Self-hosted Microsoft 365 alternative for EU data sovereignty

Self-hosted Microsoft 365 alternative for EU data sovereignty: the short answer

A self-hosted open-source suite running in your own datacenter or a European provider's datacenter meets EU residency duties only if the people who operate it, hold the encryption keys and provide support are also under EU control. Location alone does not settle the question. Under GDPR Article 44, remote access from a third country, even just displaying data on a screen for support, counts as a transfer under the EDPB Guidelines 05/2021, so a support contract with a non-EU engineer can undo a well-placed server. Start by mapping every party with administrative or access rights, including the hosting provider, the Kubernetes or database vendors and any support subscription.

Microsoft's EU Data Boundary and Microsoft 365 Local change where data is stored and processed, but they do not answer every control question. Under 18 U.S.C. 2713, US providers must preserve or disclose data in their possession, custody or control regardless of where it sits, and the EDPB Recommendations 01/2020 state that where a provider needs data in the clear and a destination's public authority powers go beyond what is necessary and proportionate, no effective technical supplementary measure can be envisioned. Ask Microsoft in writing how the EU Data Boundary applies to your tenant, which exclusions (including Multi-Geo tenants) affect your data, and who can access support data. Read the current terms yourself, and have counsel review them, because the EU-US Data Privacy Framework is under appeal as Case C-703/25 P.

What the EU data sovereignty constraint requires

For European organizations, the question is less whether data sits in an EU region and more who can lawfully reach it, from where, and under which law. The four cards below cover the transfer rules, foreign authority access, the status of the EU-US framework and the switching rights that shape any exit plan.

Transfers include remote access

GDPR Article 44 applies to every transfer of personal data to a third country, including onward transfers. EDPB Guidelines 05/2021 treat remote access from a third country as a transfer, even when the data is only displayed on a screen for support or administration. Check every vendor support path, follow-the-sun team and admin console login for locations outside the EEA, not only where data is stored. Fines for infringements of Articles 44 to 49 reach EUR 20 million or 4% of worldwide annual turnover, as stated in Article 83(5)(c).

Foreign authority access

The US CLOUD Act provision at 18 U.S.C. 2713 requires providers to preserve or disclose data in their possession, custody or control, wherever it is located. GDPR Article 48 says a third-country order to disclose personal data is enforceable in the EU only when it rests on an international agreement such as a mutual legal assistance treaty. Ask any cloud provider for its process on foreign demands, and confirm whether its operating entity or parent company falls under such laws.

Schrems II and the Data Privacy Framework

In Case C-311/18 (Schrems II), the Court of Justice invalidated the Privacy Shield adequacy decision while keeping standard contractual clauses valid. The 2023 Data Privacy Framework decision covers only US organizations on the DPF List, and an appeal in Case C-703/25 P is pending. EDPB Recommendations 01/2020 state that where a provider must access data in the clear and foreign surveillance powers exceed what is necessary and proportionate, no effective technical measure may exist. Treat framework status as a moving legal position and record it in your transfer assessment.

Data Act switching rights

The Data Act has applied since 12 September 2025 and gives customers the right to switch from a data processing service to another provider or to on-premises infrastructure. Notice may run up to two months, with a 30-day transition, and switching charges are banned from 12 January 2027. Article 32 also requires providers to prevent third-country governmental access to non-personal data held in the Union where it would conflict with Union or national law. Write these terms into your contract and exit plan before renewal.

Where Microsoft 365 meets the constraint and where it does not

The EU Data Boundary, Multi-Geo tenant exclusions and Microsoft 365 Local answer different questions, and none of them settles who can compel access to your data. Before you rely on any of them, confirm in Microsoft's current documentation which workloads and data categories the EU Data Boundary covers, and which services or data are excluded for Multi-Geo tenants, since those lists change. Do not assume that a European datacenter removes exposure to US law. Under 18 U.S.C. 2713, providers must preserve or disclose data in their possession, custody or control whether it sits inside or outside the United States, so data location alone does not answer the question. Ask Microsoft in writing which legal entity contracts with you and which entity can be compelled.

