Self-hosted Google Workspace alternative for EU data sovereignty: the short answer
If your Google Workspace data region or encryption option does not meet a European sovereignty requirement, an EU-hosted, self-hosted deployment can meet it better. The short answer is to run Nextcloud Hub with Collabora Online for files and documents and OX App Suite for mail and calendar, all in infrastructure you control inside the EU, or to deploy openDesk on Kubernetes if you want a bundled public-sector suite. Both keep the data plane under your administration, which is the point of the change. Confirm current Google edition details, including which regions each edition offers and which features require Enterprise Plus or a similar tier, directly with Google, because edition terms change.
The main caveat is that data residency alone does not remove third-country legal exposure. A provider headquartered in the United States can be compelled to disclose data it holds, wherever that data sits, under 18 U.S.C. 2713, and the EDPB treats remote access from a third country as a transfer. So an EU-hosted Nextcloud or openDesk stack still needs a review of who administers it, who can access logs and backups, and whether any support vendor or hosting provider falls under foreign law. Your own deployment can close much of that gap, but only if the operating model is designed for it.
Before you commit, decide three things: who holds administrative and key access, which hosting provider and support contracts sit in the chain, and whether you need the paid Nextcloud or openDesk Enterprise support tiers for the patch cadence your regulator expects. Ask Google for written confirmation of the data locations and encryption controls on your current edition, and ask your legal team to map the transfer analysis before you treat the migration as a sovereignty fix.
What the EU data sovereignty requirement actually asks for
The requirement is less about where a server sits than about who can reach the data and under which law. Transfers, the limits of EU-US adequacy and foreign government access all turn on the same question: can a non-EU legal authority compel access to personal data held for an EU controller? Each card below is a check you should be able to answer before you compare hosting options.
Transfers and remote access
Article 44 of the GDPR applies to every transfer of personal data to a third country, including onward transfers. EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when staff only view data on a screen for support or administration. Check which support engineers, managed service providers and follow-the-sun teams can reach the tenant from outside the EEA, and whether storage or backups sit in a cloud outside the EEA.
Fines under Article 83(5)(c)
Infringements of Articles 44 to 49 fall in the higher fine tier of the GDPR. The ceiling is EUR 20 million or 4% of worldwide annual turnover, whichever is higher. Regulators weigh this exposure when they assess a controller's transfer decisions, so the cost of getting the transfer design wrong is not limited to a migration budget. Ask counsel to map each data flow to a transfer mechanism before you sign a processor agreement.
Limits of EU-US adequacy
The Court of Justice invalidated the EU-US Privacy Shield in Case C-311/18 (Schrems II) but kept standard contractual clauses valid. The current Data Privacy Framework, under Commission Implementing Decision (EU) 2023/1795, covers only US organizations on the Data Privacy Framework List. An appeal against the General Court's September 2025 judgment is pending as Case C-703/25 P, so the adequacy basis could change. Document a fallback plan that does not depend on that decision.
Foreign government access rules
The US CLOUD Act, in 18 U.S.C. 2713, requires providers to preserve or disclose data in their possession, custody or control, wherever it is stored. GDPR Article 48 allows a third-country disclosure order to be enforced in the EU only under an international agreement such as a mutual legal assistance treaty. Article 32 of the Data Act requires data processing service providers to guard against third-country access to non-personal data held in the Union. EDPB Example 12 says that using an EU processor subject to third-country law is not itself a transfer, but complying with such an authority's request would be one, so the controller must assess that exposure before engaging the processor.
Where Google Workspace meets the requirement and where it leaves gaps
Start by writing down exactly what the requirement says. For most European buyers it is one of three things: personal data stays in the EEA, administrators and support staff cannot reach it from a third country, or the organization holds the encryption keys. Each one maps to a different Google Workspace control, and each control depends on edition. Check the current data region options for your edition and tenant in the Google Workspace contract and admin documentation, and confirm with your account team whether client-side encryption is available only on Enterprise Plus or on another tier. Get the answers in writing, with the edition name and the date, because these terms change.
