Document editing for EU data sovereignty

Why browser editing is a GDPR transfer question for EU document editing

For an EU controller editing personal data in a browser suite, the hosting location of the editor and the traffic it carries decide transfer exposure, not only where the files rest. Every keystroke, cursor position, document fetch and save travels between the browser, the document server and the file platform, and any of those components operated from outside the EEA can make the session a transfer under Chapter V of the GDPR. The EDPB's Guidelines 05/2021 (version 2.0) are explicit that remote access from a third country, even only displaying data on a screen for support or administration, is a transfer, and that storage in a cloud outside the EEA is one too. A browser editor run by a vendor on infrastructure outside the Union therefore creates transfer exposure on every editing session, whether or not anyone downloads a copy.

The cleanest path for most EU organizations is to run the editor, its document server and the storage behind it on infrastructure the controller controls inside the EEA, such as its own data center or a cloud account in an EU region it selects. Collabora Online and ONLYOFFICE Docs both run as self-hosted services, so the controller decides where the document server, the WOPI endpoint and the file platform sit, and which support or telemetry channels, if any, leave the network. Self-hosting does not end the analysis. Under the EDPB's Example 12, an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a third-country authority request would be, so the controller should check whether the operator, its parent company or its support staff can be compelled to grant access from outside the EU. Confirm in writing with each vendor and any hosting provider which jurisdictions can reach administrator access, logs and backups, and which support channels open remote sessions.

Which GDPR, transfer and sovereignty requirements shape the editing design

This table maps each GDPR, transfer and sovereignty requirement to what it asks of the editing stack, from editor hosting and WOPI traffic to logs and vendor support access. Read each row as a design question: if your answer to the requirement is unclear, the editor location, log scope or support model needs a decision before procurement. The main takeaway is that the editor, its document traffic and its support paths all count as processing locations, not only the file storage.

Requirement	What it means for the editing design	Evidence to prepare
GDPR Article 44 (onward transfers)	Every transfer to a third country, including onward transfers, must meet Chapter V. Editor hosting, backups and subprocessors all need a documented location.	Data flow map showing where documents, sessions and backups sit, with each subprocessor location
GDPR Article 83(5)(c) fine ceiling	Infringements of Articles 44 to 49 carry fines of up to EUR 20 million or 4% of worldwide annual turnover, which is why transfer exposure reaches the board.	Risk register entry linking editing hosting decisions to transfer compliance
EDPB Guidelines 05/2021 (remote access)	Remote access from a third country, even only displaying a document for support, counts as a transfer. Vendor support sessions must be scoped to EEA staff or controlled.	Support access procedure, named staff locations and session logs for vendor access
EDPB Guidelines 05/2021 (cloud storage)	Storing document content in a cloud outside the EEA is a transfer. Editor caches, temporary files and object storage belong in the assessed boundary.	Storage location inventory for editor temporary files, backups and object stores
EDPB Guidelines 05/2021 (Example 12)	Using an EU processor subject to third-country law with extraterritorial effect is not itself a transfer, but complying with a foreign authority request would be. Assess that exposure before engaging the processor.	Written exposure assessment for any hosting or support provider with foreign parent or law
GDPR Article 48 (third-country orders)	A foreign court or authority order to disclose personal data is only recognized in the EU if based on an international agreement such as a mutual legal assistance treaty. Editing logs and document copies should be minimized so fewer records are exposed.	Legal review of disclosure paths and a log retention schedule for WOPI and editor activity
18 U.S.C. 2713 (CLOUD Act reach)	US providers must preserve or disclose data in their possession, custody or control wherever it is stored. A US-parented hosting or support vendor can be reached even for EU-located editors.	Vendor ownership and control statement, plus contract terms on notification and challenge of orders
Schrems II and EDPB Recommendations 01/2020	Standard contractual clauses survived Schrems II, but where a provider must access data in the clear and foreign powers exceed what is necessary, the EDPB sees no effective technical supplementary measure. Self-hosting in EU infrastructure without foreign admin access is the main control.	Transfer impact assessment covering editor hosts, admin access and key custody
Data Privacy Framework status (Case C-703/25 P)	Adequacy under Implementing Decision (EU) 2023/1795 covers only US organizations on the Data Privacy Framework List. An appeal of the General Court's September 2025 judgment is pending, so do not treat DPF listing as settled.	Current DPF list check for each US vendor, plus a fallback transfer mechanism if the adequacy finding changes
EU Data Act Article 32 (third-country access)	Providers must take measures to prevent third-country governmental access to non-personal data held in the Union where it conflicts with Union or national law. Ask providers how they document these measures.	Provider's written Article 32 measures and their scope for hosted editing services
Data Act Articles 25, 29 and 50 (switching)	Customers may switch to another provider or to on-premises infrastructure, with a maximum two-month notice period and a 30-day transition. Switching charges are banned from 12 January 2027. Open-source self-hosting keeps this exit path practical.	Exit plan naming export formats, editor replacement path and contract notice terms

Which self-hosted editors fit an EU sovereignty brief

The editor you pick sets where document content travels during a session, who can issue support and security updates, and what the license obliges you to do. The cards below cover the main options for a European brief, along with the checks each one needs before a decision.

Collabora Online

Collabora Online is a browser editor built on LibreOffice technology, released under MPL-2.0, and integrated into file and chat platforms through WOPI. Its WOPI integrations include Nextcloud, Seafile and Mattermost. The free CODE build is intended for testing, home use or small teams and is not recommended for production, so a sovereignty design that goes live needs a supported edition. Confirm with the vendor which plan carries signed security updates and where support staff are located.

