Online Whiteboard
Mural
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Tactivos, Inc. dba Mural · www.mural.co
Compare with Miro → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Mural at a glance
- Vendor
- Tactivos, Inc. dba Mural
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Mural 3/5, the mean of 6 judges. Mural, an online whiteboard from Tactivos, Inc. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Mural, an online whiteboard from Tactivos, Inc. dba Mural, is strongest on access and administration at 7 to 8, with 7 on canvas and content, facilitation, and integrations and export. Judges credit SCIM provisioning with Entra ID and Okta, audit logs feeding a SIEM, link sharing switched off at workspace or company level, and a Jira two-way sync documented down to conflict handling. Security and deployment sits at 6: encryption and a detailed bring-your-own-key setup are on record, but we found no public information on an administrative switch for the AI features or stated deletion periods. Sovereignty is weakest at 3 to 4 — the contracting entity is Tactivos under California law, every listed subprocessor sits in the United States, and regional data residency is an Enterprise-plan, workspace-by-workspace option. Pricing transparency scores 5: the Free plan ($0 USD for unlimited members, three editable murals at a time) and Business (17.99 USD per member / month billed annually) are public; Enterprise is contact for pricing. Variation never exceeds one point; the lone 3 in sovereignty weighed where client boards are stored.
Speaks for it
- Facilitation features including timer, voting, private mode, summon and take control, and facilitator lock are listed as available on all plans
- Visitors join through a settable, expiring link without registering, and visitors are included in every plan
- SCIM provisioning is documented with Microsoft Entra ID and Okta connectors, a test sandbox, and the identity provider as single source of truth
- The Jira integration is a documented two-way sync with a stated conflict policy that Jira overwrites Mural
- Bring-your-own-key encryption keeps the customer's key in their own AWS KMS, with revocation cutting access within fifteen minutes
Held against it
- Sovereignty scores 3 to 4, with the contracting entity Tactivos, Inc. under California law and every listed subprocessor located in the United States
- Regional data residency is an Enterprise-plan, workspace-by-workspace option only, so the United States remains the default for all other plans
- The public API is described as beta with no guarantee that it will become generally available
- We found no public information on an administrative switch for the AI features or on a statement that board content does not train the models
- The Enterprise tier is contact for pricing, and we found no public price for the Team+ tier or for AI credits
Best for
- You run workshops where outside participants join through an expiring link without registering an account
- Your product or IT team works in Jira and wants a documented two-way sync with a stated conflict policy
- You administer membership at scale through Microsoft Entra ID or Okta and need SCIM provisioning, audit logs and SIEM support
Avoid if
- Your data protection officer has ruled out US-hosted boards
- Your procurement requires certifications such as BSI C5; the stated certifications are SOC 2 Type 2, ISO 27001 and Microsoft 365, with GDPR and CCPA compliance claimed
- Your exit plan depends on a generally available API or export beyond PowerPoint; the API is beta with no promise of general release
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 3.5 of 5 |
| Workshop facilitation & participation | 3.5 of 5 |
| Integrations, import & export | 3.5 of 5 |
| Sharing, permissions & administration | 3.5 of 5 |
| Security, AI controls & deployment | 3 of 5 |
| European sovereignty | 2 of 5 |
| Pricing transparency | 2.5 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
The infinite canvas carries sticky notes, text, shapes, connectors, images, files, tables, drawings and mind maps, with hundreds of built-in templates and my own templates published to the workspace on web, desktop and mobile apps — my evening-before prep is covered. Mural AI clusters, summarises, translates and generates ideas, flow charts and mind maps, with the models named. We found no public information on search across boards, kanban boards, or documented limits for very large boards. 2 6 12 13 21
The Product Team Lead
The board itself is well documented: a shared infinite canvas with sticky notes, text, shapes, connectors, images, icons, tables, drawings and mind maps, hundreds of built-in templates plus our own templates published to the workspace, and apps for web, Windows, macOS, Android and iOS. Mural AI clusters sticky notes by topic with a preview mode, summarises, translates and generates mind maps and flow charts with named models, which is more content help than most boards give. We found no public information on search across all boards, on documented limits for large boards, on kanban, or on live video embeds, so the top level stays out of reach. 1 2 6 12 13 21
The Microsoft 365 Admin