Exit planning depends on export rights, and those are licensed separately. Purview eDiscovery can export Exchange mailbox items as PST or .msg files and SharePoint and OneDrive content as native documents with selectable version history, but exporting requires a Microsoft 365 E3 or E5 license, and each search export package expires 14 days after creation. Confirm that your current subscription includes that export capability for every administrator who will run it, and build the migration schedule so downloads finish inside the 14-day window. Read Microsoft's eDiscovery export documentation before you assume the same steps will work for your tenant's retention and hold settings.

Turn the open questions into a written checklist for the contract review. Ask who holds support access to your tenant, under what approval and from which countries, and whether customer-managed encryption keys are available for each workload you run. Ask how government access requests are handled, whether you are notified, and how requests are assessed against GDPR Article 48, which allows a third-country order to be recognized only under an international agreement. No supplied source shows that Microsoft 365 or any alternative meets a specific sovereignty requirement, so the transfer assessment and any data protection impact assessment remain your work, as the EDPB Recommendations 01/2020 describe. Record the answers you receive and the date you received them.

Which open-source options fit EU data sovereignty

This table compares openDesk (Community and Enterprise), Nextcloud Hub with Collabora Online and OX App Suite, and Nextcloud All-in-One on who controls hosting, licensing, components and operations. Read each row as a question to answer for your own environment, since sovereignty depends on where you run the stack and who holds the support contract. The main takeaway is that every option moves control to you, but the Kubernetes and enterprise-only trade-offs differ sharply.

Criterion	openDesk (Community and Enterprise)	Nextcloud Hub with Collabora and OX	Nextcloud All-in-One
Where hosting runs	Your own Kubernetes cluster in your datacenter or a European provider you choose	Your own servers or cloud account, with components installed separately	Your own Docker host or Kubernetes cluster, installed through the official installation method
Licensing of core components	Apache 2.0 for deployment automation; each bundled component keeps its own license, such as AGPL-3.0 for Nextcloud and MPL-2.0 for Collabora	Nextcloud Server under AGPL-3.0; Collabora Online under MPL-2.0; OX App Suite under its Open-Xchange terms, which you should confirm	Same component licenses as Nextcloud and Collabora; confirm the license of each bundled container image before deployment
Who provides support and patches	ZenDiS develops the suite; Enterprise Edition adds SLA-backed 2nd and 3rd level support and patches, sold as SaaS or on-premises	Community support is free; Nextcloud GmbH sells Standard, Premium and Ultimate subscriptions with a 100-user minimum	Community maintained; no vendor support tier is documented in the supplied material, so confirm with Nextcloud GmbH
Enterprise-only features	Collabora branding and load scaling, Element AdminBot, GroupSync, Nextcloud Enterprise security patches, OX S3 storage and advanced search	Enterprise subscribers receive additional features and support; confirm the current feature list on the pricing page	Bundles ClamAV, full-text search and BorgBackup, so fewer add-ons are needed than in a manual install
Mail and calendar	OX App Suite for groupware is bundled	Nextcloud does not include a mail server; OX App Suite or another mail server must be added separately	Does not include a mail server; mail must come from another platform
Platform requirements	CNCF-certified Kubernetes v1.33 or later, an ingress controller, cert-manager, Helm and Helmfile; tested on kubespray, not OpenShift	Nextcloud 35 recommends MariaDB 11.8 or PostgreSQL 18, PHP 8.5 and Apache or nginx with php-fpm	Docker-based install with a Helm chart for Kubernetes; you still operate the host, backups and updates
Upgrade path	Annual major releases; only the latest minor is supported and in-place major upgrades are not guaranteed	Four-month major releases; upgrades must go one major version at a time with a backup before each step	Follows Nextcloud upgrade rules; plan staged updates and test third-party apps first
Main trade-off for sovereignty	Strongest bundled suite, but operating Kubernetes and the external services it expects is a significant in-house skill set	Greatest flexibility to choose the mail and office stack, at the cost of integrating and testing each component yourself	Fastest route to a working Nextcloud instance, with less control over the wider stack and no bundled mail server