Next, test the transfer question directly. Under EDPB Guidelines 05/2021, remote access from a third country is a transfer even when the person only views data on a screen for support or administration, and storage in a cloud outside the EEA is also a transfer. Ask the provider where support staff sit, whether support access is granted through follow-the-sun or escalation teams outside the EEA, and what logging and approval applies to that access. Separately, the same guidelines say that an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be. Your legal team should assess that exposure, including the US CLOUD Act provision at 18 U.S.C. 2713, before accepting a vendor's assurances. DeployOpen does not issue legal opinions or attestations, and an independent auditor or qualified counsel should review the conclusion.
Plan the exit as part of the same review. The admin Data Export tool and per-user Takeout are the two routes out of Google, and their limits matter for timing: the admin account must be at least 30 days old, exports can take up to 14 days, and the default Cloud Storage bucket is deleted after 60 days. Confirm with your administrator whether Takeout is enabled for users, because that setting controls the per-user route. Under Regulation (EU) 2023/2854, the Data Act gives customers a switching right from data processing services, so ask the provider which switching terms apply to your contract. A self-hosted target built on Nextcloud or openDesk moves the hosting decision into your own infrastructure, but it still requires a documented migration plan, a tested restore and an agreed cutover window.
Which open-source options fit an EU sovereignty requirement
This table compares EU-hosted Nextcloud Hub, Collabora Online, OX App Suite and openDesk on residency control, legal exposure, licensing, support, Kubernetes requirements and operating effort. Read each row against your own data classification and whichever operator will run the deployment, since the legal exposure depends on who holds the keys and the infrastructure. The main takeaway is that the platform choice matters less than where it runs and who operates it.
| Criterion | Nextcloud Hub with Collabora Online | OX App Suite | openDesk Community and Enterprise |
|---|---|---|---|
| Residency control | Runs on servers you choose, in an EU data center or your own facility | Deployable on premises or in a chosen cloud, so location is set by the buyer | Deployed into your Kubernetes cluster, so the location of that cluster sets residency |
| Legal exposure of the operator | Depends on the host: an EU-owned operator avoids direct third-country reach, a US-parented host does not | Depends on the operator; OX Cloud is a managed service, so confirm its operator and hosting entity | Depends on who operates the cluster; confirm the hosting provider's ownership and sub-processors |
| License | Nextcloud Server under AGPL-3.0; Collabora Online under MPL-2.0 | Commercial product line from Open-Xchange, with Dovecot part of that line; confirm component licenses for your edition | Deployment repository under Apache-2.0; bundled components keep their own licenses, such as AGPL-3.0 and MPL-2.0 |
| Support model | Free community use; Nextcloud GmbH Standard, Premium and Ultimate subscriptions, with Nextcloud One for organizations under 100 users | Open-Xchange sells support and managed service options; confirm scope and SLA in writing | Community Edition with community support; Enterprise Edition recommended for production with SLA-backed 2nd and 3rd level support |
| Kubernetes and infrastructure | Not required; installs on a standard web stack or through All-in-One, which bundles components and a Helm chart | Not required for the core product; sizing depends on the chosen deployment model | Required: CNCF-certified Kubernetes v1.33 or later, cert-manager, ingress, RWO volumes, Helm and Helmfile |
| Production dependencies | Database, cache, mail relay and backup are part of your build; All-in-One includes Redis, PostgreSQL and BorgBackup | Confirm which mail, storage and database services are required for your size | Requires external PostgreSQL, MariaDB, Redis, Memcached, Cassandra, SMTP relay, ClamAV, object storage and a TURN server |
| Enterprise-only features | Enterprise subscriptions add support, maintenance lifecycle and clustered instance support | Confirm feature split with Open-Xchange before choosing an edition | Enterprise adds closed-source modules, GroupSync, Admin Console, Guard app and SLA-backed patches; these are not in Community |
| Operating effort | Major releases every four months; upgrades cannot skip majors, so plan one step at a time with backups | Depends on the chosen deployment; ask for the upgrade and patch model in writing | Major releases annually, minor monthly; in-place major upgrades are not guaranteed, so plan intermediate steps |
How to deploy Nextcloud or openDesk so the data stays in the EU
This sequence fixes where personal data is processed and by whom before any platform is installed, then builds, connects and migrates the workplace so the EU location holds through go-live.
