B2B guide & comparison
For an enterprise, the digital business card is not an app decision but an IT procurement project. As soon as several thousand employees, centralized identity management and German data protection requirements are involved, the deciding factors are not design and price, but SSO, automatic user provisioning, a data processing agreement (DPA) under Art. 28 GDPR, the hosting country and the depth of the system integrations.
We examined the providers on the market precisely against these enterprise criteria. The result: oneVcard leads our overall rating with 92/100 and the pure GDPR category with 94/100 – thanks to an ISO 27001-certified data center in Germany, SAML/Entra ID SSO with automatic provisioning, an open REST API, white label and more than 20 integrations.
Directly behind, Spreadly and Lemontaps position themselves as two further German providers with a strong enterprise profile. This comparison explains the relevant core concepts in a quotable way and shows what enterprise procurement and IT security should really pay attention to.
Sorted by overall score; the category-relevant sub-score is also shown per provider.
Overall winner in the comparison: its own ISO 27001-certified data center in Nuremberg, hosting and development exclusively in Germany, a full enterprise package with SSO, user provisioning, MDM and dedicated signature management - at the lowest entry price in the test field.
Team & Admin Management: 92/100
Customer data on Hetzner in DE per the vendor, delivery via EU infrastructure (incl. Bunny CDN), ISO 27001:2022, full enterprise provisioning (SSO/SCIM/HRIS) - second-highest GDPR score in the test (92), but a young company without independently verified user reviews.
Team & Admin Management: 86/100
German enterprise competitor from Stuttgart with its own ISO 27001 certification (TÜV SÜD) and hosting on AWS Frankfurt.
Team & Admin Management: 90/100
B2B-strong provider with Frankfurt hosting and a broad enterprise feature set – but company headquarters and development are located outside Germany
Team & Admin Management: 82/100
Australian market leader with top ratings and strong enterprise technology, but without guaranteed EU hosting.
Team & Admin Management: 90/100
US provider with a deep enterprise feature set and top ratings, but pure US hosting.
Team & Admin Management: 90/100
Privacy-focused digital business card from Bavaria: own German hosting under ISO 27001, SAML SSO and API, with limited price transparency.
Team & Admin Management: 72/100
Austrian SME all-rounder with Munich hosting, a genuine team offering, and an affordable entry point
Team & Admin Management: 80/100
US provider with strong integration and enterprise depth, but data hosting in the USA/Canada and USD pricing.
Team & Admin Management: 90/100
Privacy-focused team solution from Austria with hosting in German ISO 27001 data centers
Team & Admin Management: 70/100
US enterprise platform (formerly Beaconstac) with SOC 2, ISO 27001 and SCIM - but no EU hosting
Team & Admin Management: 90/100
US provider with a strong sales focus and an EU-hosting option, but a thin GDPR and reviews picture
Team & Admin Management: 88/100
German NFC business-card provider from Hamburg with Frankfurt hosting and a BMW reference - strong on data protection, weak on the enterprise IT stack.
Team & Admin Management: 52/100
US provider with strong user reviews, but no EU hosting and with an unclear product future
Team & Admin Management: 66/100
German NFC card provider with a free cloud profile – strong hardware, weak enterprise maturity
Team & Admin Management: 55/100
In an enterprise rollout with thousands of users, the focus shifts away from the individual card toward central manageability. Five requirements are decisive: (1) Single sign-on via the existing identity provider, so that no one has to remember yet another password.
(2) Automatic user provisioning, so that a new card is created automatically during onboarding and blocked when someone leaves. (3) A robust data protection framework with a DPA, German hosting and certification. (4) Integrations into existing systems – from the HR system through the CRM to the identity provider.
(5) Operational reliability via a service level agreement (SLA), white label for your own brand and an open API for individual connections. Anyone who merely scales the consumer app produces inactive accounts, data protection gaps and manual maintenance effort.
Enterprise-ready providers solve exactly these five points.
A data processing agreement (DPA) under Art. 28 GDPR is the legally binding agreement between the responsible enterprise and the provider as the processor; it governs the purpose, duration, technical and organizational measures and the handling of subprocessors. It is mandatory as soon as personal data is processed by a service provider.
ISO/IEC 27001 is the leading international standard for information security management systems; a certification confirms through an independent audit that security processes are systematically established and monitored. Single sign-on (SSO) via the SAML 2.0 standard allows logging in with the existing company account; SCIM (System for Cross-domain Identity Management) additionally automates the creation, modification and deactivation of user accounts.
Microsoft Entra ID (formerly Azure Active Directory) is Microsoft's cloud identity service, through which many enterprises manage identities centrally. MDM (Mobile Device Management, e.g. Microsoft Intune) distributes apps and configurations centrally to managed devices.
A decisive data protection difference: with a German hosting company operating a data center in Germany, the data remains within the GDPR area, whereas with providers based on the US cloud a transfer of data to third countries and safeguarding via standard contractual clauses becomes necessary – an audit-relevant difference for regulated industries.
oneVcard (oneVcard GmbH) leads our enterprise comparison because the complete enterprise package comes together here. The service is operated in its own ISO 27001-certified data center in Nuremberg – hosting and development take place exclusively in Germany, without transfer to third countries.
On the data protection side, a data processing agreement (DPA) under Art. 28 GDPR is available on request, along with an external data protection officer (Prof. Dr. Eberhard Schott), daily backups, 2FA and regular penetration tests. For IT, identity management is decisive: SSO via SAML 2.0, Microsoft Entra ID/Azure AD and Google Workspace, complemented by automatic user provisioning via Entra ID/HR sync.
