Compare ArkiaSuite and Kolab Now on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Google Workspace, Microsoft 365
France· Office Productivity Suite
Needs review
Shortlist when you want a French all-in-one workspace on operator-owned servers in Savoie with a public Art. 28 DPA and frank security limits. Skip when you need SecNumCloud/HDS, E2EE, mature Apple clients, or multi-admin 24/7 operations. Consider mailbox.org, Kolab Now or Nextcloud instead in those cases.
Switzerland· Groupware
Needs review
Shortlist when you want Swiss-operated, FOSS-based classical groupware (mail, CalDAV/CardDAV, ActiveSync, files, Collabora) on operator-owned Bern infrastructure. Skip when you need default zero-access E2EE mail, public ISO/SOC evidence, or mature video — consider Proton Mail/Tuta for E2EE mail or Google Workspace/Microsoft 365 for enterprise suite depth.
Highlighted rows differ between the two products.
| Feature | ArkiaSuite | Kolab Now |
|---|---|---|
| Country of origin | France | Switzerland |
| Category | Office Productivity Suite | Groupware |
| Open source | No | Yes |
| Self-hosted | No | No |
| Headquarters | France | Switzerland |
| Legal entity | GS Informatique EURL (SIREN 925 179 079, RCS Chambéry) | Apheleia IT AG (trade register CH-036.3.053.227-3; VAT CHE-149.254.861) |
| Governing law | Not listed | Swiss law (see Terms of Service for contract details) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Medium | Medium |
| EU-hosted status | EU hosted | Not listed |
| Hosting / residency | Content on GS Informatique hardware in Frontenex (primary) and Faverges (encrypted backup). Payments via Stripe Payments Europe (Ireland, US-group payment processor). Password checks via Have I Been Pwned k-anonymity API. TLS via Let's Encrypt. No AWS/GCP/Azure claimed for content. | Primary mailbox/groupware hosting claimed on operator-controlled infrastructure in Bern, Switzerland (IBM OpenPOWER hypervisors, hardware-encrypted IBM storage, RHEL). No AWS/GCP/Azure hosting advertised for customer mail. Billing wallet supports PayPal, credit card, and EUR bank transfer — US-linked payment processors for payment data. Full subprocessor/backup register not published on pages reviewed. |
| Summary | French-hosted all-in-one workspace: cloud files, email, browser office docs, calendar and photo backup on the operator's own servers in Savoie. | Swiss-hosted FOSS Kolab groupware from Apheleia IT AG: email, calendars, contacts, files and optional Collabora collab on operator infrastructure in Bern. |
| Tags |
| At a glance | ArkiaSuite | Kolab Now |
|---|---|---|
| HQ | Frontenex, Savoie, France | Not listed |
| Legal entity | GS Informatique EURL (SIREN 925 179 079) | Not listed |
| Hosting model | Operator-owned servers (not AWS/GCP/Azure) | Not listed |
| Self-host | No (vendor-operated SaaS) | Not listed |
| Open source | No | Not listed |
| Commercial model | Free tier + subscription storage/mail upgrades | Paid modular subscriptions via prepaid wallet; trial month |
| HQ / operator | Not listed | Apheleia IT AG, Bern, Switzerland |
| Product since | Not listed | 2013 (Swiss-operated hosted Kolab) |
| Hosting | Not listed | Operator rack in Bern; IBM OpenPOWER + encrypted storage (vendor FAQ) |
| Stack | Not listed | Kolab FOSS; RHEL; open mail/groupware protocols |
| Self-host this SKU | Not listed | No (managed); Kolab suite is self-hostable separately |
| Key capabilities | ArkiaSuite | Kolab Now |
|---|---|---|
| EU-operated | Yes | Not listed |
| Hosted in France | Yes | Not listed |
| Public Art. 28 DPA | Yes | Not listed |
| Free tier | Yes | Not listed |
| Files + mail + docs | Yes | Not listed |
| Swiss-operated | Not listed | Yes |
| FOSS Kolab stack | Not listed | Yes |
| Full groupware suite | Not listed | Yes |
| IMAP / CalDAV / ActiveSync | Not listed | Yes |
| Hosted in Bern (claimed) | Not listed | Yes |
| Optional PGP | Not listed | Yes |
Operator-owned file sync in Savoie
ArkiaCloud stores and syncs files from Windows, browser or phone, with expiring password-protected share links, team spaces, trash and prior versions. Primary disks sit in Frontenex; nightly encrypted backups go to a second GS Informatique site in Faverges.
