Online Whiteboard
Whimsical
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 6 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Whimsical, Inc. · whimsical.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Whimsical at a glance
- Vendor
- Whimsical, Inc.
- Headquarters
- Incorporated in United States source, captured 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Yes, per the vendor’s own page source, captured 1 Nov 2026
- Panel verdict
- The AI panel rates Whimsical 2.5/5, the mean of 6 judges. Whimsical is an online whiteboard. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 1 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Whimsical is an online whiteboard. Its scores are strongest on pricing transparency (6 to 7) and access and administration, where they cluster at 6; the weakest are sovereignty at 3 and security and deployment at 4. All three public tiers are priced per editor — Free at $0, Pro at $10 / Month / Editor, Business at $20 / Month / Editor — with guests and viewers free and unlimited on every plan, though we found no public information on AI pricing or minimum seats. The captured pages state the services are hosted in and provided from the United States on Amazon Web Services, with Whimsical, Inc. of Denver, Colorado as the contracting entity under Delaware law, and we found no public information on an EU hosting option. Facilitation and integrations and export both span 4 to 6: on facilitation, the workshop-facilitator judge finds the gear thin — voting is limited to workspace editors, and no presentation mode or object locking is documented — while the product-team lead finds the documented timer, voting and guest access sufficient for retrospectives.
Speaks for it
- All three public tiers priced per editor — Free at $0, Pro at $10 / Month / Editor, Business at $20 / Month / Editor — with annual billing saving 17% and guests and viewers free and unlimited on every plan
- SAML single sign-on and SCIM provisioning included with the Business tier, with setup guides for Okta, Entra ID and other identity providers, plus domain auto-join and the option for admins to block new workspaces
- Import guides for Miro, Mural, FigJam, Lucidchart, Lucidspark, Visio, Microsoft Whiteboard and more, with the Miro path documented object by object, down to what arrives as an empty rectangle
- A free template library spanning nine categories, with custom templates included on every plan
- A data processing addendum published as a PDF and incorporated by reference with no separate signature, alongside stated SOC 2 Type 2, encryption in transit (TLS 1.2 or better) and at rest (AES-256)
Held against it
- Voting is only available for workspace editors and cannot be reset for multiple rounds, leaving invited guests outside the vote
- Export covers image and Markdown with PDF via the browser's print dialog, and we found no public information on a documented API, webhooks or a CSV export of the notes
- We found no public information on an admin switch to turn the AI features off, on whether customer content trains the models, or on a stated deletion period
- The captured pages state the services are hosted in and provided from the United States on Amazon Web Services, and we found no public information on an EU hosting option
- We found no public information on audit logs, retention rules, legal hold, or what happens to a person's boards when they leave
Best for
- You are moving boards off Miro, Mural, FigJam, Lucidchart or Visio and want the transfer documented object by object before you commit
- You run sessions with external participants and want guests and viewers free and unlimited on every plan, with per-guest view, comment or edit rights
- You want SAML single sign-on and SCIM provisioning at a published tier price — Business at $20 / Month / Editor — rather than through a sales conversation
- You run product-team retrospectives where a shared timer and sticky-note voting are the core facilitation gear
Avoid if
- Your data protection officer rules out boards hosted in the United States under Delaware law — the captured pages state US hosting on Amazon Web Services, and we found no public information on an EU hosting option
- Your workshops need invited guests to vote, a presentation mode or locked objects — ask the vendor: the public pages we read do not show it
- You must compute the full annual cost before signing — we found no public information on AI pricing or minimum seats, and the pricing page stops at Business, pointing larger buyers to Contact sales
- Your works council asks what managers can see of individual activity — the privacy policy states Whimsical may disclose information about a user and their workspaces to that user's organisation, and we found no public information on what a manager can view
The scores
| Criterion | Panel median |
|---|---|
| Canvas, templates & content | 3 of 5 |
| Workshop facilitation & participation | 2 of 5 |
| Integrations, import & export | 3 of 5 |
| Sharing, permissions & administration | 3 of 5 |
| Security, AI controls & deployment | 2 of 5 |
| European sovereignty | 1.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Canvas, templates & content
Show reasoningHide reasoning
How this is scored
What can be put on the board and how fast: an infinite canvas, sticky notes, text, shapes and connectors, freehand drawing and pen input, frames and sections, images, files, documents and video embedded on the board, tables, mind maps, diagrams and flowcharts, a template library for workshops, retrospectives and planning, own templates for the organisation, search across boards, performance on large boards, and AI that clusters, summarises or generates content.