Define processing location and operator chain
Your legal or privacy lead writes down where each data category will be stored, backed up and administered, and every organization that can touch it, including the hosting provider, the managed service operator, support staff and any subprocessor. Check remote access in particular, since EDPB Guidelines 05/2021 treat even a support session that displays data from a third country as a transfer. Confirm with the hosting provider which legal entity controls the infrastructure and whether any third-country authority can compel access. Done when you hold a signed map of locations and operators that your data protection officer has reviewed.
Choose between Nextcloud and openDesk
Pick Nextcloud Hub when you need files, sync and browser editing with Collabora Online and can run the stack with a small team, and openDesk when you want a broader bundled suite on Kubernetes that covers groupware, chat and video. Nextcloud Enterprise carries a 100-user minimum for paid tiers, and openDesk recommends its Enterprise Edition for production, so your choice affects the support contract as well as the software. Ask each vendor or partner to confirm which components are included, which are Enterprise-only and where support is delivered from. Done when the decision record names the platform, the edition and the support route.
Size the infrastructure and production services
Your platform or infrastructure team sizes the environment. An openDesk evaluation deployment needs at least 12 x64 CPU cores, 32 GB of RAM and more than 10 GB of disk, and ARM is not yet supported. Production adds external services that openDesk expects: PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. For Nextcloud 35, confirm the database (MariaDB 11.8 or PostgreSQL 18 is recommended) and PHP 8.5 with Apache or nginx. Done when the sizing sheet is signed off and every service has a named owner inside the EU location.
Connect the directory and single sign-on
Your identity team connects the platform to your user directory before any real data is migrated. Nextcloud's LDAP app lets LDAP and Active Directory users sign in with their directory credentials, and Nextcloud also documents OpenID Connect and SAML backends. For openDesk, the federation with an external identity provider is documented separately, so confirm the chosen method with ZenDiS or your integrator. Test group mapping, offboarding and deprovisioning with a pilot group. Done when a test user from each group can sign in, and a disabled account loses access without manual cleanup.
Harden, back up and set the upgrade path
Your security team applies the hardening baseline, sets encrypted backups held in the same EU jurisdiction and restores a backup into a test instance to prove it works. Agree the upgrade calendar in writing. Nextcloud does not allow skipping major releases, so you upgrade one major version at a time, back up before each upgrade and disable third-party apps until they are confirmed compatible. openDesk supports only the latest minor version, does not guarantee in-place upgrades between majors and may need intermediate steps after skipped minors. Done when a restore test has passed and the upgrade runbook is approved.
Run the security testing before go-live
An independent tester or your internal team checks the deployed application, its APIs, the network path and the directory integration before users arrive. Scope the test against the hardening baseline and the remote-access paths identified in step one, so that support and administration access is covered as well as end-user traffic. Record findings, assign owners and retest the critical ones. Done when the report lists no open critical findings and the retest evidence is stored with the processing records.
Export from Google and import in waves
Your Google Workspace super administrator runs the Data Export, which requires an admin account at least 30 days old and delivers zip files to a Cloud Storage bucket. Exports typically take about 72 hours but can take up to 14 days, and the default bucket is deleted after 60 days, so copy the archives into your EU storage before that window closes. Users who need personal copies can use Takeout if your administrators allow it. Import Drive files and mail in waves, convert native Docs, Sheets and Slides files, and check that sharing permissions survived. Done when a sample of each data type opens correctly in the target and the Cloud Storage copy is verified.