Email with optional custom-domain Pro
ArkiaMail provides ad-free mailboxes with spam filtering and optional two-factor authentication. Free accounts include a limited mailbox; larger boxes and ArkiaMail Pro on the customer's own domain are provisioned as paid add-ons (Pro is set up with the operator, not only self-serve).
Browser docs compatible with Office formats
ArkiaDocs offers word processing, spreadsheets and presentations in the browser with multi-user editing and claimed compatibility with Word, Excel and PowerPoint files, living on the same account as files and mail.
Calendar, contacts and photo backup
ArkiaAgenda syncs shared calendars, contacts and tasks with phone and desktop clients. ArkiaPhotos backs up phone photos and groups them by date, place and face; face templates are computed on Frontenex servers and can be disabled on request.
Windows desktop app shipping now
A native Windows 10/11 64-bit app (site lists version 1.6.0) auto-syncs chosen folders and opens mail, files, docs and calendar in one window. Android is described as in Play Store review; macOS and iOS clients are still in development.
FOSS Kolab groupware with open clients
Hosted Kolab stack: IMAP/SMTP mail, CalDAV/CardDAV calendars and contacts, tasks, notes, and WebDAV files. ActiveSync is available for mobile/Outlook-style sync on full groupware subscriptions. Teams keep standard desktop and mobile clients instead of a proprietary-only app.
Private domains, multi-user cockpit, shared folders
Primary account owners verify custom domains (DNS guides in the KB), add users under one wallet, and share mail folders, calendars, notes, and files inside the domain. Fits small businesses and families that need branded addresses and shared inboxes without Google Workspace.
Swiss own-rack hosting with PFS and header hygiene
Operator FAQ places production systems in a Bern rack on IBM OpenPOWER with hardware-encrypted storage, RHEL, and segmented firewalls. TLS is described as end-to-end inside the platform with Perfect Forward Secrecy; outbound mail strips client IP and MUA identity from headers.
Sieve filters, DKIM, modular spam controls
Server-side Sieve rules (folder, redirect, vacation, discard) run in the web client. Outbound DKIM is supported with CNAME delegation for private domains. Spam tagging is available; aggressive auto-junk is deliberately left to customer Sieve policy rather than opaque provider filtering.
Collabora Online files plus optional PGP and Kolab Meet
Domain users can collaboratively edit documents/presentations via Collabora Online on shared files. Webmail can import PGP keys for optional message encryption (vendor warns keys on server are weaker than offline E2EE). Kolab Meet adds personal video rooms on groupware plans but remains public beta.
TOTP 2FA with an important client trade-off
Time-based one-time passwords (e.g. Aegis) can be required for accounts. When 2FA is enabled for a user, vendor docs state non-web clients (IMAP, POP, ActiveSync, CalDAV/CardDAV, WebDAV) are blocked — evaluate this before mandating 2FA on mobile-heavy fleets.