Who operates the stack in each hosting model

When the organization runs openDesk, or Nextcloud with OX App Suite, in its own datacenter, it holds the hardware, hypervisors, Kubernetes cluster, storage, backups and the keys that protect them. Its own staff patch the platform, rotate secrets and decide who receives privileged access. No third-country processor sits in the chain unless the organization adds one. The trade-off is that the organization carries every operational role itself or pays a partner to perform some of them.

Infrastructure: The organization owns or leases the racks, network, Kubernetes cluster, PostgreSQL, MariaDB, object storage and TURN server that openDesk expects for production.
Administrators: Platform staff hold cluster-admin and host-level rights. Document the named roles, the approval path and the break-glass procedure in writing.
Keys: Encryption keys, certificates and backup keys sit in key management the organization controls, ideally backed by a hardware security module it operates.
Support access: Vendor or partner sessions into production should run through accounts the organization approves and logs. Remote access from a third country can still be a transfer under EDPB Guidelines 05/2021, so record where each session originates.
Upgrades: openDesk supports only the latest minor version, and Nextcloud requires one major version at a time, so the internal team must schedule and test every upgrade.

Before committing, confirm which person holds each privileged role, where the keys are generated and stored, and which external sessions can reach production.

How to deploy openDesk or Nextcloud under the constraint

This sequence turns an EU data sovereignty requirement into a deployment you control, from confirming where data and support access sit to the upgrade and backup routines that keep the system running after go-live.

Confirm datacenter location and support access
Before any infrastructure is ordered, the CISO or CIO records which datacenter, cloud region or sovereign facility will hold the data, which legal entity operates it, and who can reach the systems for support. Ask the chosen provider in writing whether any remote administration, log access or vendor support session can display or transfer personal data from outside the EEA, since the EDPB treats remote access from a third country as a transfer. Done when the answers are documented and signed off by the data protection officer.
Provision a CNCF-certified Kubernetes cluster
The platform team builds a CNCF-certified Kubernetes cluster at v1.33 or later inside the approved location. openDesk requires an ingress controller (haproxy-ingress, or the deprecated Ingress nginx), cert-manager, and an RWO volume provisioner, and the installer needs Helm 3.17.3 or later below v4 and Helmfile 1.0.0 or later. Confirm with the ZenDiS documentation that your distribution is supported, because the project tests kubespray clusters and does not test OpenShift. Done when the cluster passes a basic workload test and every required component reports healthy.
Provision production data and mail services
For production, openDesk expects external services rather than bundled test instances: PostgreSQL 15, MariaDB 10, Redis 7, Memcached, Cassandra, an SMTP relay, ClamAV reached over ICAP, object storage and a TURN server. The infrastructure team hosts each service inside the same jurisdiction, with its own backup policy and access control, and documents where every service's data lives. Done when each service is reachable from the cluster, its credentials sit in the secrets store, and the data map lists every location where personal data is stored. Nextcloud deployments need the equivalent database, cache and mail services, with the versions in the current Nextcloud system requirements.
Federate identity with your directory
Connect users to your existing directory so access follows your joiner, mover and leaver process. For Nextcloud, the LDAP app lets Active Directory or LDAP users log in with their directory credentials, and OpenID Connect or SAML backends are also documented. For openDesk, the identity federation guide describes connecting an external identity provider. The identity team tests with a small pilot group, including a disabled account and a group removal, to confirm that access is revoked. Done when the pilot accounts sign in and the revocation test denies access within the expected window set by your policy.
Deploy the evaluation environment before production
Build a separate evaluation deployment first to confirm the chain works end to end. The openDesk requirements list 12 x64 CPU cores, 32 GB of RAM and more than 10 GB of disk for an evaluation, with ARM not yet supported. These figures apply only to evaluation and do not size a production environment, which depends on user count, storage volume and the external services listed above. Done when the team has installed the chosen release, signed in with federated accounts, and recorded the install steps as a runbook for production.
Deploy production and configure backups
Deploy the production release from the same runbook, with the enterprise decision made in advance: ZenDiS recommends openDesk Enterprise Edition for production, and it adds SLA-backed support and patches, while Nextcloud Enterprise is sold in tiers with a 100-user minimum. Configure backups for every stateful service, including the databases, object storage and file data, then test a restore into an isolated namespace. Done when a restore test succeeds, the recovery time and recovery point are recorded, and the backup copies sit in the same jurisdiction as the production data.
Set the upgrade cadence and test it
Agree a written patching process with the vendor or the support provider. openDesk plans major releases annually in Q3, minor releases monthly and patch releases on demand, supports only the latest minor version, and does not guarantee in-place upgrades between majors. Nextcloud publishes a new major version every four months, supports each for one year, and does not allow skipping major releases, so administrators must step through one major version at a time, back up before each step and disable third-party apps until they are confirmed compatible. Done when a staging copy has been upgraded through the planned path and the rollback procedure has been tested.
Document controls and hand over operations
Record the location map, access model, backup and upgrade procedures, and the identity configuration in the controls register that the compliance team will use for assessment. DeployOpen prepares this evidence for an independent auditor, but the audit report itself comes from the auditor and certification body, not from the implementation. Ask the operations team to confirm who holds administrative credentials and how privileged sessions are logged. Done when the handover pack is approved, operators have run one planned upgrade in staging, and the owner of each control is named.