Document evidence and hand over operations
Your compliance lead collects the processing location records, operator list, transfer analysis, configuration baseline, test reports and upgrade runbook into one evidence pack. DeployOpen can prepare these systems and records for an assessment, but independent auditors issue any audit report or certification. Confirm with your operations team who handles monitoring, patching and incident response, and whether a support or upgrade retainer covers that work. Done when the evidence pack is filed, the operations owners have signed the runbook and the legacy Google tenancy is closed according to your retention policy.
Evidence a DPO or auditor will ask for
A DPO or auditor reviewing a move to an EU-hosted deployment will ask for the same core set of records: where data lives, who can reach it, and how it is kept running. The cards below cover what each record contains and what to check before the file goes to an assessor. DeployOpen prepares these artifacts from the implementation, but independent auditors and certification bodies are the ones who issue any assessment or certification.
Records of processing locations
Document every place personal data is stored, processed or viewed: the data center or cloud region, backup copies, the mail relay, object storage and any support access path. The EDPB treats storage in a cloud outside the EEA and remote viewing from a third country as transfers, so each location needs an entry. Check that administrator and vendor support sessions are listed too, because a screen share from outside the EEA counts. Ask your hosting provider to confirm the physical region for each service in writing.
Transfer assessment and third-country exposure
Record whether any party in the chain is subject to third-country law with extraterritorial reach, and whether that party could be compelled to disclose data held in the EU. Relevant laws include the US CLOUD Act provision at 18 U.S.C. 2713 and the Data Privacy Framework position, which remains under appeal as Case C-703/25 P. Note the controls that limit exposure, such as customer-held keys and EU-only administrative access. Have counsel review the conclusions, since the assessment itself is a controller decision.
Processor contract chain
List every processor and sub-processor that touches the data, from the cloud or data center operator to DeployOpen, support vendors and any managed service. Each link needs a data processing agreement that names the processing purpose, location and security measures. Where transfers occur, record the standard contractual clauses in Commission Implementing Decision (EU) 2021/914 and the supplementary measures. Ask every party to confirm in writing which sub-processors they use and how changes are notified.
Access logs and admin role records
Keep a current register of who holds administrator roles on the Kubernetes cluster, the identity provider, the file platform and the database, with the approval for each grant. Retain authentication and privileged action logs for the period your policy sets, and confirm that logs themselves stay in the EU. Review the list each quarter and after staff changes. For openDesk, record how identity federation with an external identity provider maps roles, so auditors can trace a user from directory account to permission.
Backup and restore test records
Show that backups exist, where they are stored and that a restore has been tested. Record backup schedules, retention periods, encryption status and the location of each backup copy, which must sit inside the same EU boundary as the primary data. Keep dated restore test results with the time taken and the data verified. Nextcloud documents a backup before every upgrade, so keep those pre-upgrade snapshots in the same log. Confirm with your operator whether any backup copy is replicated outside the EU.
Upgrade and patch history
Keep a dated log of every platform update, including the source and target versions, the test environment result and the person who approved the change. Nextcloud requires one major version at a time, so the log should show each step. For openDesk, track the release used, since only the latest minor version is supported and in-place upgrades between majors are not guaranteed. An auditor will check that security patches were applied within the time your policy sets, so compare the log against the vendor's security advisories.
Questions buyers ask before choosing an EU-hosted Google Workspace alternative
What does an EU-hosted Google Workspace alternative cost, and what drives it?
