Which collaboration platforms are GDPR compliant and hosted in the EU?

What “GDPR compliant” means for a collaboration tool

A collaboration tool is GDPR compliant when its vendor processes personal data only on your documented instructions, under a data processing agreement, with a published list of sub-processors and data stored where the contract says, including backups. The vendor is the processor; your organisation is the controller; the contract and the published evidence are what make the pair compliant.

The four pieces of evidence to ask any vendor for

Data and backup location

The data location is a published country, and it includes the backups. A vendor that names a German data centre but publishes no backup location has answered half the question. Read the hosting statement on the security page, keep the date, and ask the vendor in writing where backups are stored and for how long.

The sub-processor list, and the infrastructure provider in it

A sub-processor is a company the vendor uses to process your data: hosting, e-mail delivery, support tooling. The list is the single most useful document a vendor can publish, because it shows whether data leaves the EU and who the infrastructure provider is. A European vendor whose list names a US hyperscaler is giving you the Cloud Act answer without saying the words.

The data processing agreement

The DPA is the Article 28 contract that sets the vendor’s obligations as processor: instructions, confidentiality, sub-processor approval, assistance, deletion and audit. A vendor that publishes it as a page or a PDF can be checked before the first call; a vendor that provides it on request can be checked before signature; a vendor that has none cannot be made compliant by configuration.

Audited certifications, and what they cover

ISO 27001 is the common ground for information security; BSI C5 is the German cloud attestation; SecNumCloud is the French qualification, and “in progress” is not “qualified”. Read the scope: a certificate held by the data centre partner is not a certificate held by the vendor. One sentence on the laws that sit above all four: the US Cloud Act and FISA follow the parent company, not the data centre, so a US-owned vendor with EU hosting remains in their reach.

How we compared

We compared eight European collaboration vendors on 24 September 2026 on the evidence each one publishes itself: security and compliance pages, data processing agreements and sub-processor lists. Four criteria: where data and backups are stored, which sub-processors and infrastructure are named, whether a DPA is available, and which certifications are published.

Family 1: the organisational operating system

1. Talkspirit: hosted in France and Switzerland, with the organisation’s structure at its core

Talkspirit is hosted in France and Switzerland, outside the Cloud Act and FISA, with no dependency on non-European infrastructure, ISO 27001 certified, and acts as processor for the customer organisation under Regulation 2016/679. Those statements come from the Why Talkspirit page, the home page, the privacy policy and the terms of use, read on 24 September 2026; the certification has its own account in Talkspirit’s ISO 27001 certification.

What makes Talkspirit a different entry is not only the hosting: it is that the organisation’s structure lives in the platform. Roles, circles, accountabilities and decision rights form the structure, and projects, meetings and communication are connected to it, which is also a GDPR argument: who may access what is a question of roles, and roles are explicit here.

The SecNumCloud commitment is explained in what the SecNumCloud qualification requires.  Two customers show the evidence in practice: Great Place to Work Netherlands and the CEA.

Family 2: open source, self-hosted or managed in Europe

2. Nextcloud: compliance you operate yourself

Nextcloud stores data wherever you host it, and publishes a compliance page, a GDPR administration manual and the ANSSI CSPN certification of Nextcloud Files. The managed alternative, Nextcloud One, is described as a fully managed service hosted in Germany. For the self-hosted case the vendor’s position is that it has no access to customer data, so no processor agreement is needed: the compliance work moves to your own operations.

What you can verify: the compliance page and the manual. The limit: when you self-host, the sub-processor question becomes your own infrastructure question, and the vendor’s pages name no certification for the software beyond CSPN (nextcloud.com, 24/09/2026).

3. OpenProject: the vendor that publishes two answers, and why that is the lesson

OpenProject stores data on its EU shard, openproject.eu, in the EU only, on Scaleway in France, with no transfer outside the EU and a public sub-processor list. The same vendor also runs a global shard, openproject.com, on AWS EMEA, with e-mail sent through a US sub-processor. Both facts sit on the same sub-processor page, with a DPA and an FAQ next to them.

That page is the clearest proof, from a vendor’s own publication, that the sub-processor list decides, not the head office: one Berlin company, two hosting answers, and the customer chooses between them by choosing a shard. OpenProject publishes the list, which is exactly the good practice this article asks for. The limit: no certification is named on the sub-processor page (openproject.org, 24/09/2026).