0 — Not a whiteboard; there is no shared canvas to put content on.
3 — A shared board with sticky notes, text, shapes and drawing; templates, embeds, diagrams and large boards are basic or not described.
5 — An infinite canvas with sticky notes, shapes and connectors, frames, images and files on the board, a template library for workshops, retrospectives and planning, own templates saved for the team, and the board usable on desktop, browser and tablet with pen input.
8 — Diagrams, mind maps, tables and kanban on the same board, embeds of live documents and video, templates managed centrally for the organisation, search across all boards, documented limits for large boards (objects, participants), and AI that clusters or summarises notes with its data use stated.
10 — A canvas a whole organisation builds on: structured data on the board (cards linked to records, custom fields), smart diagramming with shape libraries for named notations, offline work with conflict-free sync described, board performance at stated scale, and every content type exportable with its structure.
The Workshop Facilitator
The infinite canvas, sticky notes, shapes, connectors and frames are documented, and the template library carries exactly the categories I build sessions from — retrospectives and meetings, brainstorming and workshops — with custom templates included on every plan so I can save my own beforehand. Diagrams, mind maps, tables, video embeds and AI generation are evidenced as well, but we found no public information on search across boards, kanban, or documented limits for large boards. 1 3 9 10 14
The Product Team Lead
The infinite canvas carries diagrams, mind maps, tables and slide decks alongside sticky notes, shapes, connectors, frames and groups, with a nine-page template library that covers retrospectives, workshops and planning, custom templates on every plan, and AI flowchart and mind map generation. That is close to what my story maps and architecture sketches need; we found no public information on search across boards, documented performance limits for large boards, or tablet and pen input. 1 3 9 10 13 14
The Microsoft 365 Admin
The infinite canvas with sticky notes, connectors, frames, image upload and video embeds is documented, and the template library is genuinely deep — nine categories including retrospectives, meetings, brainstorming and workshops, plus UML, ER, swimlane and fishbone diagrams and AWS and Azure icon sets — with custom templates on every plan and AI that generates diagrams and mind maps. We found no public information on search across boards, centrally managed template libraries, stated limits for large boards, or the AI's data use. 1 3 9 10 14
The Works Council Member
The canvas is well documented: an infinite canvas with sticky notes, connectors, frames and groups, images and video embeds, a broad free template library covering retrospectives, workshops, meetings and planning, custom templates on every plan, and named notations such as UML, ER, swimlane, fishbone and AWS or Azure icon sets, plus AI flowcharts and AI mind maps. We found no public information on search across boards, on documented limits for large boards, or on what the AI does with the notes it organises — its data use is only referenced through supplementary AI terms whose content we could not read. This is deeper than a basic board, but organisation-wide content management is not described. 1 3 9 10 14
The Public-Sector Project Lead
The infinite canvas carries sticky notes, shapes, connectors, frames, tables, images and embedded video, and the template library covers retrospectives, workshops, planning and named notations such as UML, ER and AWS or Azure icon sets, with custom templates included on every plan — a solid base for our agency workshops. We found no public information on search across boards, pen input or documented limits for very large boards, and the AI features are listed without any statement of their data use. 1 3 9 10 14
The Skeptic
An infinite canvas with sticky notes, connectors, frames, images and embedded video, mind maps, flowcharts and wireframes, a free template library spanning retrospectives, workshops and prioritization, and custom templates on every plan including Free. AI generates diagrams and organizes ideas, but we found no public information on search across boards, kanban, or documented limits for large boards, and the AI's use of board content is governed by separate AI terms whose terms the captured pages do not show. That is well above a basic shared board, short of the top tier. 1 3 9 10 14
Workshop facilitation & participation
Show reasoningHide reasoning
How this is scored
What it takes to run a session on the board: guests who join without an account, a timer, voting and dot voting, a private or anonymous mode for notes, bringing everyone to the facilitator's view (summon, follow), a presentation or frame mode, locking objects, reactions, breakout areas, an agenda or session plan, built-in audio or video or the call apps the board runs inside, participant limits, and accessibility for participants (keyboard, screen reader, contrast).
