Kolab Now vs Nextcloud

Compare Kolab Now and Nextcloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Workspace, Microsoft 365

Kolab Now

Switzerland· Groupware

Needs review

Shortlist when you want Swiss-operated, FOSS-based classical groupware (mail, CalDAV/CardDAV, ActiveSync, files, Collabora) on operator-owned Bern infrastructure. Skip when you need default zero-access E2EE mail, public ISO/SOC evidence, or mature video — consider Proton Mail/Tuta for E2EE mail or Google Workspace/Microsoft 365 for enterprise suite depth.

Swiss-operatedFOSS Kolab stackFull groupware suiteIMAP / CalDAV / ActiveSyncHosted in Bern (claimed)Optional PGP

View listing Visit Website

Nextcloud

Germany· Cloud Computing

Needs review

Shortlist Nextcloud when you need an AGPL self-hosted Hub (files, Talk, groupware, office, optional local AI) under German vendor ownership and operator-controlled residency. Skip when you want zero-ops multi-tenant SaaS — prefer Google Workspace/Microsoft 365 — or mainly need lightweight P2P sync (Syncthing) or file-sync without a full collab suite (Seafile).

EU-operated vendorOpen source (AGPLv3)Self-hostedFull collab HubOptional E2EEEnterprise support

View listing Visit Website

Highlighted rows differ between the two products.

Kolab Now vs Nextcloud: Snapshot
Feature	Kolab Now	Nextcloud
Country of origin	Switzerland	Germany
Category	Groupware	Cloud Computing
Open source	Yes	Yes
Self-hosted	No	Yes
Headquarters	Switzerland	Germany
Legal entity	Apheleia IT AG (trade register CH-036.3.053.227-3; VAT CHE-149.254.861)	Nextcloud GmbH (HRB 227086, AG München; VAT DE307093598)
Governing law	Swiss law (see Terms of Service for contract details)	Germany
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Primary mailbox/groupware hosting claimed on operator-controlled infrastructure in Bern, Switzerland (IBM OpenPOWER hypervisors, hardware-encrypted IBM storage, RHEL). No AWS/GCP/Azure hosting advertised for customer mail. Billing wallet supports PayPal, credit card, and EUR bank transfer — US-linked payment processors for payment data. Full subprocessor/backup register not published on pages reviewed.	Primary product path: customer or partner operates the instance (on-prem or chosen hoster). Nextcloud GmbH states it does not offer Nextcloud hosting for others and designs the software so user content is not sent to the vendor. Optional customer-configured backends (S3/SWIFT, SharePoint, SMB, etc.) and partner-managed hosting introduce those providers' regions and subprocessors. Website/CRM tools (e.g. Matomo, embedded video) apply to nextcloud.com, not Hub file data.
Summary	Swiss-hosted FOSS Kolab groupware from Apheleia IT AG: email, calendars, contacts, files and optional Collabora collab on operator infrastructure in Bern.	Open-source, self-hosted content collaboration Hub from Nextcloud GmbH (Germany): Files, Talk, Groupware, Office, local AI Assistant, and Flow—an on-prem alternative to Microsoft 365-style suites.
Tags	open-source privacy groupware email switzerland caldav activesync foss	open-source privacy cloud self-hosted enterprise productivity collaboration agpl file-sync

At a glance: Kolab Now vs Nextcloud
At a glance	Kolab Now	Nextcloud
HQ / operator	Apheleia IT AG, Bern, Switzerland	Not listed
Product since	2013 (Swiss-operated hosted Kolab)	Not listed
Hosting	Operator rack in Bern; IBM OpenPOWER + encrypted storage (vendor FAQ)	Not listed
Stack	Kolab FOSS; RHEL; open mail/groupware protocols	Not listed
Self-host this SKU	No (managed); Kolab suite is self-hostable separately	Not listed
Commercial model	Paid modular subscriptions via prepaid wallet; trial month	Free community software; seat-based Enterprise subscriptions
HQ	Not listed	Stuttgart, Germany (Nextcloud GmbH)
License	Not listed	AGPLv3 (server); fully open source per vendor
Deployment	Not listed	Self-host or partner-host; vendor does not multi-tenant host files
Hub apps	Not listed	Files, Talk, Groupware, Office, Assistant, Flow
Founded	Not listed	2016 (ownCloud fork)

Key capabilities: Kolab Now vs Nextcloud
Key capabilities	Kolab Now	Nextcloud
Swiss-operated	Yes	Not listed
FOSS Kolab stack	Yes	Not listed
Full groupware suite	Yes	Not listed
IMAP / CalDAV / ActiveSync	Yes	Not listed
Hosted in Bern (claimed)	Yes	Not listed
Optional PGP	Yes	Not listed
EU-operated vendor	Not listed	Yes
Open source (AGPLv3)	Not listed	Yes
Self-hosted	Not listed	Yes
Full collab Hub	Not listed	Yes
Optional E2EE	Not listed	Yes
Enterprise support	Not listed	Yes

