Self-hosted Dropbox alternative for EU data residency

Why a self-hosted Dropbox alternative for EU data residency is the simpler route for some teams

For a European team whose Dropbox data sits in the United States, self-hosted Nextcloud in an EU datacenter can keep the data in the EU under the organization's own control. That is the short answer, but it only holds when the team has actually mapped where its personal data flows today. Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet the Chapter V conditions, and the question is not only where files are stored. Remote access from a third country, even to display data for support, counts as a transfer under the EDPB's Guidelines 05/2021, so the review has to cover administrators, support staff and sub-processors as well as storage.

This page covers what Dropbox's EU storage option requires, when a Nextcloud deployment in an EU datacenter is the simpler way to meet the requirement, and what the team must check before deciding. The answer depends on two things: the transfer analysis the organization's data protection lead completes for its current Dropbox use, and what the team needs from Dropbox in practice, such as desktop sync, sharing links, admin controls or specific integrations. A team that mainly needs in-region storage for a bounded set of files will weigh these differently from one that depends on a wide set of Dropbox features.

Nothing here suggests Dropbox is unsuitable for European organizations. Dropbox offers an EU storage option, and the right choice depends on the terms, the contract and the team's own review. Before comparing options, confirm the current EU storage terms, billing conditions and data processing addendum directly with Dropbox, and record what the transfer assessment found for each data category. Those documents, not this summary, should drive the decision.

What EU data residency requires for file storage

Personal data stored with a US provider is a transfer question before it is a storage question. The cards below set out the transfer rules, the legal status of the EU-US framework, and the US law exposure that decide whether an EU storage option is enough. Counsel should confirm how these points apply to your own processing.

Storage outside the EEA is a transfer

Under GDPR Article 44, every transfer of personal data to a third country, including onward transfers, must meet the Chapter V conditions. The EDPB's Guidelines 05/2021 treat storage in a cloud outside the EEA as a transfer, and also treat remote access from a third country as one, even when the data is only displayed on a screen for support. Check where the provider stores data, where its staff can view it, and which sub-processors touch it.

Cost of infringement

Article 83(5)(c) sets the upper fine for infringements of Articles 44 to 49 at EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Regulators treat an unlawful transfer as a compliance failure in its own right, separate from any breach of security. Record your transfer analysis and the safeguards you relied on so you can show them if asked.

Schrems II and the EU-US framework

The Court of Justice invalidated the Privacy Shield in Case C-311/18 (Schrems II) while upholding standard contractual clauses, which means transfers must be assessed case by case. The EU-US Data Privacy Framework adequacy decision, Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List. An appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P, so confirm the provider's listing and watch the outcome.

US law reaching data in the EU

The CLOUD Act provision at 18 U.S.C. 2713 requires providers to preserve or disclose data in their possession, custody or control, wherever it is located. A US-parent provider can therefore face a US order for data held in an EU datacenter. EDPB Recommendations 01/2020 say that where a provider needs access to data in the clear and foreign authority powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned.

Why EU hosting alone may not settle it

An EU storage region does not end the analysis if the provider is a US company that can be compelled to hand over data. Ask whether the provider's contract, support model and key management keep data out of reach of non-EU parties. Self-hosting in an EU datacenter you control removes the provider from the chain, though your own support vendors still need the same review.

Data Act switching rights

Regulation (EU) 2023/2854 gives customers of data processing services the right to switch to another provider or to on-premises infrastructure, and Article 32 requires providers to prevent unlawful third-country government access to non-personal data held in the Union. The Data Act applies from 12 September 2025. Confirm the notice period and transition terms in your contract before you rely on them.

What Dropbox's EU storage option requires and where it falls short

Dropbox's EU storage option comes with conditions that must be accepted before any technical question is considered: annual billing, a minimum of 10 licenses, individual review of each request, and no choice of which EU location holds the data. Annual billing fixes the commitment for a year and gives up the flexibility of monthly exit. The 10-license minimum excludes smaller teams that want only one group on the service. Individual review means the timeline is set by Dropbox, not by the team. Confirm current terms in writing with Dropbox, including whether the EU option also covers sync clients, backups, previews and any support access from outside the EU, and record the answers for the decision file.

Storing data in an EU datacenter does not by itself settle the transfer question. The US CLOUD Act provision at 18 U.S.C. 2713 requires providers of remote computing services to preserve or disclose data in their possession, custody or control, whether that data sits inside or outside the United States. The EDPB's Guidelines 05/2021 treat remote access from a third country as a transfer, and state that complying with a third-country authority request would be one too. Ask legal counsel to assess that exposure against the EDPB guidance on third-country law, and to confirm how GDPR Article 48 applies to any order a US court might issue.