An infinite canvas with sticky notes, text, shapes, connectors, images, files, tables, drawings and mind maps is documented, plus built-in and organisation-published templates, and AI that clusters, summarises, translates and generates mind maps, flow charts and stakeholder maps with the underlying models named (GPT-5.1, GPT-5-mini). What holds it back for a company our size: we found no public information on search across all boards, on documented limits for large boards, or on a statement of how the AI uses board content. 2 6 12 21
The Works Council Member
The canvas is thoroughly documented: an infinite, resizable board carrying sticky notes, text, shapes, connectors, drawings, images, files, tables and mind maps, hundreds of built-in templates plus templates published to the workspace, and AI that generates, clusters, summarises and labels notes with the model behind each feature named. We found no public information on search across all boards, kanban views, or stated limits for large boards, and nothing on the pages we read about what happens to board content sent to the AI features. 1 2 6 12 13 21
The Public-Sector Project Lead
An infinite canvas with sticky notes, shapes, connectors, tables, mind maps, drawings and files is evidenced, templates number in the hundreds and can be published to our workspace for reuse, and the AI actions — generate, cluster, summarise, translate — are documented down to the model behind them. We found no public information on search across boards, documented limits for large boards, video embeds, or a statement of how the AI features use board content, so the top band is not reached. 2 6 12 13 21
The Skeptic
An infinite canvas with sticky notes, text, shapes, connectors, drawings, images, files and tables is on record, alongside hundreds of built-in templates, custom templates published to the workspace, and an AI suite that genuinely clusters, summarises, translates and generates mind maps and diagrams on named models. It stops short of the top level because we found no public information on search across boards, documented limits for large boards, or what the listed AI Terms actually say about data use. 2 6 12 13 21
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
This is the heart of my working week: visitors join by a settable, expiring link without registering on every plan, and timer, voting, private mode, summon and facilitator lock are all listed as available on all plans. The board runs inside Teams, Zoom and Webex meetings, and help-centre articles cover the screen reader, keyboard shortcuts and accessible facilitation. We found no public information on stated participant limits per board or breakout areas. 3 6 14 15 18
The Product Team Lead
Every session tool my teams need is on the list and available on all plans: summon and take control, timer, voting, private mode, facilitator lock, laser pointer, outline and instructions, reactions, and visitors joining by expiring link without an account. The board runs inside Teams, Zoom and Webex, and on the Enterprise plan guest facilitators can be granted these powers per user and revoked at any time. We found no public information on breakout areas, participant limits per session or voting-result export, and the accessibility material is help-centre guidance with a screen-reader article rather than a published conformance report. 2 3 6 14 15 18
The Microsoft 365 Admin
Facilitation is clearly the vendor's craft: timer, voting, private mode, summon and take control, facilitator lock, laser pointer and hide-and-reveal are available on every plan, guests on Enterprise can even be granted the full facilitation set and have it revoked by the mural owner, and murals run inside Teams, Zoom and Webex meetings. We found no public information on participant limits per session, breakout areas, or a published accessibility conformance report — only best-practice articles and the vendor's own note that it is still building out accessibility. 3 6 14 15 18
The Works Council Member
Facilitation is the best-evidenced area: summon and take control, timer, voting, private mode, facilitator lock, laser pointer, hide-and-reveal and the outline function are listed as available on every plan, visitors join through expiring links without an account, the board runs inside Teams, Zoom and Webex, and on Enterprise plans even guests can be granted the full facilitation set, revocable at any time. We found no public information on participant limits per session, a published accessibility conformance report, or exportable voting results, though dedicated articles cover screen reader support, keyboard shortcuts and accessible facilitation. 3 6 14 15 18
The Public-Sector Project Lead
Visitors join through an expiring link without an account and are asked only for a name — exactly how colleagues from other authorities would take part — and the facilitation features cover timer, voting, private mode, summon and follow, facilitator lock and hide-and-reveal on every plan, with the board running in the browser, which suits our locked-down machines. External consultants can even be granted full facilitation, though only on the Enterprise plan and only after Mural's own team enables it. The help centre documents a screen reader, keyboard shortcuts and accessible-mural guidance, but the vendor describes itself as just scratching the surface of accessibility, and we found no public information on breakout areas, stated participant limits or a published conformance report. 6 14 15 17 18
The Skeptic