The cost is a mix of one-time work and recurring spend, and the split depends on your own infrastructure and support model. Nextcloud Enterprise is sold per user per year, and the list prices in the Nextcloud pricing page start at 71.29 euros for Standard, 104.99 euros for Premium and 204.75 euros for Ultimate, for 100 or more users, with a 100-user minimum and lower rates from 200 users. Those subscriptions are optional, since Nextcloud Hub is free to self-host under the AGPL. The other components are the cloud or data center capacity in the EU, storage, backup, mail infrastructure, Collabora Online or OX App Suite licensing or support, migration labor and staff time to run the platform. Ask any quote to separate one-time migration from recurring hosting, support and upgrade effort, and to state what the Google Workspace edition it replaces costs per user.
How long does a migration off Google Workspace take?
The export step has fixed limits, and the rest of the timeline depends on data volume, shared content and how many users cut over at once. In the admin Data Export, Google states that exports typically take about 72 hours but can take up to 14 days, the admin account must be at least 30 days old, and the default Cloud Storage bucket is deleted after 60 days. Plan the window so the archive is downloaded and verified well before that deletion date. Other drivers include the size of Drive and mailboxes, the number of native Docs, Sheets and Slides files that need conversion, shared drives, and how much cleanup of sharing links you want before cutover. Ask any provider for a schedule that starts from a written scope and names the export, conversion, import and parallel-run phases separately.
Can our own team run this migration without outside help?
A team with Linux, Kubernetes or PHP operations experience and a clear owner for mail and identity can often do parts of the work itself, but the full move usually needs skills across several areas at once. The main areas are platform installation, identity integration, mail routing and deliverability, document conversion, backup and restore testing, and upgrades. Nextcloud requires upgrading one major version at a time with a backup before each step, and openDesk requires a CNCF-certified Kubernetes cluster and external production services. Be honest about who on the team would carry the platform after go-live, because that ongoing load is often larger than the first deployment. A fixed-scope engagement with DeployOpen can cover planning, implementation, hardening, backup and documentation, with the written scope agreed before work starts.
What does our side need to provide for the project?
Your side provides the decisions, access and environment, and the project moves at the pace those inputs allow. Expect to supply an EU cloud account, data center or air-gapped network where the platform will run, identity source access such as LDAP or Active Directory, OpenID Connect or SAML details, DNS and TLS control, and a mail domain plan. You also need named owners for data classification, retention rules, sharing policy and user acceptance testing. For openDesk, production needs external PostgreSQL, MariaDB or Redis services, an SMTP relay, ClamAV over ICAP, object storage and a TURN server. Confirm each of these items in your own environment before signing a scope, since a missing dependency is one of the most common causes of delay.
Does hosting in the EU remove US legal exposure for our data?
No. EU hosting reduces some transfer risk, but it does not by itself remove exposure to foreign government access. The US CLOUD Act provision at 18 U.S.C. 2713 requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control, wherever it is located. The EDPB Guidelines 05/2021 also say that complying with a third-country authority request would be a transfer, so a controller should assess that exposure before engaging a processor subject to third-country law. The key questions are who controls the hosting company, who holds the keys, who can administer the systems, and whether any remote support from outside the EU can view data. Ask your counsel to review these points for your data categories. Self-hosting on infrastructure you control, with contractual and technical measures you verify, is one way to reduce this exposure.
Is openDesk Community Edition enough for production?
ZenDiS recommends openDesk Enterprise Edition for production, so the Community Edition should be treated as a starting point rather than a finished production setup. The Enterprise Edition uses the same open-source core licenses but adds closed-source modules, an Enterprise-only registry and license file, and SLA-backed second and third level support and patches, sold as SaaS or for on-premises installation. Enterprise-only features include Collabora branding and automatic load scaling, Element AdminBot, GroupSync and Admin Console, and the Guard app for Nextcloud Enterprise security patches. The Community Edition also requires a Kubernetes cluster at v1.33 or later and the production services listed in the openDesk requirements. Confirm with ZenDiS which edition fits your patching and support obligations.
What does ongoing support and upgrade work look like after go-live?