If the assessment finds the exposure unacceptable, the EDPB's Recommendations 01/2020 state that where a provider needs data in the clear and third-country powers exceed what is necessary and proportionate, no effective technical supplementary measure can be envisioned. A self-hosted Nextcloud deployment in an EU datacenter, run by the team or its implementation partner, takes the US provider out of the data path, but the team must still confirm where backups, logs and vendor support access reside. If Dropbox remains under consideration, check its listing on the Data Privacy Framework List, since the adequacy decision is under appeal as Case C-703/25 P.

Which open-source options keep EU data in the EU

Nextcloud Hub is the most direct replacement for Dropbox file sync and sharing. It is licensed under the AGPL and is free to self-host, so an EU datacenter that your own team operates keeps files, database and backups under your control. Residency depends as much on who can reach the system as on where the disks sit. Under EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen, counts as a transfer.

Cost model: The software carries no license fee. Nextcloud GmbH sells Standard, Premium and a top enterprise tier for support and maintenance, with a 100-user minimum. The pricing page lists rates starting at 71.29 euros per user per year for Standard at 100 or more users. Nextcloud One managed hosting is offered for organizations under 100 users, so confirm where its servers sit before assuming EU residency.
Identity: LDAP and Active Directory users can sign in with directory credentials, and OpenID Connect and SAML backends are documented.
Deployment: Nextcloud All-in-One bundles PostgreSQL, Redis, ClamAV, full-text search and BorgBackup-based backups, and a Helm chart is available for Kubernetes.
Upgrades: A new major version ships every four months, each supported for one year. Upgrades must go one major version at a time, with a backup before each step and third-party apps disabled until confirmed compatible.

Confirm the datacenter location in writing, who holds administrator and support access, and whether support sessions from outside the EEA are excluded in your contract and runbooks.

How to deploy Nextcloud in an EU datacenter under the constraint

This sequence turns the residency requirement into a deployment in which personal data, administration, backups and identity stay inside the EU, with each step closed by a check the team can verify.

Confirm the EU hosting boundary in writing
Choose an EU datacenter or an EU cloud account, then ask the provider in writing where the data, backups, logs and snapshots are stored and which staff can reach the systems. Confirm that support engineers, managed service staff and any remote administration from outside the EU are either excluded or handled under a documented transfer mechanism, because EDPB Guidelines 05/2021 treat remote access from a third country, even only displaying data on a screen, as a transfer. The output is a signed hosting statement that names locations, access paths and backup regions.
Fix the stack against the Nextcloud 35 requirements
Check the Nextcloud 35 system requirements and select a supported database, PHP version and web server. The current recommendations are MariaDB 11.8 or PostgreSQL 18, PHP 8.5, and Apache 2.4 or nginx with php-fpm. Note that Oracle Database is only available with an enterprise subscription. Record the chosen versions in the deployment document so that every later upgrade can be checked against the same matrix. The output is an approved bill of materials.
Install Nextcloud with All-in-One or manually
Deploy Nextcloud All-in-One, which the project describes as its official installation method and which bundles Redis and APCu caching, PostgreSQL, Nextcloud Office, Talk, BorgBackup-based backups, ClamAV and full-text search, with a Helm chart for Kubernetes. If the organization needs a hand-built stack, perform a manual install instead and document each component. Either way, keep the container images and packages in EU-controlled registries and mirrors. The output is a reachable instance on an EU-hosted address with TLS enabled.
Connect directory and single sign-on
Integrate identity so users do not hold local passwords. Use the LDAP app for Active Directory or LDAP users, or configure OpenID Connect or SAML as the authentication backend, following the Nextcloud LDAP documentation. Confirm that the identity provider itself is hosted within the EU boundary, since a non-EU identity service would move personal data out of scope. Test one account from each group, including a disabled account to confirm access is revoked. The output is a sign-in test log.
Keep backups and storage inside the EU
Point object storage, database dumps and backup repositories at EU locations only. If BorgBackup is used through All-in-One, confirm the remote repository is in the EU and that no vendor-managed replication copies data elsewhere. Restore a sample of files and the database to a separate EU environment to prove the backup works. Record the retention settings and who holds the encryption keys. The output is a successful restore report.
Plan upgrades one major version at a time
Nextcloud does not allow skipping major releases, so administrators must step through each major version. Use the maintenance and release schedule to pick the target release and check its end-of-life date, for example noting that Nextcloud 33 is supported until February 2027 and Nextcloud 34 until June 2027. Before each upgrade, take a full backup, then follow the upgrade manual. Assign an owner for the monthly maintenance releases. The output is a written upgrade calendar with named owners.
Restrict third-party apps and harden the instance
Install only apps that the team needs and disable any app that is not confirmed compatible with the current major release, as the upgrade documentation advises. Review app authors, update channels and whether an app sends data to an external service, because an outbound call to a non-EU endpoint is a transfer in its own right. Confirm that the admin panel, server logs and monitoring agents also stay inside the EU. The output is an approved app list and a data-flow note.
Record the evidence for the assessment
Assemble the hosting statement, stack record, sign-in test log, restore report, upgrade calendar and approved app list into one evidence pack for the data protection officer and for any independent auditor. Note that DeployOpen prepares these systems, controls and evidence for assessment but does not issue audit reports or certifications. Ask the auditor which records they expect. The output is a dated evidence pack ready for review.