Evidence regulators and auditors ask for

A sovereignty decision is only as strong as the records behind it. The cards below cover the evidence a data protection authority, a customer or an independent auditor will ask for, whichever suite you run. DeployOpen prepares these records and controls for your assessment, but independent auditors and certification bodies issue any attestation.

Data processing location records

Record where every data store sits for each workload: mailboxes, file storage, databases, backups, search indexes and logs. For each location, note the legal entity that operates it and the country of its staff with administrative access. Regulators read these records against Article 44 of the GDPR, so check that backups and disaster recovery copies are included, not only primary storage. Confirm the answer for any managed or vendor-run component in writing.

Transfer impact assessments and SCC use

If any processor or support path reaches data from a third country, document the transfer, the safeguard relied on and the assessment behind it. Standard contractual clauses under Commission Implementing Decision (EU) 2021/914 need a signed record and a transfer impact assessment that considers the destination's public authority powers. Keep the assessment current, because the EU-US Data Privacy Framework rests on a pending appeal. Ask any Microsoft-operated or other vendor-operated component for its current transfer documentation.

Access logs for remote support

Remote access from outside the EEA counts as a transfer, even when a support engineer only views a screen. Keep logs of every administrative and vendor session: who connected, from which country, which system, under which approval and for how long. Tie each session to a ticket and a named account, and store the logs in your own infrastructure. Check that privileged accounts cannot be used without leaving a record.

Key management records

Document who holds encryption keys, where they are generated and stored, and whether a third party can reach them in the clear. Under EDPB Recommendations 01/2020, a supplementary technical measure only helps when the key stays with the controller. Record key rotation, key custody steps and the procedure for revoking access. Ask any cloud provider to confirm in writing whether it can access data in plaintext.

Data Act switching and exit documentation

The EU Data Act gives customers the right to switch providers or move to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Keep an exit plan that lists data formats, export procedures, dependencies and the contract terms that govern each step. Charges for switching are banned from 12 January 2027, so record any fees you pay today. Test the export path before you need it.

