Nextcloud Talk

The Security Officer

Breakout rooms and webinars-with-lobby exist, and published scaling is candid — 6-10 participants for a private setup, thousands only at enterprise — but the evidence is silent on screen sharing, mute-all or any host moderation, and says nothing about behaviour on a constrained connection beyond admitting video caps you at 20. Between the 3 and 5 anchors: breakout rooms without the moderation and screen-sharing basics that rubric level 5 demands. 1

Report an error

The Security Officer

"Multi-layered encryption" is a marketing phrase, not a mechanism: no end-to-end statement for meetings, no key handling, and signaling can run through a High Performance Backend hosted by unnamed partners. The only concrete cryptography I can verify is push notifications encrypted and re-signed by the vendor's proxy, with a lobby available only for webinars that buy the HPB. Nothing here tells me what the server operator or the hosted HPB can see of the media. 1 3

Report an error

The Security Officer

Web, desktop and mobile are covered, live transcription with translation exists, and there is a real telephone path — but dial-in requires the separately deployed HPB and no numbers or rates are listed. There is no accessibility statement, no keyboard or screen-reader evidence, and no documented low-bandwidth behaviour anywhere in the evidence; silence here is information. 1 4

Report an error

The Security Officer

There is a recording-consent prompt in meetings and self-hosting puts the recording on infrastructure the customer controls, which is a decent starting point. But the evidence evidences no admin policy over who may record, no retention or deletion rule for recordings or the AI transcripts, and no access logging — message expiration is a chat feature, not recording governance, and nothing here is works-council switchable. 1

Report an error

The Security Officer

Deployment is genuinely the customer's: fully on-premises, airgap-capable, open source, with webhook bots, a SIP bridge and a Pexip gateway for room systems and an Outlook add-in. But the evidence shows no SAML/OIDC SSO, no SCIM provisioning and no SDK — for a self-hosted stack, the absence of documented identity federation is a real gap. 1 2

Report an error

The Security Officer

The contracting entity is firmly German — Nextcloud GmbH, register HRB 227086, Stuttgart, German VAT ID — and the self-hosted/airgap model means media locality is largely the customer's own decision, which is why I score above the 5 anchor. But nothing evidences where vendor-operated pieces land: the STUN server Nextcloud itself hosts, partner-hosted HPBs with unnamed partners, and Matomo cloud for analytics; there is no product subprocessor list, so the chain is partly a black box. 1 3 4

Report an error

The Security Officer

Per-user prices are public for three tiers with volume breaks, in EUR per year net of VAT, from 100 users — better than a headline, but capacity limits per plan are absent, minimum term is unstated, and dial-in is entirely unpriced because it depends on an HPB whose hosted cost never appears. Recording storage is likewise unmentioned; the annual invoice for what a buyer actually needs is not computable from these pages. 1 2

Report an error