Collabora Online for public sector and government

Why public sector teams self-host Collabora Online for document editing

A ministry, municipality or agency that must keep its documents under its own control can run Collabora Online on infrastructure it operates, so that browser-based editing of documents, spreadsheets and presentations happens inside its own boundary. Collabora Online is the editing service, and the host platform keeps the files. Documents stay in Nextcloud, openDesk or another WOPI host, while Collabora Online renders and edits them in the browser through the WOPI protocol. That split matters for procurement and risk reviews, because the team can name exactly which component stores content and which one only processes it during a session.

The integration works through WOPI, in which the host platform hands the editor a short-lived reference to a file and the editor reads and writes it back through the host. In Nextcloud, this is configured in Nextcloud Office, where administrators also choose which groups may use the editor and which may edit rather than only view. In openDesk, Collabora is the bundled web office, and ZenDiS documents its deployment as part of a Kubernetes-based stack. Before go-live, the team should confirm with its host vendor which WOPI host versions and configuration keys apply to its release, and should check that the Collabora server URL uses the same protocol as the host, preferably HTTPS.

Collabora Online's server code is licensed under the Mozilla Public License 2.0 (MPL-2.0), which lets public bodies inspect, self-host and modify the server without a per-seat license for the code itself. Collabora's commercial subscriptions cover support, long term support, signed security updates and a customer portal, and those terms are separate from the license. Procurement teams should therefore ask for the support scope in writing and treat the license and the subscription as two decisions. The open license does not remove the need to test document fidelity, patch on a published schedule and document who operates the service.

Which public sector requirements shape the Collabora Online build

This table maps the public sector requirements for this topic to the bodies they apply to and to the hosting, routing and support decisions they shape. Check the applicability column first, because several rules exclude defence, law enforcement or national security bodies, or depend on population size. Data location, provider jurisdiction and accessibility shape most of the architecture, so settle applicability before choosing where Collabora Online runs.

Requirement	Who it applies to	What it means for the build
NIS2 (Directive (EU) 2022/2555)	Central government entities of any size. Local administration only where a Member State extends it. Excludes national security, public security, defence and law enforcement.	Treat the editing service as part of the supply chain you must manage. Confirm with your national authority whether your body is in scope.
GDPR Chapter V and Article 44	Controllers and processors that transfer personal data to third countries.	Keep documents and storage in the EEA. Remote administrator access from outside the EEA can count as a transfer.
Third-country authority access (GDPR Article 48, 18 U.S.C. 2713, EDPB 01/2020)	Bodies engaging a provider subject to third-country law with extraterritorial reach.	Assess provider jurisdiction before engagement. Self-hosting keeps document content on your infrastructure, but partner support access still needs assessment.
EU Data Act Article 32 and switching rights	Providers of data processing services offered in the EU, and customers of those services.	Ask any hosted editing provider for its safeguards against third-country access and its switching terms. Switching charges are banned from 12 January 2027.
ADA Title II (28 CFR 35.200, WCAG 2.1 A and AA)	State and local governments, including web content delivered through contracts or licenses.	Compliance dates are 26 April 2027 for entities serving 50,000 or more people and 26 April 2028 for smaller entities. Request the editor's accessibility documentation and test your own templates.
FBI CJIS Security Policy v6.1	Agencies that handle criminal justice information in the United States.	Requires FIPS 140-3 validated modules or AES-256 for CJI at rest and in transit outside physically secure locations. Vulnerability scanning is at least monthly.
CUI under 32 CFR 2002.14(h)(2)	Non-federal systems that hold controlled unclassified information for federal agencies.	NIST SP 800-171 applies unless the CUI category sets other safeguards. Confirm the category with the data owner before selecting a host.
FedRAMP scope (OMB M-24-15)	Cloud services that handle federal information on behalf of an agency.	A single-agency system on cloud infrastructure, not offered as a shared service, is out of scope. A multi-agency hosted editing service is likely in scope, so confirm with the program.

Choosing between openDesk, a Nextcloud stack and a standalone Collabora Online server

openDesk is a Kubernetes-based digital workplace suite for public administration, provided by ZenDiS GmbH, and Collabora is bundled in it as the web office next to Nextcloud, OX App Suite, Element, XWiki, OpenProject and other components. You do not choose Collabora as a standalone product here. You adopt the whole suite, so the platform obligations cover far more than the office editor.