Summon-and-take-control, timer, voting, private mode, facilitator lock, hide-and-reveal and an outline for following along are available on every plan, visitors join by expiring link without an account, the board runs inside Teams, Zoom and Webex, and Enterprise guests can be granted the full facilitation set. We found no public information on participant limits per session, breakout areas, an export of voting results, or a published accessibility conformance report — accessibility shows up as best-practice and screen-reader articles instead. 3 6 14 15 18
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
The Jira two-way sync is documented step by step — issues come in as cards, sticky notes become issues, Jira wins on conflict — and the canvas embed SDK, PowerPoint export and embedding into Confluence, Notion and hundreds of sites via Embedly cover the edges of a workshop's aftermath. The public API is described as beta with no guarantee of general release, and we found no public information on webhooks, an import from Mural or Mural-format boards, or a structured export of the notes. 3 5 16 17
The Product Team Lead
The Jira integration is the best-documented part of the product and exactly what I need: two-way sync, sticky notes converting into issue cards, an info panel where edits sync back, JQL-filtered bulk import, pasting an issue URL onto the canvas, and a stated conflict policy that Jira overwrites Mural. Linear, Asana and Rally also sync two ways, boards embed widely through Embedly, there is a canvas embed SDK for building collaboration into our own applications, and content exports to PowerPoint and to and from spreadsheets. The API is documented but explicitly in beta with no guarantee of general availability, and we found no public information on webhooks, on import from other whiteboards, or on a full account export in an open format. 3 5 16
The Microsoft 365 Admin
The Jira integration is a properly documented two-way sync with bulk import, field customisation and a merge-conflict policy that names Jira as source of truth, Asana, Linear and Rally also sync two ways, and there are Teams, Zoom, Webex and Slack apps, Confluence embedding, PowerPoint export and an embed SDK for third-party apps. The REST API is explicitly in beta with no commitment to general availability, and we found no public information on webhooks, import from other whiteboards, or an open-format export. 3 5 16
The Works Council Member
The Jira link is a documented two-way sync — issues become cards, sticky notes become issues, visible fields are configurable per project and Jira is respected as the source of truth on conflict — alongside two-way syncs with Asana, Linear and Rally, embedding into Confluence, Notion and Trello, and a canvas embed SDK. The public API is described as being in beta with no promise of general availability, and we found no public information on webhooks, import from other whiteboards, or export formats beyond PowerPoint and pasting content out to Google Sheets or Excel. 3 5 16 17
The Public-Sector Project Lead
The two-way Jira sync is documented in unusual detail — issues import as cards, sticky notes convert to issues, field sync and conflict handling are spelled out — and it sits alongside Asana, Linear and Rally syncs, apps for Teams, Zoom, Webex and Slack, embedding through Confluence Smart Links and Embedly, PowerPoint export and paste in both directions with spreadsheets. The REST API and the canvas embed SDK are explicitly in beta with no promise of general release, and we found no public information on import from other whiteboards or on webhooks, so moving a whole workspace out would rest on the API's beta terms. 3 5 16 17
The Skeptic
The two-way Jira sync is documented down to conflict handling, with Jira as the declared source of truth; Linear, Asana and Rally also sync both ways, murals embed in Confluence, Notion and hundreds of sites via Embedly, and both an API and an embeddable-canvas SDK exist — though the API is in beta with an express disclaimer that general availability is not promised. The exit is the weak point: PowerPoint export is described, and we found no public information on export as PDF, image or a CSV of the notes, nor on webhooks or import from other whiteboards. 3 5 16 17
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
SCIM provisioning is documented in detail with Microsoft Entra ID and Okta, link sharing can be switched off at workspace or company level, guest domains can be restricted, audit logs feed a SIEM such as Splunk, and murals transfer to a new owner when someone leaves. Two-factor authentication, IP allowlisting, confidential rooms and eDiscovery round out the enterprise set. We found no public information on domain capture of existing accounts or classification labels on boards. 4 6 7 18 19
The Product Team Lead
Administration is documented in real depth: SCIM provisioning with Entra ID and Okta connectors and a test sandbox, the identity provider as single source of truth, link sharing switched off at workspace or company level, guest domain restrictions, confidential rooms, ownership transfer when someone leaves, and audit logs pushed to Splunk or a SIEM with eDiscovery support. Member, guest and visitor types are clearly defined with conversion rules. We found no public information on domain capture of existing accounts, legal hold, data classification labels or how admin roles are split by scope. 3 4 6 7 18 19