0 — No real-time collaboration; only one person can work on a board at a time.
3 — Several people edit the same board in real time and see each other's cursors; facilitation tools and guest access are basic or not described.
5 — Guests join by link without an account, a timer, voting, bringing participants to the facilitator's view, a presentation mode through frames, locking objects, and comments with mentions.
8 — A private or anonymous mode for brainstorming, voting with results and export, breakout areas or assigned frames, a session agenda or facilitator panel, the board running inside Teams, Zoom or Webex meetings, participant limits per session stated, and an accessibility statement for the board.
10 — Facilitation that a large event runs on: hundreds of participants per board with stated limits, facilitator controls over who may edit what and when, session recordings or summaries with their data use stated, a published accessibility conformance report (WCAG), and facilitation features documented step by step.
The Workshop Facilitator
The basics I cannot run a session without are partly there: anyone with a link can view, comment or edit with an option to extend that to people without an account, a timer visible to everyone on the board with presets up to 99 minutes, and voting on sticky notes. The pages state voting is only available for workspace editors and cannot be reset for a second round, and we found no public information on bringing participants to the facilitator's view, a presentation mode, locking objects, or the board running inside Teams, Zoom or Webex. 1 11 12 15
The Product Team Lead
The timer and voting are documented step by step — configurable votes per person, results displayed on the sticky notes, live cursors disabled during voting — and guests join by link without an account, with an option to extend comment or edit rights to people who have no Whimsical account. For my retrospectives, we found no public information on bringing participants to the facilitator's view, a presentation mode, breakout areas, the board running inside Teams, Zoom or Webex, or an accessibility statement. 1 11 12 15 16
The Microsoft 365 Admin
Real-time multiplayer editing, a timer visible to everyone on the board, and configurable sticky-note voting with results shown are documented step by step, and anonymous commenting or editing by link can be extended to people without an account. We found no public information on bringing participants to the facilitator's view, a presentation mode, locking objects, breakout areas, participant limits, or accessibility for participants. 1 11 12 15
The Works Council Member
The timer and the voting are documented step by step — configurable votes per person, results shown on the sticky notes, live cursors disabled during voting to avoid bias — and anyone with a link can view, comment or edit, with anonymous access extendable to people without a Whimsical account, all on top of stated real-time multiplayer editing. We found no public information on a private or anonymous mode for notes, on bringing everyone to the facilitator's view, on a presentation mode, on locking objects, on breakout areas, or on accessibility for participants. The basics of a session are there and clearly written up, but half of what a facilitator needs for a controlled workshop is not described. 1 11 12 15
The Public-Sector Project Lead
A timer with presets, mute and up to 99 minutes 59 seconds, and sticky-note voting with configurable vote counts and live results are documented well enough to actually run a session, and link access can be extended to people without an account for anonymous comments and edits. We found no public information on a presentation or frame mode, bringing participants to the facilitator's view, locking objects, breakout areas or an accessibility statement — the last being something our procurement would insist on for workshops with external authorities — and voting is limited to workspace editors, which leaves invited guests outside the vote. 11 12 15 16
The Skeptic
Multiplayer editing is real, the timer is documented down to per-user mute settings, and voting works with a configurable vote count, results shown on the sticky notes and cursors hidden during the session; link access can even be extended to people without a Whimsical account for comments and edits. But voting is limited to workspace editors, so guests sit out the vote, and we found no public information on bringing everyone to the facilitator's view, a presentation mode, locking objects, breakout areas, participant limits, or accessibility for participants. A workshop can run here, on thin facilitation gear. 1 11 12 15
Integrations, import & export
Show reasoningHide reasoning
How this is scored
How the board connects to the work around it and whether the content can leave: apps for Teams, Zoom, Webex, Slack and Google or Microsoft files, a two-way sync with Jira, Azure DevOps or other work tools, embedding boards in Confluence, SharePoint or intranets, a documented REST API and webhooks, import from Miro, Mural or other boards and from CSV or images, and export as PDF, image, CSV of the notes or an editable file another tool can open.
0 — No integration and no export of any kind; content can only be viewed on the vendor's board.
3 — Export as image or PDF and a few named integrations; an API, imports and structured export are basic or not described.
5 — Apps for at least Teams or Zoom and Slack, an integration with Jira or another work tool, embedding a board in other tools, export as PDF, image and CSV of the notes, and a documented API.