Questions teams ask before choosing an EU-hosted file sync service

What drives the cost of a self-hosted EU file sync service?

The main cost drivers are the EU datacenter or cloud account, storage capacity, backups, the people who run the service, and any paid support tier. Infrastructure costs are one-time setup plus recurring compute, storage and backup charges. Staff time is the largest recurring item for most teams, because someone must patch, upgrade and monitor the platform. Nextcloud Hub itself is free under the AGPL, but Nextcloud GmbH sells Standard, Premium and Ultimate enterprise subscriptions. Per the Nextcloud pricing page, list prices start at 71.29 euros, 104.99 euros and 204.75 euros per user per year respectively for 100 or more users, with a 100-user minimum. Ask any quote to separate infrastructure, storage growth, backup retention, implementation and support so you can compare each line.

How long does an EU-hosted Nextcloud deployment take?

The timeline depends on the number of users, how many data sources need migrating, identity integration, the compliance evidence you need, and how many teams cut over and when. Environment readiness, such as cloud accounts, network access and approved datacenter location, often sets the pace more than the software does. Ask for a timeline in the written scope, with milestones for pilot, migration waves and cutover. DeployOpen works on fixed-scope engagements, so scope, deliverables and timelines are agreed in writing before work starts.

What does our team need to provide for the project?

You need a named business owner, an identity source such as Active Directory or LDAP, a decision on the EU datacenter or cloud region, and people who can approve storage, backup and retention policies. Engineering staff must own the platform after handover. Nextcloud's LDAP app lets directory users log in with their existing credentials, and OpenID Connect and SAML backends are also documented, so confirm which one your identity provider supports. Teams should also name a migration sponsor who can ask each department to confirm which folders matter and who should own them.

Can our own IT team run a self-hosted Nextcloud without outside help?

Many teams with Linux and database experience can run Nextcloud, but the work includes more than installation. Nextcloud publishes a new major version every four months and supports each for one year through monthly maintenance releases. Upgrades must move one major version at a time, with a backup before each upgrade and third-party apps disabled until confirmed compatible. Nextcloud All-in-One is the official installation method, bundling caching, PostgreSQL, backups with BorgBackup, ClamAV and full-text search. Decide whether your team can take on that upgrade cadence, and whether a retainer for upgrades and testing fits your staffing better.

Do Data Act switching rights matter when choosing a file sync provider?

Yes, they set a contract baseline. The EU Data Act, applicable since 12 September 2025, gives customers the right to switch from a data processing service to another provider or to on-premises ICT infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027 under the same regulation. These rights apply to the provider relationship, not to the technology you choose, so review them with counsel before signing a Dropbox or any other cloud contract. Owning the self-hosted platform also means you hold the data and infrastructure directly, which reduces dependence on any single vendor.

Does hosting in the EU settle the GDPR transfer question?

Not on its own. Storing data in an EU datacenter avoids most storage transfers, but EDPB Guidelines 05/2021 treat remote access from a third country, even just displaying data for support, as a transfer. Cloud storage outside the EEA also counts. A provider subject to third-country law can still create exposure if it must comply with a foreign authority request, and the EDPB asks controllers to assess that before engaging the processor. Under the CLOUD Act provision at 18 U.S.C. 2713, US providers must preserve or disclose data in their control wherever it sits. Ask your legal team to map every administrator and support access path, not only where the disks are.

What does a migration from Dropbox involve?

A migration usually covers inventory, data copy, identity mapping, sharing and link recreation, client rollout and a cutover by team. Dropbox's browser download is limited to folders under 250 GB uncompressed with fewer than 10,000 files, so large transfers typically run through the desktop app. Sharing links, permissions and version history do not carry over automatically, so plan to recreate them and record which ones must be restored. Expect a parallel-run period and a clear read-only date for the old Dropbox folders. Ask any quote to list the inventory method, the transfer tooling, the users affected per wave and the handling of links and version history.

Evidence regulators and auditors ask for

Moving files to an EU datacenter changes what you must be able to show, not only where bytes sit. The cards below list the records a data protection authority, an internal audit team or an independent assessor will typically request, and they connect to the transfer analysis that starts the project. DeployOpen prepares these controls and evidence, but independent auditors and certification bodies issue any audit report or attestation.

