Group-to-List Synchronization
Map each Nextcloud group to a dedicated AutoPhish target list—create a new list straight from Nextcloud or connect an existing one. Departments, locations and teams become ready-made simulation audiences.
New on the Nextcloud App Store
Nextcloud Phishing Simulation That Keeps Itself Up to Date
Install the AutoPhish app on your Nextcloud server, map your groups, and run realistic phishing simulations with built-in security awareness training. New hires are covered automatically, leavers drop out, and nobody touches a CSV again.
You Chose Nextcloud for Control. Your Awareness Training Should Fit That Choice.
Organizations run Nextcloud because they want to own their data and their infrastructure. Yet most phishing simulation tools assume Microsoft 365 or Google Workspace and leave everyone else exporting user lists by hand. Those lists go stale within weeks: new colleagues never get tested, people who left still receive simulations, and reports stop reflecting your real organization. AutoPhish closes that gap with a native Nextcloud integration, so your phishing tests always reach the people who are actually on your team.
Up and Running in Three Steps
Install the App
Install "AutoPhish: Phishing Simulation & Training" from the Nextcloud App Store via Apps administration. It supports Nextcloud 32 to 35.
Connect AutoPhish
Create an API key with the targets:read and targets:write scopes in AutoPhish, then enter it with your company ID under Administration settings → AutoPhish.
Map Groups and Launch
Map each Nextcloud group to its own AutoPhish target list. Once the first sync finishes, launch campaigns and review results in AutoPhish.
Built for Nextcloud Administrators
Scheduled or On-Demand Sync
Choose a sync interval from 5 minutes to 24 hours via Nextcloud background jobs, or trigger a sync manually with an occ command. Last run, last success and membership counts are visible in the admin settings.
Safe by Design
Stale memberships are only removed after complete reads and verified additions. Failed reads or invalid addresses block removals instead of emptying a list, and the app never deletes targets company-wide.
Minimal Data, Encrypted Credentials
Only primary email addresses and, for new recipients, display names leave your server. User and group IDs stay in Nextcloud, there is no telemetry, and the API key is encrypted with Nextcloud's crypto service.
Your Nextcloud Users, the Full AutoPhish Platform
The Nextcloud app keeps your recipients current. Everything else happens in AutoPhish—the automated phishing simulation and security awareness training platform for teams that want results without the admin overhead.
- AI-generated phishing emails tailored to your industry, language and the services your team really uses
- Fully automated campaigns that run on a schedule without manual effort
- Just-in-time micro-training the moment someone clicks a simulated phishing link
- SMS smishing and QR quishing simulations on the same platform
- Clear reports and trends for management, auditors and NIS2 evidence
- Anonymous mode for organizations with Works Council or strict privacy requirements
Data Sovereignty, End to End
Nextcloud keeps your files under your control—AutoPhish keeps your awareness program in the EU. Our servers are hosted in Germany, all data is processed in the EU, and we sign DPAs on request. The Nextcloud app itself is open source under the AGPL, so your administrators can inspect exactly what it sends before they enable it.
Nextcloud Phishing Simulation FAQ
What does the AutoPhish Nextcloud app do?
It keeps AutoPhish target lists in sync with selected Nextcloud groups. You map each group to its own target list, and the app adds new members and removes people who left the group on a schedule or on demand. Campaign creation, email delivery, training and reporting happen in AutoPhish.
Which Nextcloud versions are supported?
The app supports Nextcloud 32 to 35 with PHP 8.3 or newer. Install it from Apps administration in your Nextcloud instance via the Nextcloud App Store.
Which data does the app send to AutoPhish?
Only what a phishing simulation needs: the primary email addresses of members of the groups you select and, for newly added recipients, their display names. Nextcloud user IDs, group IDs and your configuration stay on your server, and the app performs no wider directory export and no telemetry.
Does the app send phishing emails from my Nextcloud server?
No. The app only synchronizes recipients. AutoPhish sends the simulated phishing emails, tracks the results and delivers training, so your Nextcloud server stays untouched by campaign traffic.
Do I need an AutoPhish account?
Yes. You need an AutoPhish company, its company ID and an API key with the targets:read and targets:write scopes. Verify the email domains of your recipients in AutoPhish before the first sync. You can start for free.
Is the Nextcloud app open source?
Yes. The app is published under the AGPL-3.0-or-later license, and its source code is available on GitHub, so you can review exactly how it handles your data.
Explore More of AutoPhish
Phishing Simulation Platform
See how AutoPhish automates realistic phishing simulations end to end.
Learn moreTraining Platform
Security awareness courses and micro-training for every employee.
Learn moreAnonymous Mode
Run simulations without exposing individual employee results.
Learn moreEnterprise & Compliance
Evidence for NIS2, DORA and ISO 27001 audits.
Learn moreRun your first phishing test in 10 minutes.
Sign up free — no credit card. Try Pro free for 7 days when you're ready.