8 — A two-way sync with Jira or Azure DevOps that keeps cards and issues aligned, a REST API with webhooks covering boards and items, import from other whiteboards documented, an export in an editable or open format, and a marketplace or app framework for extensions.
10 — Integration and exit both complete: an API that can read and write everything the board holds, a full account export in an open format that another tool imports with structure kept, SDKs or an embeddable board for own applications, and the export and deletion on termination documented.
The Workshop Facilitator
Import from Miro, Mural, FigJam, Lucidchart, Visio and more is documented in unusual depth — the Miro path spells out object by object what comes across and what arrives as an empty rectangle — and boards embed into a long list of apps including Confluence and Notion, with Slack, Jira and GitHub integrations on all plans. Export runs to image, Markdown and PDF via the browser print dialog; we found no public information on a REST API or webhooks, CSV export of the notes, or apps for the meeting platforms. 2 3 13 14 15
The Product Team Lead
Import is the strongest part: documented move paths from eleven tools including Miro, Mural, FigJam and Visio, with the Miro copy-and-paste behaviour spelled out object by object, plus Slack, GitHub, Notion and embeds into Confluence and eleven other apps. But the Jira integration is previews and smart links rather than the two-way sync my teams would live in, export is image or Markdown, and we found no public information on a REST API, webhooks or a CSV export of the notes; the MCP server is the only programmatic surface shown. 2 13 14 15
The Microsoft 365 Admin
Migration into Whimsical is the best-documented part: import guides for Miro, Mural, FigJam, Lucidchart, Lucidspark, Visio, Microsoft Whiteboard and more, with the Miro transfer detailed down to which formatting survives; Slack, GitHub, Jira smart links, Linear, Notion and Google Docs are named, boards embed into Confluence, Trello, Asana and others, and export covers image and Markdown plus PDF through the browser print dialog. We found no public information on a documented API with webhooks, CSV export of notes, a two-way sync with Jira or Azure DevOps, or an app marketplace. 2 13 14 15
The Works Council Member
Arriving and embedding are the strong side: import guides exist for Miro, Mural, FigJam, Lucidchart, Lucidspark, Visio, Microsoft Whiteboard, Excalidraw, tldraw, Canva and draw.io — the Miro path is documented object by object, including what stays behind — and boards can be embedded into Confluence, Notion, Trello, Asana and a dozen other tools, with Slack, GitHub, Linear and Jira integrations and an MCP server for AI clients. Export is documented as an image or Markdown for boards and docs, with printing to PDF; we found no public information on a CSV export of notes, a REST API, webhooks, or a two-way sync with Jira or Azure DevOps. Structured, tool-to-tool exit is therefore not evidenced. 2 13 14 15
The Public-Sector Project Lead
Migration is documented in unusual depth, with guides for moving from Miro, Mural, FigJam, Lucidchart, Visio and others — including which objects survive and an offer to match remaining contract time with credits — alongside Slack, Jira, GitHub and Notion integrations and embeds in Confluence and many other tools. We found no public information on a REST API, webhooks or CSV export of the notes, and export runs to image, Markdown or PDF via the print dialog, so structured exit remains limited. 2 13 14 15
The Skeptic
Slack, GitHub, Jira, Linear, Notion and a dozen embed targets are named, and the Miro migration guide is unusually honest — images arrive as empty rectangles, comments, votes, tags and timers stay behind, colors are matched not copied. Import is documented from nine other whiteboard tools, and export covers image, Markdown, and PDF only through the browser's print dialog. The Jira connection is previews and smart links rather than a two-way sync, and we found no public information on a documented API, webhooks, or a CSV export of the notes — the exit door is narrow even if the entrance is wide. 2 13 14 15
Sharing, permissions & administration
Show reasoningHide reasoning
How this is scored
Who can see and change a board and how the organisation controls it: sharing by link with expiry and password, guest and external-user rules, roles per board, project and team, default sharing settings set by the admin, single sign-on (SAML, OpenID Connect), user provisioning (SCIM), domain capture and control of shadow accounts, audit logs, content retention and legal hold, transfer of boards when a person leaves, and admin reports.
0 — No accounts or permissions; anyone with a board's address can see and edit it, with no way to restrict it.