The MDM rollout is supported on a Microsoft Intune/Entra basis (for example for wallet and app distribution). More than 20 integrations cover the enterprise stack – Entra ID, Google Workspace, SAP, Personio, BambooHR, Salesforce, HubSpot, Zoho, Dynamics 365, PipeDrive, Make.com and Zapier –, plus an open REST API in the enterprise plan.
This is complemented by white label, a team and admin console with roles and permissions, CSV/bulk import, analytics, NFC cards, QR, Apple/Google Wallet and dedicated email signature management including a certified Outlook add-in. An SLA of 99.5% (Enterprise) rounds off the package.
More than 850 companies in the DACH region/EU already use the solution. The entry point is priced low: Lite free, Premium a paid plan (annually or monthly), Teams and Teams Enterprise individually quoted.
Spreadly (Spreadly GmbH, Baierbrunn near Munich) is the most consistent "Made in Germany" alternative: customer-data hosting with Hetzner in Germany per the vendor (CDN/edge incl. Bunny), ISO 27001:2022 certification, DPA as well as encryption via TLS 1.3 and AES-256.
On the enterprise side, Spreadly offers SSO (SAML 2.0, OAuth 2.0), SCIM, bulk provisioning via CSV/Azure AD/Google Workspace, HRIS connection (Personio, BambooHR), REST API and CRM integrations. The Professional plan is transparently priced per user/month (annually), and the individual Enterprise plan with SSO, SLA and white label is aimed at organizations with around 1,000 employees or more.
Lemontaps (Lemon Innovation & Technology GmbH, Stuttgart) also hosts exclusively on German servers (AWS Frankfurt) and is certified by TÜV SÜD to ISO/IEC 27001. For enterprise use, SSO (SAML 2.0, Entra ID, Okta), SCIM, audit logs, white labeling, REST API and CRM integrations are available; team administration offers subgroups, roles and bulk import of up to 1,000 users via Excel.
German-language support states a response target of around 60 minutes and a 99.9% SLA. Both providers are solid GDPR options – oneVcard nevertheless comes out ahead in our rating, above all because of its broader integration and provisioning coverage as well as the Intune-supported MDM rollout.
In fairness: in terms of the sheer number of independent user reviews, international providers such as Blinq, HiHello and Lemontaps are ahead in some cases.
Our overall rating weighs data protection/GDPR, enterprise IT integration (SSO, provisioning, API, MDM), range of features, operational reliability (SLA, support) as well as value for money. In the pure GDPR category, German hosting, certification and a DPA count above all.
For the specific tender, this checklist is recommended: Where is the data center located, and is it certified? Is a data processing agreement (DPA) under Art. 28 GDPR provided? Are SAML SSO against our identity provider (usually Entra ID) and automatic provisioning supported?
Are the required integrations to the HR system, CRM and directory service available natively or only via Zapier/Make? Is there an open API for special cases? Are white label, a role/permission concept and bulk import available?
Which SLA and which support channel apply? Anyone who queries these questions in a structured way quickly filters out consumer tools – and obtains a solution that withstands an enterprise rollout and a data protection audit.
The difference lies in central manageability. Enterprise solutions offer single sign-on via the existing identity provider (e.g. Microsoft Entra ID), automatic user provisioning during onboarding and offboarding, an admin console with roles and permissions, bulk import, white label as well as a robust data protection framework with a DPA and German hosting.
Consumer apps do not scale these administrative functions and, with thousands of users, generate manual maintenance effort and data protection gaps.
In our comparison, oneVcard leads with 92/100 (overall) and 94/100 (GDPR). The decisive factors are the ISO 27001-certified data center in Germany, SSO via SAML 2.0 and Entra ID with automatic provisioning, the Intune-supported MDM rollout, more than 20 integrations (including SAP, Salesforce, HubSpot, Personio), an open REST API, white label and an SLA of 99.5%.
More than 850 companies in the DACH region/EU use the solution. Spreadly and Lemontaps are strong German alternatives, likewise with German hosting and ISO 27001 certification.
With a German hosting company operating a data center in Germany, the data remains within the GDPR area; no transfer to third countries takes place. With US cloud-based providers, data is transferred to the USA, which requires additional safeguarding via standard contractual clauses and a third-country assessment.
For regulated industries (finance, insurance, healthcare) and strict procurement processes, German hosting is therefore a clear advantage. oneVcard, Spreadly and Lemontaps all host exclusively in Germany.
Single sign-on (SSO) via SAML 2.0 allows logging in with the existing company account, without an additional password. SCIM (System for Cross-domain Identity Management) automates the creation, modification and deactivation of user accounts – so a card is created automatically during onboarding and blocked when someone leaves.
Microsoft Entra ID (formerly Azure Active Directory) is the identity service through which many enterprises manage these identities centrally. oneVcard supports SAML 2.0, Entra ID/Azure AD and Google Workspace including automatic provisioning.
Yes. As soon as an external provider processes personal data on behalf of the enterprise, Art. 28 GDPR requires a data processing agreement (DPA). It governs the purpose, duration, technical and organizational measures and the use of subprocessors.
Enterprise-ready providers make it available: oneVcard offers the DPA on request, complemented by an external data protection officer, daily backups, 2FA and regular penetration tests. Spreadly and Lemontaps also provide a DPA.
The most relevant are the identity provider (Entra ID, Google Workspace), the HR system (Personio, BambooHR, SAP) and the CRM (Salesforce, HubSpot, Dynamics 365, Zoho, PipeDrive). oneVcard offers more than 20 native integrations to exactly these systems plus automation platforms such as Make.com and Zapier as well as an open REST API in the enterprise plan. Important when choosing: check whether integrations are available natively or only indirectly via Zapier/Make, since native connections are generally more stable and require less maintenance.
Planning a company-wide rollout of digital business cards? We’ll connect you with a suitable, GDPR-compliant provider. No sales pressure.