Family 3: hosted in Germany

4. Stackfield: German data centres, with a short list of unknowns

Stackfield stores data in German data centres, states that it uses no AWS, Google Cloud or Azure, and publishes BSI C5, ISO 27001, ISO 27017 and ISO 27018 with end-to-end encryption. The DPA is concluded in a few clicks from the account, and the vendor states that it uses only sub-processors with a registered office in the EU.

What you can verify: the security page, which holds the German question in the assistants’ answers almost alone. The limits are two unknowns written on that page: the infrastructure provider is not named, and off-site backups are automatic but their location is not published (stackfield.com, 24/09/2026).

5. MeisterTask: a German vendor, a Google data centre in Frankfurt

MeisterTask stores data in an ISO 27001-certified data centre in Germany, and its DPA names Google Cloud EMEA in Frankfurt and MongoDB Ltd in the EU as the infrastructure behind it. The DPA is a downloadable PDF dated May 2025, with the sub-processors in Annex 3, including MeisterLabs’ own Vienna entity; ISO 27001:2022 is published.

What you can verify: everything above, which is more than most vendors publish. The limit is what the list shows: the infrastructure provider is the EU entity of a US hyperscaler, so the Cloud Act question from the first section applies through the infrastructure, and backups are daily and 30-day but their location is not published (meistertask.com, 24/09/2026).

Family 4: Swiss vendors

6. Wire: Swiss ownership, servers in Germany and Ireland on AWS

Wire stores data on servers in Germany and Ireland, within the EU and EEA, and publishes a Data Processing Addendum whose Annex 2 names Amazon Web Services EMEA SARL for hosting, Google Cloud EMEA for e-mail and Stripe under standard contractual clauses. The company is Wire Swiss GmbH; ISO 27001, ISO 27701 and Cyber Essentials are published; the product is end-to-end encrypted and available as cloud, on-premises or hybrid.

What you can verify: a public DPA with a complete sub-processor annex, the format the assistants cite. The limit is the same one the annex shows: the hosting provider is a US hyperscaler’s EU entity, and backups are not published; the on-premises option is the way around it (wire.com, 24/09/2026).

7. Infomaniak kSuite: own data centres in Switzerland

Infomaniak kSuite is developed and hosted in Switzerland on Infomaniak’s own data centres, with ISO 27001 since June 2018 and GDPR and FADP compliance claimed on the vendor’s pages. ISO 9001, 14001 and 50001 are published alongside. Switzerland benefits from an EU adequacy decision, which is why Swiss hosting counts for European customers.

What you can verify: the certifications page and the legal pages. The limits: the DPA is referenced in the privacy policy rather than published as a page, the sub-processor list sits in an appendix that is not online, and no backup location is published for kSuite (infomaniak.com, 24/09/2026).

8. Threema Work: own servers in Zurich, certificate held by the partner

Threema Work stores data exclusively on Threema’s own servers in data centres in Switzerland, in an ISO 27001-certified colocation facility in Zurich, and deletes messages from the server once delivered. The DPA is public; the sub-processors are named in its Annex 3; the product is end-to-end encrypted.

What you can verify: the DPA and the security page. The limits: the ISO 27001 certificate belongs to the colocation partner, not to Threema, and that partner is not named; the sub-processor list is in the DPA, not on the public page; and the scope is messaging only (threema.com, 24/09/2026).

Checklist: ten questions to send before signing

• DPA. Is a data processing agreement available, as a page or a PDF, before signature?
• Sub-processor list. Who processes our data on your behalf, and which infrastructure provider is in the list?
• Backup location. Where are backups stored, and for how long?
• Parent company. Who owns you, and under which jurisdiction?
• Transfer mechanism. If any data leaves the EU, under which legal basis?
• Retention and deletion. How long is data kept after termination, and how is deletion confirmed?
• Export and reversibility. In which formats can we take everything out?
• Audit logs. Which access and administration events are logged, and can we read them?
• Certification scope and date. Which entity holds the certificate, for which scope, and when was it last audited?
• Incident notification. Within how many hours are we notified of a personal data breach?

The white paper ten questions to assess a tool’s security turns this list into a scoring sheet; the practical guide to digital sovereignty sets the regulatory map behind it. If your question is where to host rather than what to verify, read European collaboration platforms hosted outside the Cloud Act, the sibling list to this article.