3 — Boards are shared with named people or by link with view or edit rights; admin controls, SSO and audit are basic or not described.
5 — Roles per board and per team, link sharing that can be restricted or switched off, guest access controlled by the admin, single sign-on with SAML, a user and board admin console, and boards transferred when a person leaves.
8 — SCIM provisioning, domain capture of existing accounts, sharing policies set centrally (no public links, guests only from allowed domains), audit logs exportable to a SIEM, retention rules and legal hold, data classification labels on boards, and admin roles split by scope.
10 — Administration that a regulated organisation can sign off: every sharing and access setting the admin controls listed with its effect, complete audit trails with a stated retention, eDiscovery and export for investigations, delegated administration across subsidiaries, and every control documented in the help centre.
The Workshop Facilitator
Link sharing can be set to view, comment or edit or disabled entirely with password protection available, guests sit in clean per-file roles of viewer, commenter or editor, and SAML single sign-on and SCIM provisioning come with setup guides for Okta, Entra ID and other identity providers. Domain auto-join and blocking new workspace creation on the domain are documented, but we found no public information on audit logs, retention rules, legal hold, or transferring boards when someone leaves. 3 15 16 17
The Product Team Lead
File-level permissions with view, comment and edit, link sharing that can be switched off entirely, password-protected files, guests confined to the files they were invited to, plus SAML SSO and SCIM with group provisioning on the Business tier, domain auto-join and admins able to block new workspaces. We found no public information on audit log export to a SIEM, retention rules or legal hold, data classification, or centrally enforced sharing policies. 3 7 15 16 17 18
The Microsoft 365 Admin
The Business tier publicly includes SAML single sign-on and SCIM provisioning with setup guides for Okta, Entra ID and JumpCloud, domain-based auto-join into the workspace, admins able to block creation of new workspaces on the domain, and an organisation's right to claim all its content — the exact levers I need to round up 600 shadow accounts. What I could not find is a sharing policy set once for everyone, audit logs exportable to a SIEM, retention rules or legal hold, or admin roles split by scope. 3 7 16 17 18
The Works Council Member
The role model is clearly tiered — members, free viewers, paid editors, guests restricted to the files they were invited to — with link sharing that can be set to view, comment, edit or disabled entirely, password-protected files from the paid plans, private files private by default, SAML single sign-on and SCIM provisioning with setup guides for Okta, Entra ID and others, and domain management through which org-plan admins can block new workspaces on the company domain. We found no public information on audit logs, on retention rules or legal hold, on centrally set sharing policies, on data classification, or on what happens to a person's boards when they leave. For a works council sign-off, those gaps weigh more heavily than the good role model does. 3 15 16 17 18
The Public-Sector Project Lead
Roles for members and guests with per-file view, comment and edit rights, link sharing that can be switched off entirely, password-protected files, SAML single sign-on, SCIM provisioning and domain auto-join with the option to block new workspaces give our IT department most of the levers it would configure. We found no public information on audit logs, retention rules or legal hold, centrally enforced sharing policies, or admin roles split by scope — questions our procurement office would ask before any signature. 3 15 16 17
The Skeptic
Link sharing runs from no access through view and comment to edit, files can be password-protected from Pro upward, guests are confined to the specific files they were invited to, and Business adds SAML single sign-on, SCIM provisioning with group support, private teams, and domain auto-join with the ability to block new workspaces. One detail to read twice: on the Free plan everyone has admin permissions — the workspace shares one key. We found no public information on centrally enforced sharing policies, exportable audit logs, retention and legal hold, or what happens to a person's boards when they leave. 3 15 16 17 18
Security, AI controls & deployment
Show reasoningHide reasoning
How this is scored
How the content of the boards is protected and where the product can run: encryption in transit and at rest, customer-managed encryption keys, a dedicated or private-cloud tenant and an on-premises edition, AI features that the admin can switch off and that do not train on customer boards, which AI providers process board content, data loss prevention, deletion of boards and accounts with stated periods, and whether individual activity (logins, contributions, time on board) is tracked and shown to managers, with a statement for works councils. Who processes the data and where, and the certifications, are scored under sovereignty.
0 — Content is not protected in transit, or boards are used for the vendor's own purposes by default with no way to opt out.
3 — Encryption is mentioned and the product is described as secure or GDPR-compliant; AI use, deletion and deployment options are basic or not described.