Kolab Now

FOSS Kolab groupware with open clients
Hosted Kolab stack: IMAP/SMTP mail, CalDAV/CardDAV calendars and contacts, tasks, notes, and WebDAV files. ActiveSync is available for mobile/Outlook-style sync on full groupware subscriptions. Teams keep standard desktop and mobile clients instead of a proprietary-only app.
Private domains, multi-user cockpit, shared folders
Primary account owners verify custom domains (DNS guides in the KB), add users under one wallet, and share mail folders, calendars, notes, and files inside the domain. Fits small businesses and families that need branded addresses and shared inboxes without Google Workspace.
Swiss own-rack hosting with PFS and header hygiene
Operator FAQ places production systems in a Bern rack on IBM OpenPOWER with hardware-encrypted storage, RHEL, and segmented firewalls. TLS is described as end-to-end inside the platform with Perfect Forward Secrecy; outbound mail strips client IP and MUA identity from headers.
Sieve filters, DKIM, modular spam controls
Server-side Sieve rules (folder, redirect, vacation, discard) run in the web client. Outbound DKIM is supported with CNAME delegation for private domains. Spam tagging is available; aggressive auto-junk is deliberately left to customer Sieve policy rather than opaque provider filtering.
Collabora Online files plus optional PGP and Kolab Meet
Domain users can collaboratively edit documents/presentations via Collabora Online on shared files. Webmail can import PGP keys for optional message encryption (vendor warns keys on server are weaker than offline E2EE). Kolab Meet adds personal video rooms on groupware plans but remains public beta.
TOTP 2FA with an important client trade-off
Time-based one-time passwords (e.g. Aegis) can be required for accounts. When 2FA is enabled for a user, vendor docs state non-web clients (IMAP, POP, ActiveSync, CalDAV/CardDAV, WebDAV) are blocked — evaluate this before mandating 2FA on mobile-heavy fleets.

Nextcloud

Nextcloud Hub: Files, Talk, Groupware, Office, Assistant, Flow
One self-hosted platform rather than a file-sync bolt-on: Files for sync/share and external storage; Talk for on-prem chat/video (optional SIP); Groupware for calendar/contacts/mail; Office for browser co-editing; Assistant for local AI tasks; Flow for automation. Limit: Talk scale and Office concurrency need extra backends/licenses for large orgs—budget High Performance Backend and editor capacity explicitly.
Self-hosted private cloud with clients and WebDAV access
Run the server on Linux with MySQL/MariaDB/PostgreSQL; users access via web UI plus desktop (Windows/macOS/Linux) and mobile (Android/iOS) clients. External storage connectors cover NFS, SMB/Windows Network Drive, SharePoint, S3/SWIFT, FTP and more so existing file systems stay under IT policy. Limit: you own patching, backup, HA, and capacity planning unless a partner hosts the instance.
Enterprise identity, sharing controls, and audit trails
LDAP/AD, native SAML 2.0, OpenID Connect, Kerberos, enforced MFA (TOTP, WebAuthn and others), password policies, file access control rules (IP, group, type, time), passworded/expiring shares, File Drop, video verification, remote wipe, and compliance-oriented activity logs. Benefits regulated teams that must prove who accessed what without sending files to a third-party SaaS tenant.
Encryption layers: TLS, server-side, optional E2EE
TLS for transport; optional AES-oriented server-side encryption for data at rest (including object storage scenarios); optional per-folder client-side end-to-end encryption with a published design whitepaper and enterprise options such as recovery keys/HSM identity issuance. Limit: E2EE is not a magic default for all Hub features—evaluate which apps and workflows remain usable when folders are E2EE-encrypted.
AGPLv3 open source with Enterprise support subscriptions
Server source is AGPLv3 on GitHub; Nextcloud states it does not ship proprietary open-core product modules. Community use is free; Enterprise plans (Standard/Premium/Ultimate) are seat-based subscriptions from a stated minimum user tier, buying support SLAs, longer maintenance, early patches, Guard, Global Scale options, and commercial connectors. Choose Enterprise when uptime and vendor SLAs matter more than pure DIY ops.
Local AI Assistant without mandatory cloud LLM tenancy
Assistant integrates summarization, translation, context chat over your data, and generation features inside Hub, designed to run with self-hosted or partner AI backends rather than forcing content into a public consumer AI product. Limit: model quality, GPU/CPU cost, and AI Act classification depend on how you deploy the models—treat AI as an optional module with its own DPIA.