Kubernetes baseline: openDesk requires a CNCF-certified cluster at v1.33 or later, an ingress controller, cert-manager, an RWO volume provisioner, Helm 3.17.3 or later below v4 and Helmfile 1.0.0 or later.
Production services: the documentation expects external production-grade PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server.
Evaluation versus production: the minimum evaluation footprint is 12 x64 cores, 32 GB of RAM and more than 10 GB of disk, but ZenDiS recommends the Enterprise Edition for production.
Release cadence: major releases are planned annually in Q3, minor releases monthly, and only the latest minor is supported, so upgrade planning becomes a standing duty.
Enterprise features: Collabora branding and automatic load scaling are listed among Enterprise-only features.

Confirm with ZenDiS or your integrator which edition and support tier cover your production estate before you commit to a timeline.

Configuration choices that matter in government deployments

Government deployments of Collabora Online tend to fail on a few early configuration decisions rather than on the editor itself. The cards below cover routing, network trust, permissions, format fidelity, AI features and identity, and each one forces a choice that is cheaper to make before the first user logs in.

Routing by WOPISrc

Collabora's Helm chart states that horizontal pod autoscaling is disabled because scaling breaks collaborative editing and copy and paste, so replicas are set manually. Your load balancer must route by the WOPISrc parameter, so every user editing one document reaches the same pod. Confirm the ingress you will use (Nginx, HAProxy or OpenShift Router) supports this before you size the cluster, and agree who changes replica counts and when.

Restricting WOPI host addresses

The Nextcloud administration manual recommends restricting WOPI requests to the IP addresses of the Collabora servers and using HTTPS for the Collabora server URL, matching the protocol of the Nextcloud installation. The decision is who is allowed to talk to the editing server and how that list is maintained when addresses change behind load balancers or proxies. Document the allow list as a controlled configuration item with an owner and a review trigger.

Group-based editor permissions

In Nextcloud Office, administrators can limit which groups can use the editor and which groups can edit rather than only view. Public bodies usually need this split for staff roles, contractors and external reviewers. Decide the group model before rollout, map it to your directory, and test that a view-only group cannot open a write session through a shared link.

Testing ODF and Microsoft formats

Citizen-facing exchange involves documents created in OpenDocument and in Microsoft formats such as docx, xlsx and pptx, plus PDF and CSV. Your policy must say which format is the official record and which is accepted for submission. Build a fidelity test set from real forms and templates, then check layout, tracked changes and formulas after a round trip before you commit to a format rule.

AI assistant off by default

Collabora Online 26.04 adds an optional AI assistant across Writer, Calc and Impress. It is off by default, and administrators choose the AI provider and whether it runs externally or on their own infrastructure. For government data, the decision is whether any provider is approved at all, and if so whether it is hosted in your own infrastructure. Keep the feature disabled until that assessment is documented and signed off.

Federating an external identity provider

openDesk documents federation with an external identity provider, and Collabora is one of its bundled components. Decide whether your agency's directory or an external IdP is the source of identity, how group claims reach the editing and file layers, and how leavers lose access to open documents. Ask the implementation partner to test session expiry and group removal, not only first sign-in.

How sovereign hosting and third-country access change the design

Sovereign hosting is mainly a question of who can reach the data and from where, and that question shapes the Collabora Online design before any server is installed. Under EDPB Guidelines 05/2021, remote support from a third country counts as a transfer even when the support engineer only views data on a screen, and so does storing data in a cloud outside the EEA. The administrative path matters as much as the storage location. Map every account that can log in to the Collabora hosts, the Nextcloud or other WOPI host, the container registry, the Kubernetes cluster and the backup store, and record the country each administrator works from. A vendor or integrator with staff abroad who can open a shell on the server is part of the transfer analysis, not an afterthought.

The guidelines also say that using an EU processor subject to third-country law with extraterritorial effect is not in itself a transfer, but complying with a third-country authority request would be. That makes the exposure assessment a required step before you engage any processor, including a support partner. Ask which laws the processor and its parent are subject to, and whether the company could be compelled to disclose data held in the EU. The US CLOUD Act provision at 18 U.S.C. 2713 applies regardless of where data sits, and EDPB Recommendations 01/2020 state that where a provider needs data in the clear and foreign powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Encryption that the provider can break does not solve that case. The Data Privacy Framework adequacy decision, Commission Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List, and an appeal of the General Court's September 2025 judgment is pending as Case C-703/25 P. Confirm the status with counsel before relying on it.