Update and patch records

Keep a dated register of every platform release, security patch and configuration change applied to the suite and its dependencies. For openDesk, note that only the latest minor version is supported and that major upgrades are not guaranteed in place. For Nextcloud, record each major upgrade, the backup taken before it and the third-party apps disabled during it. This register shows an auditor that the system stays inside a supported lifecycle.

Questions buyers ask before choosing a self-hosted Microsoft 365 alternative

What does a self-hosted Microsoft 365 alternative cost compared with Microsoft 365?

The cost depends on which components you choose and who runs them, so there is no single figure to compare. Nextcloud Enterprise is sold per user per year in Standard, Premium and Ultimate tiers, with list prices starting at 71.29, 104.99 and 204.75 euros per user per year respectively for 100 or more users, according to Nextcloud's pricing page, and it has a 100-user minimum. Community editions are free to license but still need servers, storage, backup, mail, and staff time for installation and upgrades. openDesk Enterprise is sold as SaaS or for on-premises installation, so ask ZenDiS or a partner for its terms. Ask any provider for a quote that separates one-time migration from recurring licensing, hosting and support.

What drives the total cost of a migration off Microsoft 365?

Four cost components usually decide the total: hardware or cloud capacity, storage volume, the staff who operate the platform, and the migration itself. Hardware needs rise with user count and with the external services openDesk expects in production, such as PostgreSQL, MariaDB, Redis, an SMTP relay, ClamAV, object storage and a TURN server. Storage grows with mailbox and document volume, which you can measure before you commit. Staff costs recur, and they depend on whether your team already runs Kubernetes or Linux services. Migration cost is mostly one-time and grows with the number of mailboxes, sites, custom retention rules and integrations. Ask each vendor or partner to price these items separately in the written scope.

How long does a migration from Microsoft 365 take?

The timeline is set by the scope, not by a standard duration, so confirm it in writing before work starts. The main variables are the number of mailboxes, the volume of SharePoint and OneDrive content, how many Teams or chat histories must move, the number of integrations, and how many cutover waves you need. Exports through Purview eDiscovery require a Microsoft 365 E3 or E5 license, and search export packages expire 14 days after creation, so your export schedule must fit that window. Plan a pilot group first, then cut over in waves. Your provider should show the phases, owners and acceptance tests in the scope document.

What does our team have to provide during a migration?

Your team needs to supply decisions, access and people who can verify results. Expect to provide an identity source (such as Active Directory or an OpenID Connect or SAML provider), DNS and certificate control, a Kubernetes cluster or servers that meet the stated requirements, and a named owner for mail routing, retention policy and legal hold. Business owners must confirm which mailboxes, sites and chats are in scope and which can be retired. Security and compliance staff should approve the data classification and export evidence. Ask the provider to list these inputs in the written scope so that gaps appear before the schedule is fixed.

Can our IT team run a self-hosted Microsoft 365 alternative without outside help?

A team can run these platforms in-house if it has Kubernetes, Linux, database and identity skills, and if it can keep up with upgrades. openDesk requires a CNCF-certified Kubernetes cluster at v1.33 or later, an ingress controller, cert-manager, an RWO volume provisioner, Helm and Helmfile, and it is tested on kubespray clusters rather than OpenShift. Nextcloud does not allow skipping major releases, so each upgrade is a planned step with backups and third-party app checks. Assess your skills honestly, then decide whether to buy a retainer for upgrades, monitoring and testing. DeployOpen plans, implements, hardens, backs up, upgrades and supports these platforms in your environment under fixed-scope or retainer agreements.

Do we need openDesk Enterprise Edition for a production deployment?

ZenDiS recommends openDesk Enterprise Edition for production. The Enterprise Edition uses the same open-source core licenses but adds closed-source modules, an Enterprise-only registry and license file, and SLA-backed second and third level support and patches. Enterprise-only features include Collabora branding and automatic load scaling, Nextcloud Enterprise security patches, OX S3 storage with advanced full-text search, and GroupSync with the Admin Console. Whether you need these depends on your support obligations and your appetite for maintaining patches yourself. Confirm the support terms, SLAs and sales model directly with ZenDiS before you decide.