Assurance & compliance: Kolab Now vs Nextcloud
Assurance & compliance	Kolab Now	Nextcloud
Independent security / no-logs audit	Not found Vendor describes no content analytics and limited operational logs (up to six months). No public third-party no-logs or security audit PDF located.	Partial Public third-party signals include NCC Group review (historic Nextcloud 11 era) and Kyos code audit for Geneva; active bug bounty. Not a current continuous independent cert of every release or of your deployment.
ISO 27001	Not found No public ISO 27001 certificate found on primary site/KB materials reviewed.	Not found Vendor describes alignment with ISO-style controls and notes customer deployments can pursue certification; no clear public claim that Nextcloud GmbH holds ISO 27001 for a multi-tenant SaaS product (they are primarily a software vendor).
SOC 2 / SOC 3	Not found No public SOC 2/3 report found.	Not found No public SOC 2/3 report found for Nextcloud as a hosted collaboration SaaS; self-host model shifts assurance to the operator.
GDPR / EU data protection	Vendor claimed Swiss operator; KB GDPR article asserts customer data ownership, no ad analytics, export/delete paths, and Swiss warrant process for third-party access. Confirm DPA/ToS for EU controllers.	Vendor claimed EU entity; privacy policy; Enterprise GDPR compliance kit (checklist, admin manual, data-request/ToS apps). Self-host design aims to avoid Nextcloud processing instance content—actual GDPR compliance depends on your hosting and configuration.
US CLOUD Act exposure (indicative)	Partial Swiss entity / no known US parent; mail claimed on Bern own-infra (not hyperscaler). Partial residual exposure via PayPal/card payment processors and unpublished full subprocessor list. Not legal advice.	Partial German GmbH, no known US parent, vendor does not host customer Hub content on self-host path → low vendor-as-host exposure. Partial because optional S3/partner hosting on US-group clouds reintroduces CLOUD Act via infrastructure. Not legal advice.
Data processing agreement (B2B)	Not found No public standalone DPA download located on marketing/KB pages in this pass; may exist in ToS or on request — confirm before B2B processing.	Partial For pure self-host software, vendor materials argue Nextcloud GmbH often is not a content processor. Enterprise support/sales process contact data; partner hosters and object-store providers need their own Art. 28 DPAs. Confirm with sales for your contract shape.
EU AI Act	Not applicable Groupware/email product; not an AI system offering.	Not applicable Core product is content collaboration software. Optional local Assistant/AI modules may need separate AI Act classification depending on models and use—handle in deployment DPIA, not as the product category default.

Considerations & known limitations: Kolab Now vs Nextcloud
Considerations & known limitations	Kolab Now	Nextcloud
Mail not zero-access by default	Medium Unlike Proton/Tuta defaults, ordinary stored mail is provider-accessible for protocol delivery unless users apply PGP or another client E2EE scheme. Material for threat models that assume provider compromise or compelled access to plaintext.	Not listed
2FA blocks non-web clients	Medium Documented behaviour: enabling TOTP 2FA confines the user to the web client and blocks IMAP/ActiveSync/CalDAV and related protocols. Breaks many mobile/Outlook deployments if applied naively.	Not listed
Limited public compliance pack	Medium No public ISO/SOC certs, independent audit, or subprocessor register found. Procurement must rely on vendor FAQs, ToS, and direct questions — slower security review than certified EU SaaS peers.	Not listed
US-linked payment processors	Low Wallet top-ups via PayPal and credit cards introduce US-group payment processors for billing data even when mailboxes stay in Switzerland. Scope is payment metadata, not IMAP content, but still relevant to transfer inventories.	Not listed
Kolab Meet still beta	Low Voice/video rooms are labelled public beta; vendor notes support may be limited. Do not treat as a Zoom/Teams replacement for critical meetings.	Not listed
Operator owns uptime, upgrades, and scale	Not listed	Medium Self-host (or partner-host) means you or a hoster must run backups, HA, Talk HPB, Office capacity, and security updates. Community installs without Enterprise SLAs leave incident response on your team.
Hosting/object-store choice can reintroduce US cloud risk	Not listed	Medium Deploying Nextcloud on AWS/GCP/Azure or primary S3 in a US-group region shifts residual CLOUD Act/process risk to that provider even though Nextcloud GmbH is German and does not hold the data as SaaS host.
E2EE is optional and feature-constrained	Not listed	Medium End-to-end encryption is not on by default for all Hub data; enabling it can limit some collaborative features. Academic research has scrutinized designs in this space—validate the version you ship against your threat model.
Certifications apply to full deployments	Not listed	Low ISO/HIPAA/CFR-style compliance is achieved (or not) by the complete stack you operate. The downloadable software is not itself a turnkey certified SaaS environment.
App Store apps are not fully code-reviewed by Nextcloud	Not listed	Low Privacy policy notes limited capacity to review all third-party apps; misuse policy exists but admins should vet apps before production install.