The Microsoft 365 Admin
Nearly everything I need for a 2,400-seat rollout is documented: SAML SSO, SCIM provisioning with Entra ID and Okta connectors, a sandbox and identity-provider as single source of truth, audit logs with SIEM support and a Splunk integration, eDiscovery, data retention, link sharing that can be switched off at workspace or company level, guest domain restrictions and ownership transfer when someone leaves. The one gap that bites me with 600 free accounts already on our addresses: we found no public information on domain capture of existing shadow accounts, and just-in-time provisioning remains the default. 4 6 7 18 19
The Works Council Member
Administration reaches the depth a works council needs to review: SCIM provisioning that makes the identity provider the single source of truth, SAML single sign-on, link sharing switchable off at company level, guest domain restrictions, share links that expire or get reset, ownership transfer when someone leaves, and audit logs feeding SIEM and Splunk dashboards showing login activities, permission changes and admin actions. We found no public information on legal hold, data classification labels on boards, or domain capture of existing accounts, and the security page names data retention as a control without describing it. 3 4 7 18 19
The Public-Sector Project Lead
Single sign-on with SAML, SCIM provisioning with a sandbox to test before rollout and the identity provider as source of truth, audit logs with SIEM support including a Splunk dashboard, guest domain restrictions, link sharing switched off at company level, eDiscovery, confidential rooms and mural ownership transfer when someone leaves cover most of what our IT and records offices check. We found no public information on domain capture of existing accounts, legal hold or data classification labels, and data retention appears only as a control name without stated rules. 3 4 7 18 19
The Skeptic
SAML single sign-on, SCIM provisioning with the identity provider as the single source of truth, company-wide shutdown of link sharing, guest domain restrictions, audit logs feeding SIEM, eDiscovery, retention controls, confidential rooms and board transfer when someone leaves are all documented. We found no public information on domain capture of existing accounts, legal hold, or data classification labels on boards. 4 5 7 18 19
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
Encryption in transit and at rest is stated, and BYOK with the customer's key in their own AWS KMS is documented down to the data types covered and a fifteen-minute revocation effect, alongside SOC 2 Type 2 and ISO 27001 claims. The AI models are named and AI Terms exist as a document. We found no public information on an administrative switch for the AI features, a statement that customer boards do not train AI models, stated deletion periods, a private-cloud or on-premises edition, or a works council statement. 6 9 12 20 21
The Product Team Lead
Encryption in transit and at rest is stated, and the customer-managed-key offering is unusually well documented: our own key in our own AWS KMS, envelope encryption, revocation cutting access within 15 minutes, and a list of exactly which content types the key covers. Enterprise adds enforced two-factor for members and guests, IP allowlisting, file-type restrictions and session controls, with SOC 2 Type 2 and ISO 27001 stated on the trust page. We found no public information on an on-premises or private-cloud edition, on an admin switch for the AI features or whether board content trains them, on a stated deletion period, or on a works-council statement — that last one matters to me in Hamburg. 6 7 9 12 21
The Microsoft 365 Admin
Encryption in transit and at rest is stated, SOC 2 Type 2, ISO 27001 and Microsoft 365 certifications are claimed, and enterprise BYOK with the key in our own AWS KMS and access cut within 15 minutes of revocation is genuinely strong — though it is AWS-only, activation goes through Mural Support, and it turns the content library off. For my own checklist: deletion on termination is stated without a period, and we found no public information on an administrator switch to turn the AI off, a statement that customer content does not train the models, an on-premises or private-cloud edition, or a works council template. 4 9 12 21
The Works Council Member
Encryption in transit and at rest is stated, and the customer-managed key offering is unusually detailed — our key stays in our own AWS KMS, revocation cuts access within fifteen minutes, and the help pages list exactly which content is covered. The AI features name their models, but we found no public information on an administrative switch to disable them, on whether board content trains those models, or on where the AI processing happens. Deletion after termination is described without a stated period, and while audit logs, SIEM support and a Microsoft Defender integration for user activity are documented, we found no public information on what a manager can see of an individual's contributions and time on board. 3 4 7 9 12 21
The Public-Sector Project Lead
