Nextcloud is an open-source, self-hosted file sync and collaboration suite from Nextcloud GmbH, an employee-funded German company founded in 2016, funded by enterprise subscriptions, not advertising. Server and apps are AGPL-licensed and developed publicly on GitHub. The privacy policy (updated July 2026) says website logs are deleted after 7 days, analytics use Matomo with anonymised IPs, and data is not analysed for marketing. Because the software is self-hosted, files live with whoever runs the server — often a third-party hosting provider — and the operator can read file contents by default: end-to-end encryption is an opt-in, folder-level feature distinct from server-side encryption. Push notifications transit Nextcloud's proxy and Google/Apple with device-key-encrypted payloads; a 2024 academic paper broke the E2EE design, prompting fixes and a partial feature disablement.
TRACK RECORD
1 ENFORCEMENT ACTION
[2025-02-05]
Germany's Federal Office for Information Security (BSI) commissioned and published an independent code analysis and dynamic security assessment of Nextcloud Server, carried out with mgm security partners GmbH under the BSI's 'Codeanalyse von Open Source Software' (CAOS 3.0) project and announced 2025-02-05. The review covered Nextcloud plus the Two-Factor Admin Support, Two-Factor Email, Two-Factor TOTP Provider and Two-Factor Webauthn extensions, combined source-code review with dynamic and interface analysis, identified several vulnerabilities, and disclosed them to the developers under a Coordinated Vulnerability Disclosure process; the BSI states the development team responded quickly and addressed the findings before publication.
Nextcloud's encryption overview describes end-to-end encryption as a folder-level option available from desktop client 3.0, rather than a default applied to all files, and acknowledges that with server-side encryption the keys are present in the Nextcloud server's memory while a user is logged in.
Nextcloud GmbH's privacy policy for nextcloud.com and its services, last updated July 2026, states that data from website visits is stored in server log files, is deleted when no longer required (log-file data after 7 days), and is not analysed for marketing purposes.
Nextcloud's company page states that the company was started in June 2016 by Frank Karlitschek and Niels Mache together with a dozen open source entrepreneurs and engineers, that it is fully employee-funded with an organic-growth strategy, and that its offices are in Berlin and Stuttgart, Germany.
The Nextcloud server is developed publicly in the nextcloud/server repository on GitHub, whose README states that all contributions to the repository from June 16, 2016 onward are licensed under the AGPLv3 or any later version.
A Nextcloud blog post published 2023-10-24 explains that mobile push notifications are encrypted with a public key generated on the user's device and are routed through the Nextcloud Push Proxy before Google's and Apple's push services, so that notification content is only decrypted on the device itself.
Nextcloud GmbH's privacy policy, last updated July 2026, contains an explicit commitment not to pass on data collected in connection with the website without the user's consent.
Nextcloud operates a public security program: its security page publishes responsible disclosure guidelines, security advisories with an official CVE database, and a threat model, and directs vulnerability reports to its HackerOne program at hackerone.com/nextcloud.
Nextcloud's whitepaper page records a further third-party code audit by a named firm: the City of Geneva contracted the Swiss IT security company Kyos to audit the Nextcloud code base it operates, and Nextcloud offers the resulting audit report as a download. The report itself sits behind a download form rather than being posted openly, so only the existence and authorship of the audit are independently verifiable from this page.
Nextcloud commissioned NCC Group to review its security processes and features and published the reviewer's findings in a post dated 2016-12-13. NCC Group's quoted assessment records that Nextcloud assesses risk against ISO/IEC 27002-2013 and Annex 14.2 of ISO/IEC 27001-2013, that the release is subject to in-house vulnerability management and routine independent penetration testing by industry-certified suppliers, and that operational security and governance are independently reviewed; the same post states the security of the release is backed by a USD 5,000 HackerOne bug bounty program.
The peer-reviewed paper 'Share with Care: Breaking E2EE in Nextcloud' (Albrecht, Backendal, Coppola, Paterson; IEEE European Symposium on Security and Privacy 2024) presented three practical attacks that compromised the confidentiality and integrity of user files under Nextcloud's end-to-end encryption; after responsible disclosure, two vulnerabilities were remediated and the first was addressed by temporarily disabling file sharing from the E2EE feature pending a redesign.
Germany's Federal Office for Information Security (BSI) commissioned and published an independent code analysis and dynamic security assessment of Nextcloud Server, carried out with mgm security partners GmbH under the BSI's 'Codeanalyse von Open Source Software' (CAOS 3.0) project and announced 2025-02-05. The review covered Nextcloud plus the Two-Factor Admin Support, Two-Factor Email, Two-Factor TOTP Provider and Two-Factor Webauthn extensions, combined source-code review with dynamic and interface analysis, identified several vulnerabilities, and disclosed them to the developers under a Coordinated Vulnerability Disclosure process; the BSI states the development team responded quickly and addressed the findings before publication.
Nextcloud's Usage survey client, an installable app maintained in the official nextcloud GitHub organization, sends anonymized instance data to Nextcloud (including the app list, database type and size, PHP environment details, and file and user counts), and its README states administrators keep full control and can disable it at any time.
Nextcloud GmbH's privacy policy, last updated July 2026, names Matomo, YouTube and Vimeo as third-party tools used on nextcloud.com, and states that Matomo web analytics processes IP addresses in anonymised form and does not transmit them to third parties.