5 — Encryption in transit and at rest stated, AI features that the admin can switch off, a statement that customer content is not used to train AI models, deletion of boards and accounts with a stated period, and a security page describing the measures.
8 — Customer-managed keys or a dedicated tenant, a private-cloud or on-premises edition documented, the AI providers that process board content named with their location, data loss prevention or classification controls, individual activity tracking described with what managers can see, and a statement or template for works council agreements.
10 — Protection that can be verified: client-side or end-to-end encryption for boards with the method published, an on-premises or sovereign-cloud edition with feature parity stated, no AI processing outside the customer's chosen region, a published penetration test summary, and every security and AI control listed with its effect.
The Workshop Facilitator
The security page states encryption in transit and at rest, SOC 2 Type 2, yearly third-party penetration testing, encrypted separate-location backups and two-factor authentication, and a data processing addendum is published as a PDF. With AI features in the product we found no public information on an admin switch to turn them off, a statement that customer content is not used to train AI models, or a stated deletion period, and the only hosting documented is Amazon Web Services in the United States. 3 4 6 7 8
The Product Team Lead
Encryption is concrete — TLS 1.2 or better in transit, AES-256 at rest, encrypted backups at a separate location, annual third-party penetration testing and SOC 2 Type II. For a works council conversation the AI and exit side stays open: we found no public information on an admin switch for AI, a statement that customer boards do not train models, stated deletion periods, or any on-premises or dedicated-tenant edition; AI use points to supplementary terms whose contents the captured pages do not show. 4 6 7 17
The Microsoft 365 Admin
Encryption in transit (TLS 1.2 or better) and at rest (AES-256), yearly third-party penetration testing, SOC 2 Type II, encrypted backups with point-in-time recovery and two-factor authentication are all stated on a public security page, but there is no stated period for deleting boards and accounts and the pages describe no deployment option beyond AWS hosting in the United States. AI exists under supplementary AI terms, yet we found no public information on an admin switch to turn it off or a statement that customer boards do not train the models — which is what my legal team needs before anyone switches it on. 3 4 6 7
The Works Council Member
Encryption in transit and at rest, yearly third-party penetration tests, SOC 2 Type 2, 24/7 monitoring, least-privilege access and encrypted backups with point-in-time recovery are stated — and the privacy policy confirms the vendor processes data on who did what, when and to what thing in a workspace, together with the number of users accessing it, and may disclose information about a user and their workspaces to that user's organisation. That is precisely what our IT committee interrogates, and we found no public information on what a manager can actually see, on any statement or template for works council agreements, or on whether AI features can be switched off by the admin. AI use is governed by supplementary AI terms that are only referenced, account and data deletion carry no stated period, and hosting is on Amazon Web Services in the United States with no other deployment option described. 4 6 7 17
The Public-Sector Project Lead
The security page states encryption in transit and at rest, third-party penetration testing at least once a year, encrypted backups in a separate location, least-privilege access and SOC 2 Type II, and a data processing agreement is published as a PDF without a separate signature. We found no public information on switching the AI features off, whether they train on customer content, deletion periods, customer-managed keys, or any on-premises, dedicated or sovereign-cloud edition — the last being exactly what our state data centre and BSI C5 requirement would turn on. 4 6 7 8
The Skeptic
The security page states TLS 1.2 or better in transit, AES-256 at rest, encrypted backups in a separate location with point-in-time recovery to the second, yearly third-party penetration testing, SOC 2 Type II, and a published DPA that needs no separate signature. But my two standing questions go unanswered: we found no public information on an admin switch to turn the AI off, on whether boards train anyone's model — the AI runs under separate Supplementary AI Terms whose content the captured pages do not show — and there is no stated deletion period, no dedicated or on-premises edition, and no statement for works councils. Individual activity is tracked (who did what, when and to what thing in a workspace), and what managers can see of it is not described. 4 6 7 8