Transfer analysis records

Keep a written assessment of every third-country path, including remote administration from outside the EEA, support sessions, backup replication and any vendor with access to the environment. The EDPB guidelines treat remote viewing of data from a third country as a transfer, so the record must cover screens as well as storage. Ask counsel to confirm whether the assessment also addresses access requests under the CLOUD Act, since that exposure can exist even when data stays in the EU.

Data location and datacenter contracts

Record the exact datacenter, city and legal entity that operates each facility, along with the contract clauses that fix processing to the EU. Include the location of every replica, snapshot and log stream, since copies often leave the primary site without anyone noticing. Confirm with the provider in writing which sub-processors can reach the infrastructure and from which countries.

Access logs and admin access records

Retain logs of user sign-ins, file access, share link creation and administrator actions in Nextcloud and the underlying operating system, SSH and database layers. Define who can read these logs and how long they are kept. Auditors usually ask for a sample of privileged sessions and proof that each one maps to a named person and an approved change.

Encryption and key custody

Document how data is encrypted in transit and at rest, where encryption keys are generated and stored, and who can use them. Specify whether keys sit inside the EU environment or with a provider that could be compelled to release them. Note that server-side encryption in Nextcloud protects against some risks but does not stop an administrator with full access, so the record must state who holds that access.

Backup location and restore tests

List where each backup is stored, how it is encrypted, how long it is retained and who can restore it. Backups are a common gap because they are often copied to a second region or a vendor cloud. Keep the results of restore tests, since an unverified backup is weak evidence for availability and recovery obligations.

Processor list and upgrade records

Maintain a current list of every processor and sub-processor with its role, location and contract reference. Alongside it, keep a dated record of Nextcloud server upgrades, PHP and database patches, and app changes, with the release each one came from. Nextcloud requires upgrades one major version at a time with a backup before each one, so the upgrade log shows whether the platform stayed within supported releases.

What a fixed-scope residency deployment covers

Most DeployOpen engagements are fixed-scope: the scope, deliverables and timelines are agreed in writing before any work starts, so the budget conversation begins with a defined boundary rather than an open-ended retainer. For a residency deployment, that boundary should name the EU datacenter or cloud region, the Nextcloud components in scope (server, database, object or file storage, backups, and any Collabora Online or Talk integration), and the acceptance tests that show data stays where the written scope says it does. Ongoing support, upgrades and continuous testing can follow as a separate retainer, which is worth agreeing on up front so that the first major upgrade is not a surprise cost.

Before a quote can be written, the client has to supply four inputs. First, the residency requirement in precise terms: which data classes must stay in the EU, whether backups and logs count, and whether any administrative or support access from outside the EEA is permitted, since remote viewing from a third country is itself a transfer under EDPB Guidelines 05/2021. Second, the identity source: whether users come from Active Directory or another LDAP directory, and whether OpenID Connect or SAML is the intended sign-in path, because Nextcloud's LDAP app and its other user authentication backends change the integration work. Third, the data volume by team, including file counts and largest folders, which drives storage sizing, migration batches and backup windows. Fourth, the access model: external sharing, guest accounts, and which teams need desktop or mobile sync.

Ask for a quote that separates one-time work (design, deployment, identity integration, migration support, hardening and evidence collection) from recurring work (maintenance, monthly updates, backup testing and the optional Nextcloud Enterprise subscription). Confirm with DeployOpen and with Nextcloud GmbH which items are included in each. Also confirm how the written scope handles a change in data volume or user count mid-project. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications, so the scope should name which assessor will review the evidence and when.

How DeployOpen deploys Nextcloud under EU residency rules

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For EU data residency, that means a Nextcloud deployment in a datacenter and cloud account the client controls, with the transfer, access and hosting decisions written down before any data moves.

How we scope

Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
The written scope names the EU datacenter or cloud region, the user groups and the directory source.
We record which data categories, third-country access paths and support channels are in or out of scope.

How we build

We install Nextcloud in the client's own infrastructure, configured for storage, database and backup locations inside the EU.
We integrate LDAP or Active Directory, OpenID Connect or SAML sign-in, and the client's chosen sync and mobile clients.
We run security testing against the deployment and document the results, including remote administration paths and vendor access.

How we hand over

Handover includes configuration records, data flow documentation and a register of where personal data is stored and processed.
We document backup, restore and upgrade procedures, including the rule to move one major Nextcloud release at a time.
We prepare systems, controls and evidence for compliance assessments, but independent auditors issue any audit reports or certifications.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover monthly maintenance releases, major version upgrades and backup verification within the agreed scope.
Ask any provider to confirm in writing which Nextcloud release line and support tier apply to your deployment.