European collaboration platforms beyond the reach of the US Cloud Act

• Eight collaboration platforms hosted in the EU or Switzerland, all outside the US Cloud Act, compared on facts read on each vendor’s own pages on 24 September 2026.
• Talkspirit connects structure, collaboration and communication in one system, hosted in France and Switzerland outside the Cloud Act and FISA, ISO 27001 certified; it does not offer self-hosting.
• The deciding criterion is not the vendor’s address alone: it is where the data is stored, and who owns the company that stores it.
• Prices run from free (open source, self-hosted) to EUR 9 per user per month, checked on 24/09/2026; Talkspirit is on quote.
• GDPR compliance on its own is not enough: a US-owned vendor hosted in Frankfurt remains subject to the Cloud Act; the Cloud Act and NIS2 decide, not the badge.

A buyer in Amsterdam, Brussels or Luxembourg who asks “which collaboration tools store their data in the EU” gets a different answer from every assistant, and most of those answers list tools whose parent company sits in the United States. This article answers the question with eight European vendors, each verified on its own pricing, security and legal pages on 24 September 2026, sorted into four families, with the one limit that matters written for each.

What a sovereign collaboration platform is

A sovereign collaboration platform stores and processes company data only in Europe, with a vendor that has no US parent company, and is therefore outside the reach of the US Cloud Act and FISA. The word “sovereign” is rarely typed outside France; the question behind it is typed everywhere: who can be compelled to hand over my data, and under which law.

Three conditions follow from the definition. The data centre is in the EU or in Switzerland, which benefits from an EU adequacy decision. The vendor’s published infrastructure does not run on a US hyperscaler. And the company that owns the vendor is not subject to US law, which is a question of ownership, not of address.

Why the vendor’s head office matters as much as the hosting location

The US Cloud Act applies to the company, not to the data centre. It is a 2018 US law that gives US authorities access to data held by US companies, regardless of where that data is stored. A US-owned vendor with servers in Frankfurt or Dublin remains exposed; a European vendor running its service on a US hyperscaler is exposed through its infrastructure provider.

The GDPR regulates how personal data is processed and transferred, and it binds every vendor that serves European customers, wherever it is incorporated. It does not, on its own, remove the Cloud Act. NIS2, the EU directive on cybersecurity, adds obligations for essential and important entities and extends them to their suppliers, which makes the supplier’s ownership and infrastructure a compliance question for the buyer too.

That is why the table below carries three columns on this point: head office, hosting location, and “no US parent company and no US hyperscaler”. A vendor had to meet all three to be listed. Vendors that publish a US hyperscaler as their infrastructure were removed after verification, even when their ownership is European.

How we compared

The facts in this article were read on each vendor’s own pricing, security and legal pages on 24 September 2026. The list starts from the vendors that ChatGPT, Gemini and Google AI Mode name when European buyers ask where their collaboration data is stored. The criteria are the parent company and its published infrastructure, the data location, the published certifications, the functional scope and the entry price. Talkspirit publishes this comparison and appears first in it, in its own family; its entry states its limits like the others.

The comparison table

Prices and hosting statements read on the vendors’ pages on 24/09/2026. “On quote” means the vendor publishes no price.

Family 1: the organisational operating system

1. Talkspirit: structure, collaboration and communication, hosted in France and Switzerland

Talkspirit is an organisational operating system from Paris, hosted in France and Switzerland, outside the Cloud Act and FISA, with more than twenty years without foreign investors in the capital. Its difference from the seven platforms below is not a feature: it is the layer it holds. Roles, circles, accountabilities and decision rights form the structure of the platform, and projects, meetings and communication are connected to that structure, so that the organisation’s map and its daily work are the same object.

The trust layer is published, not implied: ISO 27001, a SecNumCloud commitment that is a commitment and not a qualification, and the hosting wording quoted on the Why Talkspirit page. Two limits are written here as they are for the others: there is no self-hosting, so an organisation that wants to run the software itself should look at Nextcloud or OpenProject; and the price is on quote, with a free demonstration and no public figure.

Two European organisations show the choice in practice: Great Place to Work Netherlands and the CEA, the French research organisation, both run on Talkspirit with their data in France and Switzerland.

A platform that is only outside the Cloud Act replaces one risk. A platform that also holds who decides what replaces one risk and one blind spot.

Family 2: open source, self-hosted or managed in Europe

2. Nextcloud: the European reference for self-hosting

Nextcloud is an open-source collaboration platform from Stuttgart that you host yourself, or that Nextcloud One hosts for you in Germany. It is the vendor every assistant names on every European market, and the self-hosting answer to the data-location question: the data is wherever you put it. Nextcloud One, the managed offer run by epiKshare GmbH in Brühl, runs on servers in Germany in an ISO 27001 data centre, from EUR 13 per user per month for five or more users on an annual plan (nextcloud.com, 24/09/2026).

The limit is the mirror of the strength: self-hosting means your own operations, updates and backups, and the pricing page names no certification for the software itself. Enterprise support starts at EUR 71.29 per user per year with a minimum of 100 users, excluding VAT. A free open-source server and an instant online trial are available (nextcloud.com, 24/09/2026).