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where boards, files and user data are stored and processed, and who the subprocessors are (hosting, CDN, real-time collaboration servers, AI providers, email, support and payment tools). Independently sourced by the sovereignty pipeline; boards hold personal data of participants and often of customers, so the whole chain counts, not only the database. An on-premises or self-hosted edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (AI features, CDN, real-time servers, email, support, payment) run through non-EU providers without a stated safeguard, or EU residency is an option of the top tier only.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5, SOC 2) stated — or an on-premises edition documented that keeps every board on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor including AI, or an on-premises or open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The Workshop Facilitator
The contracting entity is Whimsical, Inc. of Denver, Colorado under Delaware law, and the pages state plainly that the services are hosted in and provided from the United States on Amazon Web Services — the answer I would have to give a client who asks where the board is stored before we start. A data processing addendum and privacy policy are published and SOC 2 is stated, and a subprocessor list is referenced though its contents are not shown on the captured pages; we found no public information on EU hosting, an EU contracting entity, or a self-hosted edition. 4 6 7 8
The Product Team Lead
The contracting entity is Whimsical, Inc. under Delaware law with a Denver address, and the services are stated to be hosted in and provided from the United States on AWS; a data processing agreement is incorporated by reference into the terms and SOC 2 Type II and GDPR and CCPA commitments are stated. We found no public information on an EU hosting option or on-premises edition, and the referenced subprocessor list does not name providers or locations on the captured pages. 3 4 6 7 8
The Microsoft 365 Admin
The contracting entity is Whimsical, Inc. in Denver under Delaware law, the services are hosted in and provided from the United States on AWS, and a data processing agreement is published and incorporated by reference with a subprocessor list referenced but not shown. We found no public information on EU hosting or a European contracting option, so boards holding participant and customer data would sit under US hosting and US law. 3 6 7 8
The Works Council Member
The contracting entity is Whimsical, Inc. of Denver under Delaware law, and the services are stated to be hosted in and provided from the United States on Amazon Web Services — for an insurer's works council, that chain sits under US jurisdiction no matter what the contract says. A data processing agreement is published as a PDF and incorporated by reference, SOC 2 Type 2 and GDPR commitments are stated, and a subprocessor list is referenced, but its contents were not captured. We found no public information on an EU hosting option or a self-hosted edition. 3 4 6 7 8
The Public-Sector Project Lead
The contracting entity is Whimsical, Inc. of Denver, Colorado under Delaware law, and the services are stated to be hosted in and provided from the United States on AWS, with a published data processing agreement and a referenced subprocessor list, of whose contents only Stripe as payment processor is named on the captured pages. We found no public information on EU hosting, a European contracting entity, or BSI C5 or ISO 27001 certification, so under our data protection officer's ruling against US-hosted boards this is not a product we could contract. 4 6 7 8
The Skeptic
Your agreement is with Whimsical, Inc., governed by Delaware law with venue in Denver County, Colorado, and the privacy notice states the services are hosted in and provided from the United States on AWS; we found no public information on a European hosting option. A DPA is published and a subprocessor list is referenced, though the captured pages name only Stripe as a processor. Non-EU entity, non-EU hosting, US payment processor — the whole chain sits outside Europe. 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per user and tier, how guests, viewers and external participants are counted, limits of the free plan (number of boards, objects, members), which features (SSO, SCIM, audit logs, EU data residency, AI credits, on-premises) cost extra, the enterprise tier's price or minimum, annual versus monthly billing, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free plan exists, but how cost scales with users, guests or features is unclear.
5 — Tiers are public with their price per user and main inclusions, but at least one commonly needed piece (SSO, EU data residency, guests, AI credits, the enterprise tier) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (members, guests, boards), free-plan limits stated, add-ons and AI credits priced, the on-premises or dedicated edition's cost or licence stated, minimum seats, term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given team size, guest count and feature set, with every add-on, setup, support and AI fee and the cancellation and data-return terms published.