For most public bodies the strongest design is to run Collabora Online inside infrastructure the body operates or contracts under its own control, with administrative access limited to named staff in the EU and logged. Article 32 of the Data Act (Regulation (EU) 2023/2854) asks providers of data processing services to take technical, organisational and legal measures against third-country government access to non-personal data held in the Union, so ask any hosting provider for those measures in writing. Document the decision, the processors involved, the access roster and the review date in the record of processing. Also confirm that updates and signing keys come from a source you can verify, and that remote vendor sessions are approved and recorded.

How a public body moves from pilot to production in phases

The sequence turns a pilot into a supported production service by settling scope, proving the platform in a non-production setting, and then moving user groups over in controlled stages. Each phase ends with a written check that the next one depends on.

Scope the hosts and user groups
Start by listing every platform that will open documents through Collabora Online, such as Nextcloud or an openDesk deployment, and the user groups that will edit, view or only read files on each one. Record which groups need editing rights and which need view-only access, since Nextcloud Office can limit both. Confirm the data classification of the documents in scope, because it determines which hosting and access conditions apply. The step is complete when the owner signs off a written scope listing hosts, groups, document types and data classes.
Build a non-production evaluation
Deploy Collabora Online and the chosen host in a test environment that mirrors the production network path, including the reverse proxy and the WOPI connection between the host and the Collabora server. If the target is openDesk, its requirements documentation gives minimum evaluation hardware of 12 x64 CPU cores, 32 GB of RAM and more than 10 GB of disk, with ARM not yet supported, so confirm your hardware against that list first. Run the test with a small set of pilot users. The step closes when the team can open, co-edit and save a representative set of documents from every host in scope.
Size and build production services
Move from the evaluation to production services with the external dependencies the platform expects, such as production-grade databases, an SMTP relay, object storage and a TURN server where the chosen stack calls for them. Set replica counts by hand, because the Collabora Helm chart disables horizontal pod autoscaling and scaling breaks collaborative editing. Configure load balancing so that all users editing one document reach the same pod, and restrict WOPI requests to the Collabora server addresses. The step is complete when a load test on the production layout behaves as your sizing estimate predicted, and the results are filed with the change record.
Test accessibility and document formats
Test the editing experience against the accessibility obligations that apply to your entity. Under the ADA Title II rule, state and local government web content and mobile apps, including content supplied through contracts or licenses, must meet WCAG 2.1 Level A and AA from 26 April 2027 for entities serving 50,000 or more people, and from 26 April 2028 for smaller entities and special districts. Involve accessibility specialists to test with assistive technology, and run a format fidelity test on the Microsoft, OpenDocument and PDF files your users actually open. The step closes with a documented result for each gap, with an owner and a fix date.
Cut over by user group
Roll out in stages, starting with the pilot groups and then adding further groups as each one confirms that its documents, permissions and workflows behave correctly. Keep the previous editing route available until each group has run its normal work without a blocking issue. Tell users which host and link to use, and give a short channel for reporting faults. The step is complete when every group in the written scope is live and the rollback path has been confirmed as no longer needed for that group.
Handle patches and releases in production
Set a routine for applying Collabora Online point releases and security advisories, and decide who approves each change. For example, the 25.04 release notes record that 25.04.7.5, released January 29, 2026, fixed CVE-2026-23623 and updated package signing keys, which shows why signing key changes need to be checked during updates. For openDesk deployments, its release management documentation says only the latest minor version is supported and in-place upgrades between majors are not guaranteed, so plan test runs before each upgrade. The step is done when the patch procedure is written, has been run once in the test environment, and is owned by a named team.

Compliance considerations to confirm with your auditors and legal team

Public sector deployments of Collabora Online sit inside several overlapping frameworks, and each one depends on the system boundary, the data classification and who operates the service. The cards below cover the frameworks most often raised in government reviews, with the question to settle for each one before the architecture is fixed.

NIST SP 800-53 as a control reference

NIST SP 800-53 Revision 5 is the federal control catalog, and SP 800-53B selects low, moderate and high baselines of 149, 287 and 370 controls and enhancements. Agencies and contractors often use these baselines as a shared vocabulary even when no federal authorization applies. Map each Collabora Online component, including the WOPI host, the document servers, the reverse proxy and the storage, to the controls your baseline selects, and confirm with your assessor which of them your organization owns.