Fit

Kolab Now

Best fit when

Small teams and professional practices that need shared mailboxes, calendars, and private domains under Swiss jurisdiction
Buyers who prioritise open standards (IMAP, CalDAV/CardDAV, ActiveSync, WebDAV) and FOSS components over proprietary lock-in
Organisations that will accept provider-accessible mail at rest and apply PGP/S/MIME themselves for sensitive threads
Users leaving Google Workspace who want groupware depth without US Big Tech mail custody
Account owners comfortable with prepaid wallet billing and modular per-user subscriptions

Poor fit when

Requirements for default end-to-end encrypted mail with zero provider access (prefer Proton Mail or Tuta)
Enterprises that need public ISO 27001/SOC 2 packs, signed DPAs, and a published subprocessor list on day one
Fleets that must combine TOTP 2FA with IMAP/ActiveSync clients on the same user (documented mutual exclusion)
Orgs treating video conferencing as a core, production-grade service (Kolab Meet is still beta)
Buyers seeking a permanent free tier or consumer-grade onboarding polish comparable to Gmail

Consider instead when

When: You need default zero-access / E2EE email more than ActiveSync groupware
Consider: Proton Mail or Tuta
Stronger default cryptography story; thinner classical groupware/ActiveSync depth than Kolab Now.
When: You want privacy-focused German email without full suite complexity
Consider: Posteo
Leaner privacy mail; not a Collabora + shared-domain groupware suite.
When: You need Google/Microsoft-class admin scale, apps marketplace, and compliance certifications
Consider: Google Workspace or Microsoft 365
Far larger ecosystems; US-centric custody and CLOUD Act profile differ sharply.
When: You want full self-host control of the same FOSS stack
Consider: Self-hosted Kolab (kolab.org) or Nextcloud plus a mail stack
More operational burden; Apheleia also sells Kolab professional services.

Nextcloud

Best fit when

Public sector and regulated orgs that must keep content on-prem or in a chosen EU private cloud rather than a US hyperscale SaaS tenant
Enterprises replacing SharePoint/OneDrive-style exchange while keeping LDAP/SAML, audit logs, and file access policies
MSPs and hosters offering branded private-cloud collaboration on their infrastructure
Education and research campuses that want Hub apps (Files, Talk, Office) under institutional IdP and storage
Teams that accept ops ownership (or will buy Enterprise + partner hosting) in exchange for AGPL inspectability and no vendor-held file tenancy

Poor fit when

Buyers who need a fully managed multi-region SaaS with the vendor running HA, support, and compliance certs as the data processor
Use cases that only need peer-to-peer folder sync without a central app server (evaluate Syncthing)
Orgs unwilling to size Talk High Performance Backend, Office concurrency, backups, and upgrade windows
Teams expecting end-to-end encryption on every Hub workflow by default without configuration trade-offs

Consider instead when

When: You mainly need fast file sync/libraries without Talk, Groupware, Office, and AI
Consider: Seafile
Seafile is lighter on collab suite surface area; Nextcloud is broader Hub.
When: You want decentralized P2P sync with no mandatory central collaboration server
Consider: Syncthing
Different architecture—no Hub apps or share-policy model like Nextcloud.
When: You need zero-ops global SaaS productivity with vendor-operated tenancy
Consider: Microsoft 365 or Google Workspace
Higher extraterritorial/process exposure via US vendors; far less self-host control.

Open questions for due diligence

Kolab Now

Will Apheleia sign a GDPR Art. 28 DPA and provide a current subprocessor list (including backups, monitoring, and payment processors) under NDA if needed?
What is the current imprint address and governing ToS URL for contract annexes (product footer vs apheleia-it.ch addresses differ)?
Is there any ISO 27001, SOC 2, or independent penetration-test summary available to customers on request?
How are backups and disaster recovery stored (same Bern facility only, or additional sites/providers)?
For regulated workloads: what is the practical process and historical volume of Swiss lawful-access requests affecting customer content?

Nextcloud

Which infrastructure (on-prem, EU hoster, or hyperscale) will run the production instance and object storage, and what subprocessors does that path introduce?
Is Enterprise subscription required for your SLA, LTS, Talk HPB, Office concurrency, and Microsoft connectors?
Will counsel treat Nextcloud GmbH as a processor for any support, push, telemetry, or managed-service path in your architecture?
Do you need current third-party penetration testing or certification evidence beyond historic NCC/Kyos materials and the bug bounty?
If enabling Assistant/AI, which model backend is used and how is it classified under the EU AI Act?