The Workshop Facilitator
All three public tiers are priced per editor — Free at $0, Pro at $10 / Month / Editor, Business at $20 / Month / Editor — with annual billing saving 17%, the free plan's limits stated numerically (50 board objects per month, 7-day version history, watermark on exports), and guests free and unlimited on every plan with viewers always free, which is exactly how I need external participants counted. VAT treatment and payment methods per tier are stated; what I cannot compute is the Org plan, referenced in release notes and sold through "Contact sales", and we found no public information on AI pricing or minimum seats. 1 3 7 15 18
The Product Team Lead
Free, Pro at $10 / Month / Editor and Business at $20 / Month / Editor are public, with the free plan's limits stated (50 board objects per month, 1GB total storage, watermark on exports), guests free and unlimited on every plan, viewers always free, annual billing saving 17%, and VAT stated as exclusive and paid by the customer. We found no public information on AI credits pricing or minimum seats, so the full annual cost for a given feature set is not computable from the public pages. 3 7 15 16
The Microsoft 365 Admin
All three tiers are priced publicly — Free at $0, Pro at $10 per Month per Editor, Business at $20 per Month per Editor — with SAML SSO and SCIM included in Business, guests and viewers free and unlimited on every plan, free-plan limits of 50 board objects and 50 doc blocks per month, annual billing saving 17%, VAT paid by the customer, and cancellation at any time. We found no public information on AI pricing or credits, or a minimum seat count. 3 7 16
The Works Council Member
All three tiers are public — Free at $0, Pro at $10 per month per editor, Business at $20 per month per editor — with annual billing saving 17%, guests free and unlimited on every plan, viewers always free, and free-plan limits stated in board objects and doc blocks per month, watermark and version history. VAT treatment (exclusive, paid by the customer), payment methods per tier, pre-payment and cancellation at any time are stated in the terms. We found no public information on minimum seats or on how the AI features are charged, which keeps a full annual cost from being computable. 3 7 15
The Public-Sector Project Lead
All three plans are publicly priced per editor — free, $10 and $20 per month — with a 17% annual saving, guests and viewers free and unlimited on every plan, free-plan object and storage limits stated, single sign-on and SCIM priced by tier rather than on request, and VAT-exclusive pre-pay terms with cancellation published. We found no public information on AI credit pricing or minimum seats, so the true annual cost for a workshop-heavy agency cannot be fully computed from public pages. 3 7 15
The Skeptic
All three public tiers are priced — Free at $0, Pro at $10 / Month / Editor, Business at $20 / Month / Editor, with annual billing saving 17% — and the Free plan's limits are stated plainly (50 board objects and 50 doc blocks per month, watermark on exports, 7-day version history) with guests and viewers free and unlimited on every plan. Single sign-on and SCIM arrive with the Business tier rather than hiding as an unpriced add-on, VAT falls on the customer, and renewal is automatic with cancellation any time. What you cannot compute from public pages: the cost of AI use, minimum seats, and the Org plan the release notes mention — the pricing page stops at Business and the site points larger buyers to contact sales. 1 3 7 16 18
European sovereignty — proven facts
1 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Incorporated in US ⚠ unverified | 0/2 pts | 7 Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Whimsical
Is Whimsical European?
No. whats-best.ai classifies Whimsical as Rest of world. Its vendor, Whimsical, Inc., is incorporated in United States, per the vendor’s page captured 1 Nov 2026.
Where does Whimsical store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Whimsical have a free plan?
Yes. Whimsical has a free plan, per the vendor’s page captured 1 Nov 2026.
What are the best alternatives to Whimsical?
As of 1 Nov 2026, the panel rates Miro (3.5/5), Collaboard (3.5/5) and Klaxoon (3/5) highest among the other 12 Online Whiteboard products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Collaboard (UK / wider Europe). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Whimsical alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. This is a US business address rather than a company register entry; no state of incorporation is named, and the 'Inc.' suffix alone would not place the entity.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (18)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage whimsical.com Checked 1 Nov 2026 Details →
- 2 Integrations page whimsical.com Checked 1 Nov 2026 Details →
- 3 Pricing page whimsical.com Checked 1 Nov 2026 Details →
- 4 Security / trust page whimsical.com Checked 1 Nov 2026 Details →
- 5 Security / trust page (trust centre) trust.whimsical.com Checked 1 Nov 2026 Details →
- 6 Privacy policy whimsical.com Checked 1 Nov 2026 Details →
- 7 Terms of service whimsical.com Checked 1 Nov 2026 Details →
- 8 Data processing agreement (dpa) whimsical.com Checked 1 Nov 2026 Details →
- 9 Canvas, templates & content — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 10 Canvas, templates & content — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 11 Workshop facilitation & participation — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 12 Workshop facilitation & participation — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 13 Integrations, import & export — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 14 Integrations, import & export — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 15 Sharing, permissions & administration — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 16 Sharing, permissions & administration — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 17 Security, AI controls & deployment — found from sitemap whimsical.com Checked 1 Nov 2026 Details →
- 18 Security, AI controls & deployment — found from sitemap whimsical.com Checked 1 Nov 2026 Details →