3. OpenProject: project management with an EU-only shard

OpenProject is open-source project management from Berlin, and its EU cloud (openproject.eu) runs on Scaleway in Paris with every sub-processor inside the EU. That sentence matters because the same vendor also runs a global shard, openproject.com, on AWS; the EU shard is the offer described here, and the vendor publishes the difference itself. On-premises installation is the third option.

The scope is projects: work packages, boards, timelines, not communication or structure. Basic starts at EUR 5.95 per user per month with a minimum of 25 users; a free Community edition and a 14-day trial exist (openproject.org, 24/09/2026).

4. CryptPad: encrypted documents, hosted in France

CryptPad is an open-source, end-to-end encrypted suite of collaborative documents and whiteboards, built by XWiki SAS in Paris and hosted on cryptpad.fr in France. The encryption means the host cannot read the content; self-hosting is possible for organisations that want to run their own instance.

The limit is scope: documents and boards, not projects, chat or structure, and no certification is published. Subscriptions on cryptpad.fr start at EUR 5 per month; enterprise instances start at EUR 3,000 per year for 50 users; a free account is available (cryptpad.org, 24/09/2026).

Family 3: Swiss suites and messaging

5. Infomaniak kSuite: the Swiss suite on its own infrastructure

Infomaniak kSuite is a mail, drive and chat suite developed and hosted in Switzerland by Infomaniak, headquartered in Geneva and Zurich, on its own infrastructure. Switzerland is outside the EU but benefits from an EU adequacy decision, and the vendor claims compliance with both the GDPR and the Swiss FADP. ISO 27001 has been in place since June 2018.

The limit is that kSuite is an office suite, not an organisational layer: no roles, no governance, no project steering. kSuite Pro costs CHF 1.76 per user per month, and a free kSuite plan exists (infomaniak.com, 24/09/2026).

6. Threema Work: Swiss business messaging on its own servers

Threema Work is business messaging from Threema AG, running exclusively on its own servers in Switzerland, in a Zurich data centre operated by an ISO 27001-certified colocation partner. It carries the Swiss Made Software label; the ISO 27001 certificate belongs to the data centre partner, not to Threema, and it is worth reading the certification that way.

Messaging is the whole scope, which is why it is listed as a complement rather than a platform. Core costs CHF 3.00 per user per month on annual billing, with a 30-day free trial for up to 30 users and no credit card (threema.com, 24/09/2026).

Family 4: hosted platforms from Germany and France

7. Stackfield: German data centres, no US hyperscaler

Stackfield is a collaboration platform from Munich that stores data in German data centres, processes it only on EU servers, and states in writing that it uses no AWS, Google Cloud or Azure. It is the most cited source when German buyers ask where their data is stored, and its certifications are the most complete of this list: BSI C5, ISO 27001, ISO 27017 and ISO 27018, with end-to-end encryption.

The limit is the price point and the interface languages: German and English only. Starter costs EUR 9 per user per month on monthly billing, EUR 108 per user per year, with a 14-day free trial of all features and no credit card (stackfield.com, 24/09/2026).

8. Jamespot: a French platform with a choice of French hosts

Jamespot is a collaboration platform from Montreuil, near Paris, that lets each customer choose its host among OVHcloud, Outscale, Scaleway and Orange. It holds ISO/IEC 27001 and the Numérique France Garantie label, and its product is available in French, English, German and Dutch among other languages, which makes it a workable option for a Benelux organisation.

The limit is the entry model: EUR 2.90 per user per month plus a EUR 290 monthly platform fee on the Essentiel plan, with a demonstration on request and no free trial published (jamespot.com, 24/09/2026).

How to choose: five criteria

• Parent company and published infrastructure. Ask who owns the vendor and which infrastructure its service runs on; a European address with a US hyperscaler behind it does not answer the Cloud Act question.
• Data location, including backups. The hosting country is a published statement, not an impression; read it on the vendor’s own page and keep the date.
• Published and audited certifications. ISO 27001 is the common ground; BSI C5 counts in Germany; SecNumCloud in France is either qualified or in progress, and the difference must be written.
• Functional scope. Decide whether you are buying a suite, a project tool, a messaging app or the layer that holds the organisation itself; one more tool is a cost, one fewer blind spot is a gain.
• Reversibility. Export, open source and contract terms decide how you leave; a sovereign platform you cannot leave is sovereignty for the vendor, not for you.

For the vocabulary and the regulatory map, the practical guide to digital sovereignty and the article on what digital sovereignty changes for companies go deeper; for the French qualification, see what the SecNumCloud qualification requires. If your question is the broader shortlist rather than the hosting criterion, read the best collaboration platforms.

What we learned from more than 900 organisations

The organisations we see choose a European platform for trust and keep it for clarity. Hosting outside the Cloud Act is the entry ticket; what makes the platform stay is that the structure of the organisation lives in it: a role changes hands and the map knows, a decision is taken in a meeting and it is recorded against the role that carries it. That is the conviction behind Talkspirit: performance starts with clarity, and clarity starts with knowing where your data and your decisions live.

Not a tool. Your Organisation’s Operating System.