocessors are listed, but every named one — AWS, Anthropic, Braze, ElevenLabs, Gainsight — is a US company, and the privacy policy warns that data may be transferred to and processed in the United States. 7 8 10 11 12
The Public-Sector Project Lead
The contracting entity in the standard terms is RealtimeBoard Inc. dba Miro of San Francisco under California law and San Francisco venue — the imprint names a Berlin GmbH and an Amsterdam EU representative exists, but the data importer in the data processing agreement is the US company. EU data residency is available on every plan on AWS, subprocessors are listed with their locations, and ISO 27001 and SOC 2 are stated; the named AI, captions, email and support processors are all in the United States, and the privacy policy warns that collected data may be transferred to and processed in the United States — with our data protection officer that ends the conversation, and we found no public information on BSI C5. 11 9 10 12 8 7
The Skeptic
AWS's EU region is available on every plan, the data processing agreement is published with EU Standard Contractual Clauses under Dutch law, subprocessors are listed with their regions, and ISO 27001 and SOC 2 are stated. But the contracting party is RealtimeBoard Inc. dba Miro of San Francisco under California law, and the named chain — Anthropic for AI, ElevenLabs for captions, Braze for email, Gainsight for support — sits in the United States, with the privacy policy warning that collected data may be transferred to and processed in the United States. 7 8 10 11 12 21
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
Free is €0, Starter €8/month per member billed yearly, Business €20/month per member billed yearly with 50 AI credits/member/month, Enterprise is "Custom pricing—from 30 members", and the plan matrix even lists MCP calls per day and which items are paid add-ons. But how guests and external participants are counted, the free plan's board limits, prices for the add-ons, and VAT treatment are not stated, so I cannot compute the annual cost of a workshop series with twenty non-account guests. 7 4 11
The Product Team Lead
Prices are public: Free at €0, Starter at €8/month per member billed yearly, Business at €20/month per member billed yearly, Enterprise custom pricing from 30 members, with a yearly saving of 20%, a 14-day Business trial, 50 AI credits/member/month on Business and per-tier MCP call limits stated. Which features are gated to which plan is visible, including add-ons my security team would want — key management, automated classification, eDiscovery, prompt blocking — but those add-ons carry no prices. We found no public information on free-plan board limits, VAT treatment, or the cost of the Enterprise tier and residency migrations. 7 11
The Microsoft 365 Admin
Free at €0, Starter at €8/month per member, billed yearly, and Business at €20/month per member, billed yearly, are public together with per-tier limits such as 50 AI credits per member per month, MCP calls per day, and the plan gating of single sign-on and audit-to-SIEM; Enterprise is custom pricing from 30 members, and classification, key management, lifecycle management and eDiscovery appear only as unpriced "Paid add-on". Guest and viewer counting, free-plan board limits and VAT treatment are not described, so the real annual cost cannot be computed from public pages alone. 4 7 11
The Works Council Member
Free at €0, Starter at '€8/month per member, billed yearly', Business at '€20/month per member, billed yearly' with a 20% yearly saving, and per-tier inclusions down to '50 AI credits/member/month' and MCP call limits, plus the 12-month auto-renewal with 90 days' notice, are all public. But the Enterprise tier is 'Custom pricing—from 30 members', every governance add-on is marked 'Paid add-on' with no figure, and free-plan limits and guest counting are not stated, so the cost of a compliant deployment cannot be computed. 7 11
The Public-Sector Project Lead
Tiers are public with exact prices — Free at €0, Starter at €8/month per member, billed yearly, Business at €20/month per member, billed yearly — and the plan comparison unusually details inclusions such as 50 AI credits/member/month and 2,000 MCP calls per day. Enterprise is "Custom pricing—from 30 members", the add-ons we would need (key management, classification, eDiscovery, premium support, the AI blocking controls) carry no prices, and we found no public information on how guests or viewers are counted. 7 4 11
The Skeptic
The self-serve tiers are public with their inclusions — Free at €0, Starter at €8/month per member, billed yearly, Business at €20/month per member, billed yearly, each mapped against AI credits, MCP calls, SSO and data residency. But the Enterprise tier is 'Custom pricing—from 30 members', the classification, key-management and AI-trust add-ons carry no figures, and we found no public information on the free plan's limits or how guests and viewers are counted. 7 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Miro
Is Miro European?
No. whats-best.ai classifies Miro as Rest of world.
Where does Miro store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention the EU, the US, Australia and Japan as hosting locations, per the vendor’s page captured 1 Nov 2026.
Does Miro have a free plan?
Yes. Miro has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Miro?
As of 1 Nov 2026, the panel rates Collaboard (3.5/5), Klaxoon (3/5) and FigJam (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Miro alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data processing agreement, Legal entity, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 25 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 10 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 legal fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (online whiteboard) miro.com Checked 1 Nov 2026 Details →
- 2 Features page (meetings and workshops) miro.com Checked 1 Nov 2026 Details →
- 3 Integrations page miro.com Checked 1 Nov 2026 Details →
- 4 Features page (enterprise) miro.com Checked 1 Nov 2026 Details →
- 5 Features page (Enterprise Guard data protection) miro.com Checked 1 Nov 2026 Details →
- 6 API documentation developers.miro.com Checked 1 Nov 2026 Details →
- 7 Pricing page miro.com Checked 1 Nov 2026 Details →
- 8 Security / trust page trust.miro.com Checked 1 Nov 2026 Details →
- 9 Legal notice miro.com Checked 1 Nov 2026 Details →
- 10 Privacy policy miro.com Checked 1 Nov 2026 Details →
- 11 Terms of service miro.com Checked 1 Nov 2026 Details →
- 12 Data processing agreement (dpa) miro.com Checked 1 Nov 2026 Details →
- 13 Canvas, templates & content — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 14 Canvas, templates & content — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 15 Workshop facilitation & participation — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 16 Workshop facilitation & participation — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 17 Integrations, import & export — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 18 Integrations, import & export — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 19 Sharing, permissions & administration — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 20 Security, AI controls & deployment — found from sitemap miro.com Checked 1 Nov 2026 Details →
- 21 Security, AI controls & deployment — found from sitemap miro.com Checked 1 Nov 2026 Details →