Ongoing work is recurring and it is usually the largest share of total cost over several years. For Nextcloud, a new major version comes every four months and each is supported for one year through monthly maintenance releases, so you need a repeatable upgrade routine with backup, staging and rollback. Nextcloud 35 was released on 16 September 2026 with end of life in September 2027, and the schedule shows older releases ending earlier. For openDesk, major releases are planned annually in Q3, only the latest minor version is supported, and in-place upgrades between majors are not guaranteed. Enterprise subscriptions can add maintenance lifecycles and support hours, as the Nextcloud pricing page describes for Premium and Ultimate. Retainers for upgrades, testing and support are available from DeployOpen, and the scope should be agreed in writing.
What changes for users and administrators after the move
Users will sign in through a different path, and that path is set by your directory. In a self-hosted Nextcloud or openDesk deployment, accounts are normally provisioned from Active Directory or LDAP through Nextcloud's LDAP app, or federated from an external identity provider over OpenID Connect or SAML. Users who today sign in with a Google account will need a new password flow, multi-factor enrollment and possibly new client apps for sync. Sharing also changes: Drive link sharing becomes Nextcloud share links and group folders, and openDesk brings its own permission model across components. Confirm with the buyer's identity team exactly how sessions, password resets and device enrollment will work before the pilot starts.
Browser editing moves to Collabora Online or the openDesk web office, and the file formats need testing. Collabora Online edits .docx, .xlsx and .pptx, so most Office-compatible work carries over, but native Google Docs, Sheets and Slides files must be converted on the way out, and layout, comments, suggestion mode and co-editing behavior can differ. openDesk bundles Collabora as its web office alongside Nextcloud, OX App Suite, Element and CryptPad, so users move between several web interfaces rather than one Google-style home screen. Google-specific features such as Smart Compose, Meet live captions, Chat spaces or Apps Script automations may not have one-to-one equivalents. Treat each as an open item to confirm in a pilot with real user groups, not as a given.
Administrators take on upgrades, backups and monitoring that Google previously carried. Nextcloud publishes a new major version every four months and supports each for one year, and it does not allow skipping major releases, so the operator must plan one-step upgrades, back up before each one and disable third-party apps until they are confirmed compatible. openDesk expects production-grade external services such as PostgreSQL, Redis, an SMTP relay and object storage, plus a Kubernetes cluster that the buyer or partner must patch and monitor. Decide early who holds these duties, whether in-house staff, a managed partner or a retainer, and ask any vendor or integrator to put the upgrade, backup and restore responsibilities in writing.
How DeployOpen deploys Nextcloud and openDesk inside your EU boundary
DeployOpen plans, implements, hardens and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks, so the data stays where your data protection assessment says it must. For an EU data sovereignty move, we start from the transfer and access questions your legal and security teams must answer, then build the Nextcloud or openDesk deployment to match.
How we scope
- Engagements are fixed-scope, with the systems, data categories and hosting locations agreed in writing before work starts.
- We map which Workspace services move, including Gmail, Drive, Docs, Meet and Chat, and which stay out of scope.
- The written scope names who controls encryption keys, administrator access and support sessions, so residency questions have documented answers.
How we build
- We deploy Nextcloud or openDesk into the EU hosting environment you specify, including Kubernetes clusters, databases, SMTP relay and object storage.
- We configure identity federation with your existing directory and document the authentication backends in use.
- We harden the stack, set up backups and test restores, and run the upgrade path between major releases before go-live.
How we hand over
- You receive architecture, configuration, runbooks and access records for the deployed environment.
- We prepare the evidence your independent auditors or certification bodies will ask for, without issuing audit reports or certifications ourselves.
- Handover includes operator training so your team can run upgrades, backups and user administration.
How we support
- Ongoing support, upgrades and continuous security testing are available as retainers after handover.
- Retainers cover the release cadence of your chosen platform, so you confirm which edition and support tier fit your risk.
- Security testing of the deployed applications and APIs can run on a recurring schedule agreed in the retainer.