Encryption in transit and at rest is stated, and bring-your-own-key encryption is documented in real depth — our key in our own AWS KMS, revocation taking effect within fifteen minutes, and an explicit list of which content is and is not covered — alongside SOC 2 Type 2 and ISO 27001. We found no public information on an on-premises or dedicated edition, on whether administrators can switch Mural AI off, or on a statement that its GPT models do not train on customer boards; deletion on termination is described without a stated period, and with no BSI C5 among the stated certifications our procurement prerequisite of C5 or our own state data centre is not met on the public evidence. 6 7 9 12 21
The Skeptic
Encryption in transit and at rest is stated, SOC 2 Type 2 and ISO 27001 are on record, and BYOK is documented in real depth — the customer's own AWS KMS key, revocation taking effect within fifteen minutes, and an explicit list of what is and is not covered. But we found no public information on an administrative switch for Mural AI, on a statement that boards do not train the models (the AI Terms are listed as a document, not shown), on deletion periods, or on any on-premises or private-cloud edition; the AI models are named while the captured subprocessor page lists hosting, database, analytics and support providers and no AI provider. 6 9 11 12 20 21
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
The contracting entity is Tactivos, Inc. dba Mural under California law, every subprocessor on the published list — hosting, database, analytics, support, email, AI profile data — is located in the United States, and regional data residency is an Enterprise-plan, workspace-by-workspace option with the United States remaining the default for all other plans. A downloadable data processing addendum referencing GDPR exists, but we found no public information on a European entity, representative or EU hosting. For the client who asks where the board is stored before the session starts, the captured pages point to the United States. 6 9 10 11
The Product Team Lead
The contracting entity is Tactivos, Inc. dba Mural under California law, and the published subprocessor list is transparent, naming Amazon Web Services, Microsoft Azure, MongoDB, Salesforce, Pendo, Segment, Databricks and others — every one located in the United States — with data defaulting to North America and a regional residency option only for Enterprise workspaces. To the vendor's credit, a downloadable data processing addendum and the full subprocessor list with a subscription for updates are public. We found no public information naming a European region for the residency option, an EU contracting entity, or any European subprocessor in the chain, so the score reflects transparency about a wholly US chain rather than European placement. 6 9 10 11 21
The Microsoft 365 Admin
The contracting entity is Tactivos, Inc. in San Francisco under California law with venue in the Northern District of California, every listed subprocessor from AWS and MongoDB to Pendo, Segment and Databricks sits in the United States, and the BYOK documentation names North America as the default content region — while a downloadable data processing agreement and a public subprocessor list do exist, which is more than some show. Regional data residency is an Enterprise-plan, workspace-by-workspace option only, and we found no public information on an EU hosting region, an EU contracting entity or an on-premises edition. 9 10 11 21
The Works Council Member
Every subprocessor on the published list — hosting on AWS and Azure, the production database at MongoDB, support on Salesforce, analytics on Pendo, Segment and Databricks — sits in the United States; the contracting entity is Tactivos in San Francisco under California law with venue in San Jose, and payment is in United States dollars only. Regional data residency is an Enterprise-plan, workspace-by-workspace option with North America the default otherwise, and we found no public information on an EU contracting entity or EU representative. A data processing addendum is downloadable, and SOC 2 Type 2 and ISO 27001 are claimed. 6 9 10 11 21
The Public-Sector Project Lead
The chain is transparent but entirely American: Tactivos, Inc. of San Francisco is the contracting entity under California law with venue in San Jose, every listed subprocessor from hosting and database to analytics and support sits in the United States, and the United States remains the default storage location, with regional residency only an Enterprise-plan, workspace-by-workspace option whose EU availability is not stated. A data processing agreement is published and ISO 27001 and SOC 2 are claimed, but we found no public information on an EU contracting entity or representative, BSI C5, or a self-hosted edition — my data protection officer has ruled out US-hosted boards, so this is where the evaluation ends for us. 6 9 10 11 21
The Skeptic
The contracting entity is Tactivos, Inc. dba Mural in San Francisco under California law, every listed subprocessor — hosting, production database, analytics, support, marketing — sits in the United States, and customer content defaults to North America, with regional residency an Enterprise-plan, workspace-by-workspace option. A downloadable data processing addendum and a subscribable subprocessor list are more transparency than a bare privacy policy, but we found no public information on any EU contracting entity, EU representative or EU hosting in the chain. 6 9 10 11 21
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