FedRAMP applies to shared cloud services

FedRAMP covers cloud products that create, collect, process, store or maintain federal information on behalf of an agency. A system used only for one agency's operations on cloud infrastructure, and not offered as a shared service, falls outside that scope. A self-hosted Collabora Online instance run only for your own staff is normally not a FedRAMP question, but a hosting provider offering editing to several agencies is. Ask legal counsel to confirm the boundary in writing before the service is described to any customer.

CMMC cloud rules for defense contractors

Under 32 CFR 170.17(c)(5), a defense contractor pursuing CMMC Level 2 may store or process CUI in a cloud service only if that service is FedRAMP Authorized at the Moderate baseline or higher, or meets equivalent requirements. Self-hosting Collabora Online inside the contractor's own assessed scope avoids a third-party cloud service, but the editing host, its logs and its backups then become part of that scope. Confirm with the CMMC assessor how the editor and its supporting components are classified before deciding where the servers run.

CJIS v6.1 encryption and scanning

CJIS Security Policy version 6.1 took effect on 26 June 2026 and requires FIPS 140-3 certified cryptographic modules, or FIPS 197 AES with keys of at least 256 bits, for criminal justice information in transit and at rest outside physically secure locations. It also requires vulnerability scanning at least monthly. For Collabora Online, confirm that TLS between the WOPI host, the editor and the browser, and any storage encryption, use validated modules, and add the editor, proxy and container images to the monthly scan schedule.

NIS2 scope exclusions for security and defense

NIS2 covers central government entities regardless of size and lists public administration as a sector of high criticality, while Member States may extend it to local administration. The directive does not apply to entities working in national security, public security, defence or law enforcement. A ministry or agency should decide with legal counsel whether its editing service falls inside NIS2 or inside one of those exclusions, because the answer changes the obligations on supply chain security, incident reporting and patch management for the editor.

DeployOpen prepares evidence, not audit reports

DeployOpen plans, hardens, documents and tests Collabora Online deployments and prepares the systems, controls and evidence that an assessment will examine. DeployOpen does not issue audit reports, attestations or certifications, and those decisions belong to independent auditors, certification bodies or the relevant authority. Ask each reviewer early which evidence they accept, such as configuration baselines, scan results, access reviews and change records, so that the evidence package matches what the assessment needs.

Procuring support for Collabora Online in public bodies

Procurement for a public body should start by separating the free edition from anything you would run in production. CODE (Collabora Online Development Edition) is free and released roughly once a month as a rolling release, and Collabora describes it as suited to testing, home use or small teams, not production. A production service needs a supported plan. Collabora's pricing page lists the Business plan at 3 euros per user per month for up to 99 users, including long term support, a service level agreement, signed security updates and customer portal access. The Enterprise plan, for 100 or more users, is quoted with volume discounts and adds integration support, customization services and roadmap input. Confirm whether the quoted price includes VAT, how seat counts are measured, and whether a Business plan can convert to Enterprise mid-term without a new contract.

If your Collabora Online runs inside openDesk, support is bought through ZenDiS rather than Collabora directly. ZenDiS recommends openDesk Enterprise Edition for production. It uses the same open-source core licenses but adds closed-source modules, an Enterprise-only registry and license file, and SLA-backed 2nd and 3rd level support and patches, sold as SaaS or for on-premises installation. Its documented Enterprise-only features include Collabora branding and automatic load scaling, so ask which of these your deployment depends on and confirm in writing which support tier covers the Collabora component specifically. Read the openDesk Enterprise Edition documentation before comparing offers.

A public body procurement should require the following in writing: a patch response commitment with stated severity levels and times, signed updates for packages and images so your staff can verify them, a named long term support branch with its end date, and access to advisories. Collabora publishes security advisories, and its 25.04 release notes record a fix for CVE-2026-23623 and updated package signing keys for RPM and DEB users. Ask how key rotation is communicated. For exit terms, the EU Data Act gives customers the right to switch from a data processing service to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition, and it bans switching charges from 12 January 2027 (Articles 25, 29 and 50). Have counsel confirm how these terms apply to your contract and to any support-only arrangement.

Questions public sector buyers ask before hiring a partner

What drives the cost of a public sector Collabora Online deployment?