Is the Microsoft EU Data Boundary enough for EU data sovereignty?

The EU Data Boundary reduces where Microsoft stores and processes customer data, but it does not remove exposure to non-EU law. The US CLOUD Act at 18 U.S.C. 2713 requires providers in scope to preserve or disclose data in their possession, custody or control, wherever that data is located. Multi-Geo tenants and Microsoft 365 Local each have their own exclusions and control arrangements, so review them against your legal analysis. Under GDPR Article 48, a third-country order is recognized only if an international agreement supports it. Ask your data protection officer and counsel to assess the exposure, and treat a self-hosted deployment in your own or a European provider's datacenter as a separate option to evaluate, not a guarantee of compliance. DeployOpen prepares systems and evidence for compliance assessments but does not issue audit reports or certifications.

How DeployOpen scopes a sovereignty migration in writing

Most DeployOpen engagements are fixed-scope, which means the scope, deliverables and timelines are agreed in writing before any work begins. For a sovereignty migration, that document should name each workload in the move (mailboxes, SharePoint and OneDrive libraries, Teams chat and meetings), the target platform (openDesk on Kubernetes, or Nextcloud with Collabora Online and OX App Suite), the hosting location and the operator of each layer. It should also state who holds the cloud accounts, data center or air-gapped network where the platform runs, and which data classes are in scope for residency review. Ask for the written scope to list the exact exclusions too, because third-country access questions often sit in the parts nobody named.

The written scope should separate the work DeployOpen performs inside your infrastructure from the controls your own teams keep. DeployOpen can plan, implement, customize, integrate and harden the platform, configure backups and upgrades, and document the resulting architecture, data flows, access paths and evidence. Confirm for each item whether the deliverable is a configuration, a runbook, a test result or an evidence pack, and who signs off. Where a supporting service is required, such as an SMTP relay, object storage or a TURN server, the scope should say whether it is provisioned by your team or by DeployOpen, because that decides where the data physically sits.

Ongoing support, upgrades and continuous testing are available as retainers, and they matter for sovereignty because the platform keeps changing after go-live. Ask for the retainer to cover the upgrade path for each component, including the one-major-version-at-a-time rule that applies to Nextcloud and the intermediate steps openDesk may need when skipping minor releases. Be clear with the provider that DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies do that work, so the scope should name the evidence your assessor will need and confirm with them in advance which artifacts they accept.

How DeployOpen deploys open-source office suites under EU sovereignty requirements

DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside the client's own infrastructure, including cloud accounts, data centers and air-gapped networks. For European organizations replacing Microsoft 365, that means the mail, files, office editing and chat run where your data governance rules say they must run, and the evidence for those controls is documented as the work proceeds.

How we scope

Written scope fixes which workloads move, such as mail, files, office editing and chat, before any work starts.
Scope records where data will be hosted, which entities hold administrative access and which transfer paths are excluded.
Engagements are fixed-scope, with deliverables and timelines agreed in writing; a quote follows from that scope.

How we build

Deployment targets your own cloud accounts, data centers or air-gapped networks, with identity federation to your existing directory.
Components are hardened and integrated, and each bundled component's license terms are reviewed and recorded.
Security testing of applications, APIs and infrastructure is run against the build before users are onboarded.

How we hand over

Handover includes architecture, configuration, backup, upgrade and access control documentation for your team.
Evidence for compliance assessments is prepared, while independent auditors and certification bodies issue any formal reports.
Administrators are trained on upgrade paths, backup restores and the one-major-version-at-a-time discipline the chosen platforms require.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover tracking of platform release schedules so upgrades are planned before support windows close.
Ask for the support scope, response commitments and upgrade responsibilities in writing before signing.

Self-hosted Microsoft 365 alternative for EU data sovereignty