The free plan is spelled out — 0 USD for unlimited members with three editable murals at a time — and Business is quoted as 17.99 USD per member / month billed annually with unlimited external users, while VAT treatment, USD-only payment and thirty-day invoice terms are stated in the terms. The Enterprise tier is "Contact for pricing", we found no public information on a price for the Team+ tier, and AI credits and data residency are not separately priced. 6 9 13 18
The Product Team Lead
The free plan is concrete — $0 USD for unlimited members, unlimited murals with 3 editable murals at a time, and visitors included in every plan — and Business is priced publicly at 17.99 USD per member / month billed annually with unlimited external users and single sign-on included. The Enterprise tier is "Contact for pricing", and the tiered Limited and Full Member prices, AI credits and the cost of data residency are not on the public pages, so I cannot compute our real annual cost without a sales conversation. The terms at least state VAT-exclusive fees, net-30 invoices and 1.5 percent monthly late interest on past-due amounts. 4 6 9 18
The Microsoft 365 Admin
The free plan is stated as $0 USD for unlimited members with three editable murals at a time, Business is 17.99 USD per member / month billed annually with SSO included, and the member/guest/visitor counting rules are explained down to Limited and Full Members. But the tier where SCIM, data residency, BYOK and the audit APIs live is contact for pricing, and we found no public information on the Team+ price or on AI credit pricing; fees are exclusive of VAT and payable in USD only. 6 9 18
The Works Council Member
The free plan and the Business tier carry public prices — zero USD for unlimited members with three editable murals at a time, and 17.99 USD per member / month billed annually — with visitors included in every plan and fees stated as exclusive of taxes including VAT. The Enterprise tier is contact-for-pricing, and we found no public information on the price of the Team+ tier or on any separately priced AI credits. 6 9 12
The Public-Sector Project Lead
The Free plan at $0 USD for unlimited members with three editable murals at a time and the Business plan at 17.99 USD per member / month billed annually, with single sign-on included and visitors free on every plan, are public and clear. But the Enterprise tier — where data residency, SCIM, audit logs and bring-your-own-key live — is only "Contact for pricing", and we found no public information on the Limited and Full Member rates, AI credit prices, minimum seats or term length, so my procurement office cannot compute the annual cost without a sales call. 4 6 9 18
The Skeptic
The free plan is concrete — "$0 USD for unlimited members" with unlimited murals but only three editable at a time — and Business is public at "17.99 USD per member / month billed annually" with visitors included in every plan and unlimited external users spelled out. The enterprise tier is "Contact for pricing", the captured pricing pages give no figure for the Team+ tier or the rates of the Limited/Full Member model, and we found no public information on AI-credit pricing, minimum seats or contract term. 6 9 18
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Mural
Is Mural European?
No. whats-best.ai classifies Mural as Rest of world.
Where does Mural store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Mural have a free plan?
Yes. Mural has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Mural?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Mural alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 19 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (21)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.mural.co Checked 1 Nov 2026 Details →
- 2 Features page www.mural.co Checked 1 Nov 2026 Details →
- 3 Integrations page www.mural.co Checked 1 Nov 2026 Details →
- 4 Features page (enterprise) www.mural.co Checked 1 Nov 2026 Details →
- 5 API documentation www.mural.co Checked 1 Nov 2026 Details →
- 6 Pricing page www.mural.co Checked 1 Nov 2026 Details →
- 7 Security / trust page www.mural.co Checked 1 Nov 2026 Details →
- 8 Privacy policy www.mural.co Checked 1 Nov 2026 Details →
- 9 Terms of service www.mural.co Checked 1 Nov 2026 Details →
- 10 Data processing agreement (dpa) www.mural.co Checked 1 Nov 2026 Details →
- 11 Subprocessor list www.mural.co Checked 1 Nov 2026 Details →
- 12 Canvas, templates & content — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 13 Canvas, templates & content — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 14 Workshop facilitation & participation — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 15 Workshop facilitation & participation — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 16 Integrations, import & export — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 17 Integrations, import & export — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 18 Sharing, permissions & administration — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 19 Sharing, permissions & administration — found from sitemap support.mural.co Checked 1 Nov 2026 Details →
- 20 Security, AI controls & deployment — found from sitemap www.mural.co Checked 1 Nov 2026 Details →
- 21 Security, AI controls & deployment — found from sitemap support.mural.co Checked 1 Nov 2026 Details →