CryptPad
Verified“French through and through β and the server can't read your data anyway.”
- Founded
- 2004
- Ownership
- Employee-owned
- Workforce
- 70+
- Encryption
- Zero-knowledge
94 = midpoint of Control 95 & Data 93
Sovereignty Quadrant
Control β who owns & governs the company Β· Data β where your data lives. Every dot is a company β click to open it.
Every number below traces to 13 sourced facts across 4 independent sources, last verified 2026-06-12. 3 open questions hold confidence at 88% β they lower confidence, never the score.
Control β
Who legally and economically controls the company
Legal & Jurisdiction
95
Incorporated and operated entirely in France. XWiki SAS is a French sociΓ©tΓ© par actions simplifiΓ©e, registered in the Paris Trade & Companies Register, with no foreign parent. EU law (GDPR, CNIL) reaches it directly and there is no competing foreign jurisdiction over the operating entity.
Why 95? 3 sourced facts · click to expand
Registered office in France
XWiki Legal Notice Β· as of 2026-06-12
Operates under EU/French data-protection law (GDPR, CNIL)
Privacy Guides β CryptPad Review Β· as of 2025-02-07
Control & Ownership
95
Privately held and employee/contributor-owned. XWiki SAS states all shareholders are employees, ex-employees, or open-source contributors; the company is not listed and explicitly does not report to external investors. Both voting control and economic interest sit in the EU.
Why 95? 3 sourced facts · click to expand
Shareholders are employees/ex-employees/OSS contributors
XWiki β Who We Are Β· as of 2026-06-12
Independent; no external financial-only investors
XWiki β Who We Are Β· as of 2026-06-12
Data β
Where your data lives and who can reach it
Data & Infrastructure
92
User data lives on OVHcloud, a French-owned provider, in French datacenters β not a US hyperscaler. Critically, CryptPad's zero-knowledge end-to-end encryption means content is encrypted in the browser and is unreadable by the server, so even a CLOUD Act-style demand to the host would yield ciphertext, not documents. Caveat: operators can still see metadata (IP, activity).
Why 92? 4 sourced facts · click to expand
Hosting provider is OVH (French company)
XWiki Legal Notice (hosting section) Β· as of 2026-06-12
Content encrypted in browser; server/admins cannot read it
CryptPad β About Β· as of 2026-06-12
Encryption primitives
Privacy Guides β CryptPad Review Β· as of 2025-02-07
Operator can still see metadata (IP, activity)
Privacy Guides β CryptPad Review Β· as of 2025-02-07
Operations & People
95
Operations are EU-centered: HQ in Paris with a second office in IaΘi, Romania, 70+ staff across France and Romania, a French CEO/founder, and EUR reporting (share capital stated in euros). No meaningful operational center of gravity outside the EU.
Why 95? 3 sourced facts · click to expand
Euro-denominated company (share capital β¬38,160)
XWiki Legal Notice Β· as of 2026-06-12
Aligned to the EU Commission’s official Cloud Sovereignty Framework (SEAL, Jun 2026) β
What we don’t know
3 open questions β they lower confidence, never the score
- ?
Exact split of where CryptPad.fr user data physically sits within OVHcloud (which French/EU datacenter region).
Low β provider is French-owned and EU-located either way, and content is E2EE; precise region would only refine the infra score.
- ?
Whether any third-party (US-based) analytics, payment, or CDN processors touch cryptpad.fr (e.g. for the paid Cloud subscription billing).
Medium β non-core processors could introduce limited foreign-law exposure for metadata/billing, though not document content.
- ?
Current precise headcount split between France and Romania, and any non-EU contractors.
Low β both stated locations are in the EU; would not change the operations verdict.
EU Cloud Sovereignty Framework lens
SEAL was designed to score cloud service providers; CryptPad is applied here as an analogous mapping for sovereignty signaling, not as a formal SEAL certification.
Strategic
Independent EU company, mission-aligned employee ownership, no foreign control or investor exit pressure.
Legal & jurisdictional
French SAS, RCS Paris registered; squarely under GDPR/CNIL with no competing foreign jurisdiction over the operating entity.
Data & AI
Zero-knowledge E2EE means content is unreadable by the server; no AI-data harvesting business model.
Operational
HQ Paris + office IaΘi; 70+ staff entirely within EU (FR/RO); EUR reporting.
Supply chain
Core hosting on French-owned OVHcloud; potential minor non-EU processors (billing/CDN) for the paid Cloud tier are unverified.
Technological
Fully open-source (AGPL-3) client and server; self-hostable, removing any single-operator dependency.
Security & compliance
Strong audited-style crypto (XSalsa20-Poly1305, Ed25519) and GDPR posture; metadata (IP/activity) still visible to operator, and no public formal certification (e.g. ISO 27001) confirmed.
Environmental sustainability
No verified data on energy sourcing or carbon reporting found for XWiki SAS or its OVHcloud footprint.
EU alternatives
German open-source collaboration/office suite; self-hostable, widely used in EU public sector. Different model (not zero-knowledge by default) but a strong EU peer.
Former E2EE docs competitor β US-based and shut down after acquisition by Notion; listed only as a cautionary non-EU contrast.
Zero-knowledge encrypted collaboration with strong privacy law, but Swiss (not EU) and owned by Swiss Post; adequacy-based rather than EU-internal.
How the method works
Methodology v2 (provisional): the score is the midpoint of two axes β Control (who owns and governs the company) and Data (where your data lives and who can reach it). Each axis is scored only on verified evidence; unknowns reduce confidence, never the score. Every input below is sourced; the weights and judgments are open to challenge.
Spotted an error? Every claim is sourced β challenge it and we correct the record.
- 2026-06-12 β Initial golden profile, authored from primary sources (human + AI review).
Report Incorrect Data
Found an error in this company's profile? Help us improve our data by submitting a correction.
Verified 2026-06-12 Β· Human + AI joint review (sources independently checked) Β· Methodology