ONLYOFFICE is an open-source office suite from Ascensio System SIA of Riga, Latvia — free AGPLv3 Desktop Editors that edit local files offline with no account, the Docs editing server, and the hosted DocSpace/Workspace cloud, which is where accounts, AWS-hosted files and analytics come in. One general Privacy Policy covers the website and cloud: it collects name, email and phone for accounts plus IP/location/device technical data, publishes retention and deletion timelines, states that personal data is not sold, and names AWS, 2checkout, Google (login), hCaptcha, monday.com and Google Analytics as third parties. End-to-end encryption exists only as opt-in Private Rooms on a self-hosted Workspace. Ownership is traceable through a 2023 company blog post and UK Companies House filings — a Singapore holding owns the UK company that owns the Latvian SIA, with the register showing prior control by a Nizhny Novgorod (Russia) entity until May 2023 — but the holding's beneficial owners are only available on request. No breach or regulator action was found; the company runs a HackerOne bounty and states it is not ISO-certified as a standalone product.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
15 ON FILE
COLLECTION
ONLYOFFICE's own Desktop Editors FAQ states that the free desktop suite works on one computer without an internet connection — no account or cloud is needed to edit local files — while noting that users can optionally connect the desktop app to a cloud (ONLYOFFICE, Nextcloud, etc.) for collaboration; the general Privacy Policy's account-data collection therefore applies to the cloud/DocSpace service, not to offline desktop use.
Privacy Guides lists OnlyOffice on its Office Suites recommendation page alongside LibreOffice, under criteria that require the suite to be cross-platform, open-source, able to function offline, and able to export to standard document formats; the listing describes it as a cloud-based free and open-source office suite with Nextcloud integration.
Ascensio System SIA's general Privacy Policy (revision dated 02.07.2025), which covers the onlyoffice.com website and the hosted ONLYOFFICE cloud service, states that registering an ONLYOFFICE account requires first and last name, email address, and a phone number for two-factor authentication, and that technical data (IP address, IP-derived location, OS/browser data, hardware specifications, and 'other data') is recorded automatically; it also publishes retention rules — data is processed only while the account is active, inactive accounts are warned after 180 days and deleted 7 days later, and deleted data is fully erased within 60 days.
UK Companies House's persons-with-significant-control register for Ascensio System Limited (company 05718967) records the current controller as Onlyoffice Capital Group Pte. Ltd (Singapore, notified 7 August 2023, 75%+ of shares) and lists ceased controllers: Rk-Technology Jsc of Nizhny Novgorod, Russia (1 November 2019 to 29 May 2023), Sherzod Usmanov of Tashkent, Uzbekistan (29 May 2023 to 7 August 2023), and Aleksei Miasnikov of Nizhny Novgorod, Russia (2017 to 2019) — a mandatory-filing trail showing the group's control moved from Russia through Uzbekistan to a Singapore holding in 2023.
The ONLYOFFICE Desktop Editors README on GitHub states the desktop suite is licensed under the GNU Affero General Public License v3 and links the component repositories (desktop-apps, desktop-sdk, core, sdkjs, web-apps) that make up the build, so the shipping code is publicly inspectable.
The ONLYOFFICE DocumentServer repository (the online editors/Docs server that also underlies the desktop and cloud products) publishes its LICENSE file as the GNU Affero General Public License version 3; paid Enterprise/Developer editions are sold under separate commercial license agreements listed on the legal-terms page.
ONLYOFFICE's About page names Ascensio System SIA, headquartered in Riga, Latvia, as the developer, names Lev Bannov as Founder and CEO, and states that a holding company in Singapore unites offices in Riga, Singapore, London, Dallas, Belgrade, Yerevan, Tashkent and Shanghai; the page frames ONLYOFFICE as an open-source project with contributors in more than 30 countries.
A company blog post dated 18 August 2023 discloses the ownership chain: ONLYOFFICE Capital Group Pte. Ltd. (Singapore, UEN 202320424D, incorporated 24 May 2023) is 100% owner of Ascensio System Limited (UK), which is 100% owner of Ascensio System SIA (Latvia); the post says the ultimate beneficiaries are listed with Singapore's ACRA and the business profile 'can be provided upon request' — i.e., the natural-person owners are not published on the company's own site.
The Desktop Editors product page states that the desktop app can be connected to third-party cloud platforms (ONLYOFFICE, Moodle, Nextcloud, ownCloud, Seafile, Liferay, KDrive) and to 'any online or local AI provider' of the user's choice — document content leaves the device only when the user connects such a service, but once connected the AI-provider or cloud operator, not ONLYOFFICE, receives it.
ONLYOFFICE's Private Rooms page describes an opt-in end-to-end-encrypted mode in which documents are encrypted on the client with AES-256 keys wrapped by per-user asymmetric keys, but it is not the default: it requires deploying ONLYOFFICE Workspace on your own server, enabling it in the Control Panel, and using the Desktop Editors — ordinary cloud/DocSpace documents are not end-to-end encrypted by default and remain readable by the service operator.
The general Privacy Policy states that Ascensio System does not sell personal data and will not share individual customer information outside contracted partners and third parties without prior written approval, while naming the third parties that do receive data for the cloud service: Amazon AWS for file storage (region chosen by the portal admin: EU/Germany, US West/Oregon, or Asia Pacific/Singapore), payment provider 2checkout (US, Netherlands, Romania), Google when Google login is used, a monday.com integration, and hCaptcha; the no-sell sentence names 'Ascensio System Limited' (the UK entity) rather than the Latvian SIA named elsewhere in the policy.
ONLYOFFICE's security page states that ONLYOFFICE is not currently ISO-certified as a standalone product, and points to a HackerOne bug bounty program as its external testing artifact; no third-party audit report by a named firm is offered on the page, and no breach or regulatory action involving ONLYOFFICE was found in this research.
A company blog post dated 17 February 2022 announced the ONLYOFFICE bug bounty program on HackerOne, launched as a private program starting from 20 invitations, with bounties ranging from $50 to $750 by severity — a real but modest funded-bounty artifact.
Apple's App Store privacy label for the ONLYOFFICE Documents iOS app (seller: Ascensio System SIA) declares only 'Data Not Linked to You' — Usage Data and Diagnostics — with no data used to track the user across other companies' apps and no data linked to identity; Apple notes this information is developer-declared and not verified by Apple.
The general Privacy Policy discloses that the onlyoffice.com website and service use Google Analytics cookies (including for marketing campaigns), embed social-media 'share/like/tweet' buttons through which social networks may record actions, and run hCaptcha from Intuition Machines, Inc. (US), which analyzes IP address, time on site, and mouse movements — conventional third-party analytics on the website and cloud rather than first-party-only tooling.