Scope and the number of users drive most of the cost, followed by how much of the surrounding platform must be built. A quote usually separates the one-time work (design, integration with your identity provider and storage, testing, documentation and handover) from recurring work (patching, upgrades, monitoring and support). Collabora's own pricing shows that licensing is a separate line: its Business plan is listed at 3 euros per user per month for up to 99 users, and the Enterprise plan for 100 or more users is quoted with volume discounts. Ask any partner to show licensing, implementation and support as separate lines, and to state which of them are fixed and which are time-and-materials.

Can our own IT body run openDesk or Collabora Online without a partner?

Yes, if your team has the skills and capacity, and many public bodies run their own platforms. openDesk is a Kubernetes-based suite, and its requirements list a CNCF-certified cluster at v1.33 or later, an ingress controller, cert-manager, an RWO volume provisioner, Helm and Helmfile, plus production-grade external services such as PostgreSQL, Redis and an SMTP relay. Collabora Online alone is simpler to run, but it still needs correct WOPI routing, since the Helm chart requires load balancers to route by the WOPISrc parameter. Assess whether your staff can operate these components through upgrades and incidents, and confirm the support route for each component before deciding.

How long does a public sector rollout take, and what does it depend on?

The duration depends on the platform scope, the number of users, your integration points and how quickly approvals, procurement and security reviews move through your organization. No fixed duration can be stated before the scope is written. Ask for a timeline that lists each phase, the dependencies on your side (cluster access, identity provider configuration, storage, DNS and certificates, test users) and the review gates. Also ask how pilot users, file fidelity testing and accessibility checks are scheduled, because these often set the critical path.

What does the work need from our staff?

Expect to provide named owners for identity, network, storage, DNS and certificates, and a decision maker who can sign off scope changes. Your platform team will need access to the target cluster or servers, a change process, and time for reviews and acceptance testing. Security and compliance staff should be involved early to agree on controls and evidence. Ask the partner to list every input they need from you, the person responsible for each, and the date by which it is needed.

Does a fixed-scope quote cover ongoing patching and upgrades?

Usually not by default. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and ongoing support, upgrades and continuous testing are offered as separate retainers. Check whether the quote includes the first upgrade cycle, how security advisories are applied, and who handles the work after handover. Collabora publishes security advisories, and its Business plan lists signed security updates and a service level agreement, so confirm which of these the supplier passes on to you and which the retainer covers.

Which accessibility and compliance obligations affect our choice of partner?

Public bodies in the United States must meet WCAG 2.1 Level A and AA for state and local government web content and mobile apps, including content provided through contracts or licenses, with dates that depend on the entity's size. Confirm with your counsel which deadline applies to you. Compliance readiness work is available from DeployOpen, which prepares systems, controls and evidence for assessments, but independent auditors and certification bodies issue the audit reports and certifications. Ask any partner to show how they will document accessibility testing and which assessor will review the evidence.

Where should we check data residency and foreign access risk before we sign?

Check where the platform runs, where backups and logs are stored, and who can access the data from outside your jurisdiction, including remote support sessions. Under GDPR, remote access from a third country, even only displaying data on a screen, is a transfer under EDPB Guidelines 05/2021. The Data Act also requires providers to take measures against third-country government access to non-personal data held in the Union. Ask the partner to state where their staff work, how support access is granted and logged, and which legal exposure they assess for their own organization before engaging with you.

How DeployOpen scopes and supports public sector Collabora Online

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including Collabora Online for public sector and government. Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.

How we scope

Written scope names the WOPI hosts, such as Nextcloud, that will connect to Collabora Online.
Scope records the hosting location, network zones and whether any editing traffic leaves your jurisdiction.
Scope lists the accessibility, document format and records-retention checks your agency needs to evidence.

How we build

We deploy Collabora Online in your cloud accounts, data centers or air-gapped network, using the method your team has chosen.
We configure WOPI allow lists, TLS and WOPISrc-aware routing so all users editing one document reach the same server.
We test document fidelity for the OpenDocument and Microsoft formats your staff actually use before users go live.

How we hand over

Handover includes configuration records, runbooks for updates and restarts, and the evidence your compliance team asks for.
We document the decisions made on hosting, identity, access groups and AI features, which stay off unless you enable them.
Your staff receive a walkthrough of monitoring, backup and update procedures, so operations stay with your own team.

How we support

Ongoing support, upgrades and continuous testing are available as retainers, scoped in writing like the original build.
Upgrade work covers moving between Collabora Online branches and tracking security advisories that affect your installation.
Support requests are scoped to your environment, so you can confirm the response terms with us before you sign.