| Assurance & compliance | ArkiaSuite | Kolab Now |
|---|---|---|
| Independent security / no-logs audit | Not found No public third-party security or no-logs audit PDF found on the site. | Not found Vendor describes no content analytics and limited operational logs (up to six months). No public third-party no-logs or security audit PDF located. |
| ISO 27001 | Not found No ISO 27001 claim located on arkiasuite.fr. | Not found No public ISO 27001 certificate found on primary site/KB materials reviewed. |
| SOC 2 / SOC 3 | Not found | Not found No public SOC 2/3 report found. |
| GDPR / EU data protection | Vendor claimed French EURL controller/processor; public privacy policy and Art. 28 contract. Confirm fit for your processing roles. | Vendor claimed Swiss operator; KB GDPR article asserts customer data ownership, no ad analytics, export/delete paths, and Swiss warrant process for third-party access. Confirm DPA/ToS for EU controllers. |
| US CLOUD Act exposure (indicative) | Partial French entity with no known US parent; content on operator-owned FR servers. Residual exposure via Stripe (US-group payments) and Have I Been Pwned password API. Not legal advice. | Partial Swiss entity / no known US parent; mail claimed on Bern own-infra (not hyperscaler). Partial residual exposure via PayPal/card payment processors and unpublished full subprocessor list. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Public Art. 28 subcontracting agreement accepted at signup/order; printable signature annex available. | Not found No public standalone DPA download located on marketing/KB pages in this pass; may exist in ToS or on request — confirm before B2B processing. |
| EU AI Act | Not applicable Face grouping on photos is a biometric-adjacent feature for the account holder's own library; product is not marketed as a general-purpose AI system. | Not applicable Groupware/email product; not an AI system offering. |
| SecNumCloud / HDS | Not found Vendor materials do not claim SecNumCloud or HDS; submitter also stated none. | Not listed |
| Considerations & known limitations | ArkiaSuite | Kolab Now |
|---|---|---|
| No disk encryption at rest on site | Medium Vendor states Frontenex disks are protected by physical lock, not encryption at rest. Off-site backups are encrypted because they travel. Theft of powered-off disks or physical access is a different threat model than hyperscaler encrypted volumes. | Not listed |
| No end-to-end encryption | Medium Administrator access can technically read stored files. Fine for many SMEs that need server-side search and previews; incompatible with E2EE mandates. | Not listed |
| Single-operator support and admin | Medium Art. 28 text states only Gérald Sonzogni has admin access and answers support. Strong accountability, weak redundancy for holidays, illness or exit planning. | Not listed |
| Limited non-Windows clients | Medium Windows app ships; Android and Apple clients are not fully released. Browser access mitigates some gaps but not all mobile workflows. | Not listed |
| No SecNumCloud, HDS or public audit | High No independent audit, ISO 27001, SOC 2, SecNumCloud or HDS found. Public-sector and health buyers with those gates must look elsewhere. | Not listed |
| US-group payment subprocessor | Low Stripe Payments Europe processes cards. Content is said not to leave GS Informatique servers, but payment metadata still involves a US-group processor. | Not listed |
| Mail not zero-access by default | Not listed | Medium Unlike Proton/Tuta defaults, ordinary stored mail is provider-accessible for protocol delivery unless users apply PGP or another client E2EE scheme. Material for threat models that assume provider compromise or compelled access to plaintext. |
| 2FA blocks non-web clients | Not listed | Medium Documented behaviour: enabling TOTP 2FA confines the user to the web client and blocks IMAP/ActiveSync/CalDAV and related protocols. Breaks many mobile/Outlook deployments if applied naively. |
| Limited public compliance pack | Not listed | Medium No public ISO/SOC certs, independent audit, or subprocessor register found. Procurement must rely on vendor FAQs, ToS, and direct questions — slower security review than certified EU SaaS peers. |
| US-linked payment processors | Not listed | Low Wallet top-ups via PayPal and credit cards introduce US-group payment processors for billing data even when mailboxes stay in Switzerland. Scope is payment metadata, not IMAP content, but still relevant to transfer inventories. |
| Kolab Meet still beta | Not listed | Low Voice/video rooms are labelled public beta; vendor notes support may be limited. Do not treat as a Zoom/Teams replacement for critical meetings. |
When: You need a mail-centric European suite with a longer public track record
Consider: mailbox.org or Proton Mail
Stronger mail heritage; less emphasis on operator-owned photo backup in Savoie
When: You want groupware with calendar/mail and more mature multi-platform clients
Consider: Kolab Now
Swiss/European groupware peer in the catalog
When: You want to operate the stack yourself on chosen EU infrastructure
Consider: Nextcloud
Self-host platform rather than GS Informatique-operated SaaS
When: You need default zero-access / E2EE email more than ActiveSync groupware
Consider: Proton Mail or Tuta
Stronger default cryptography story; thinner classical groupware/ActiveSync depth than Kolab Now.
When: You want privacy-focused German email without full suite complexity
Consider: Posteo
Leaner privacy mail; not a Collabora + shared-domain groupware suite.
When: You need Google/Microsoft-class admin scale, apps marketplace, and compliance certifications
Consider: Google Workspace or Microsoft 365
Far larger ecosystems; US-centric custody and CLOUD Act profile differ sharply.
When: You want full self-host control of the same FOSS stack
Consider: Self-hosted Kolab (kolab.org) or Nextcloud plus a mail stack
More operational burden; Apheleia also sells Kolab professional services.