What people ask before they move a team or a community over — security, hosting, the assistant and the bill. If yours is not here, write to hello@coreoffice.eu.
Plenty of products say "secure" and stop there. Here is the specific answer, including the parts that are not encrypted and the parts we are still building.
Direct messages, group chats, server channels and the files sent inside them — encrypted in your browser before they are sent, so we cannot read them. Meeting media too, on supported browsers.
Every file in a CoreOffice workspace is encrypted with its own AES-256-GCM key. That key is itself sealed by a separate master key and stored apart from the file, so the file storage, the database and the master key are three separate things, and a copy of any one of them opens nothing on its own.
Version history is encrypted the same way, everything travels over TLS, and who can open a file follows your workspace membership and team permissions. On a self-hosted server the keys are generated on your own machine and never leave it.
Because documents are previewed and co-edited in the browser by an editor that runs on the server, and it cannot do that with a file it is unable to open. So the service decrypts a file only to show or edit it for someone who has access, or when you ask the assistant to work on it — the same trade most online office suites make. Messages never need that, so they are sealed in your browser instead, and so is a file you send inside a conversation.
On free CoreCommunity servers and on personal files there is no at-rest encryption for files. The text of calendar entries, tasks and form responses is encrypted at rest everywhere, but not end-to-end: the service holds the key so it can show and sync them, and their dates, times and attendees are not encrypted.
For one-to-one messages, yes — the same construction. Direct messages run over X3DH and the Double Ratchet: a session per device and a fresh key for every message, which gives forward secrecy and post-compromise security. Our own implementation of the published spec, not Signal's library, and not independently audited.
Group chats and channels still share one group key and are not forward secret — that is the next piece.
Yes. Every direct message is sealed separately for each device you are signed in on. A device you add later is the harder case: forward secrecy destroys the keys that opened older messages, so without help a new laptop would start from empty.
So key recovery is on by default: your app keeps a sealed copy of each message as it reads it, under a key only your passphrase opens. Sign in on the new device, unlock, and your history is there. The trade is that someone who learns your passphrase can read your archived history — one switch in Settings turns it off and deletes every copy.
There is no Google Analytics, no Sentry, no advertising pixel — no third-party code receives your data. We do keep our own product analytics, and those sit behind a consent banner.
Where it runs, who it answers to, and how you take it with you.
In EU data centres. Our cloud runs on Hetzner servers, a German provider, inside the EU. Or on a server you own — one command on your own Ubuntu machine, talking to no external service. Self-hosting is on every plan, not an enterprise upsell.
A Portuguese company, invoicing in euros, under EU law — not a subsidiary answering to a parent company on another continent. Ask which providers touch your data and we will name them.
An Ubuntu machine you control. One command installs the whole stack behind your firewall, and it calls no external service once it is running — we have no access to it. Self-hosting comes with the free plan too. How the licence works is on the pricing page.
Yes, and it is a supported path rather than a favour: you export from the cloud workspace and import into your own installation.
Yes. Messages, files, tasks and calendars export to JSON, CSV or ZIP, and documents are kept in formats LibreOffice opens without us. Leaving should take an afternoon. Software you cannot walk away from is not really yours.
You submit a data-subject request and an administrator fulfils it — export as JSON, CSV or ZIP, or full erasure. A breach register and consent history sit behind the same panel.
CompanionCore opens your files and edits them, rather than talking about them. Here is what it sees.
Only if you choose that. The assistant can run on a local model, so nothing leaves. Prefer a hosted one and you bring the key and decide what it sees.
No. Your work is never training data.
No. CompanionCore is included on every CoreOffice plan, at no extra cost per person.
The short answers. The full table, the calculator and the billing questions are on the pricing page.
From €4,99 a month plus €1,99 a person on our cloud, net of VAT. Larger teams move to a per-person plan with no platform fee, and if you would rather own than rent there is a licence you buy once. See every plan.
Yes, and no card is required. At the end of the trial the workspace is not deleted: it becomes read-only until you either subscribe or export your data. Nothing disappears without you being told first.
Yes — registered nonprofits, schools and universities get 50% off, cloud or self-hosted. Write to us from the institution's own domain and we apply it.
Channels, voice and video for a group of people who are not a company.
Free, and it does not get more expensive as the server fills up — there is no per-member charge and no history cut-off. Boosts are the only money in it, they are bought by members rather than by the owner, and they only ever add capability. A server that nobody ever boosts keeps working exactly as it is.
Who they are for. They share a codebase, an infrastructure and a security model. CoreOffice is the full suite a company runs on — chat, meetings, documents, calendar, mail, tasks and the assistant. CoreCommunity is a free home for a community: channels, voice, video and file sharing. More on CoreCommunity.
Yes. Host it yourself and the storage ceiling goes away entirely.
What to install, and what state things are in.
In the browser, with nothing to install, and as an app for Windows, macOS, Linux, iOS and Android. The desktop app holds about 5 MB of memory when idle — the measurement is on the home page.
Not yet — we are in beta, so prices, dates and details can still move before launch. Online checkout is not live: during the beta we arrange the subscription with you directly. Leave your email and we open a workspace for you.
Write to hello@coreoffice.eu and we answer. Or skip ahead and try it with your team.