ONLYOFFICE Docs

ONLYOFFICE Docs is an online office suite for documents, spreadsheets, presentations, forms and PDF, compatible with Office Open XML formats and licensed under AGPL-3.0. Its AGPL terms can require source disclosure for modified network-accessible services, so legal review matters if you customize the editor. Clustering is limited to paid editions, so confirm the edition and support model that your user count and availability target require before you commit to an architecture.

Nextcloud Office as the host

Nextcloud Office connects editing to the Nextcloud file layer, which keeps files, sharing and sessions on one server you control. Nextcloud Server is licensed under AGPL-3.0. Nextcloud Enterprise is sold in Standard, Premium and Ultimate tiers with a 100-user minimum, and the tier sets maintenance length and support hours. Confirm which tier your sovereignty and availability requirements need, and whether the editor backend is hosted in the same EU boundary as the files.

Nextcloud release lifecycle

Nextcloud publishes a new major version every four months and supports each one for a year, and it does not allow skipping major releases during upgrades. For a sovereignty brief this means the host and editor must be upgraded in sequence, with a backup before every step. Plan a standing upgrade window, and confirm with your provider how long your chosen tier guarantees maintenance for each version you run.

License obligations and jurisdiction

Licenses such as AGPL-3.0 and MPL-2.0 govern how you may use, modify and redistribute the code. They do not determine where personal data is stored, who can compel access to it, or whether a transfer occurs under GDPR. Those questions depend on the hosting location, the operator of the service and the support contract. Ask each candidate for its license terms, its support jurisdiction and its operator, then have counsel review them against your transfer assessment.

Self-hosted editors versus US cloud office suites under EU law

The core point is that the two models carry different kinds of exposure, and neither one is safe by default. A US cloud office suite can be subject to the US CLOUD Act (18 U.S.C. 2713), which requires electronic communication and remote computing service providers to preserve or disclose data in their possession, custody or control whether that data sits inside or outside the United States. Hosting in an EU region does not remove that obligation. GDPR Article 48 limits how a third-country order can be enforced in the EU, but it does not stop the provider from receiving the order. Your assessment should therefore ask who controls the keys, who can reach the tenant's content and editing sessions, and what the provider's contract says about government requests.

EDPB Guidelines 05/2021 (Example 12) draw a useful line. Using an EU processor that is still subject to third-country law with extraterritorial effect is not in itself a transfer. Complying with a request from that third-country authority, however, would be a transfer, so the controller should assess that exposure before engaging the processor. EDPB Recommendations 01/2020 go further where the cloud provider needs access to data in the clear: if the destination's public authority powers go beyond what is necessary and proportionate, the EDPB states it cannot envision an effective technical supplementary measure. Encryption that the provider can break does not solve that problem, which is why the editor's key handling and session data flows matter as much as the hosting location.

A self-hosted editor such as Collabora Online or ONLYOFFICE Docs, running in your own cloud account or data center, removes the foreign suite vendor from the chain and gives you direct control over where documents and WOPI traffic travel. It does not remove the need for assessment. You still need to evaluate the operator team, the cloud or colocation host (including whether that host is a US company subject to the CLOUD Act), the administrator accounts that can read storage or logs, and any backup or support access that brings data into view of a third party. Confirm with your host and support provider where administrative access originates, whether remote support sessions display content, and where logs and crash dumps are stored. Those are the points where a supposedly EU-only deployment can still leave the EEA.

Keeping an optional AI assistant on your own infrastructure

Collabora Online 26.04 was announced on July 23, 2026, and adds an optional AI assistant across Writer, Calc and Impress. The assistant is off by default, which means that a standard deployment does not send document content to any AI service. This is the simplest position for a data sovereignty review, because the editor's data flows stay the same as they were before the upgrade. It still needs a check, because an upgrade can change defaults, and a team member can enable the feature in a configuration file or admin panel without a formal decision.

Confirm the setting after each upgrade: Check the assistant configuration in every environment after upgrading to 26.04 or later, and record the value in your change log.
Restrict who can change it: Limit administrative access to the document server configuration, and require a change request for any AI-related setting.
Keep a written record: Document the decision to leave the assistant disabled, the reason, and the review date, so auditors see a deliberate control.
Test the disabled state: Confirm with network logs that the editor does not contact AI endpoints when a user works with a document.
Plan for later requests: Users will ask for the feature. Prepare the assessment in the other two tabs before a request arrives.

Before you rely on this position, confirm with Collabora which settings control the assistant in your release and how the default is documented for your version.

How an EU sovereign editing rollout runs, phase by phase

The sequence turns a general wish to keep documents in the EU into a mapped data flow, a jurisdiction-checked supplier list, a deployed and restricted editing service, and evidence that the setup holds from pilot through exit. Each phase closes with a document or configuration that the next phase depends on.

Map transfers and document data flows
The privacy lead and the business owners of each document type list where documents are created, stored, opened and edited, and which people or systems can reach them from outside the EU. The map covers browser editing sessions, WOPI calls between the file platform and the editor, backups, logs, support access and any AI feature. Each flow is marked as staying in the EEA, leaving it, or being unknown. The output is a signed data flow register that names every point where personal data could be displayed or stored outside the EEA, because EDPB Guidelines 05/2021 treat remote viewing from a third country as a transfer too.
Assess hosting, jurisdiction and support paths
For each processor and sub-processor on the map, the legal and security team records the operating entity, the data centre locations, the location of administrators and support engineers, and the legal exposure to third-country authority requests. US-parented cloud suites and any support path that allows remote screen access need particular attention, since EDPB Example 12 says compliance with a third-country authority request would itself be a transfer. Ask each provider in writing where data and support sessions are processed and how it responds to foreign government demands. The output is a jurisdiction assessment per supplier with a clear accept, restrict or reject decision.
Select the editor and file platform editions
Choose the editing engine and the file platform together, because the WOPI integration, licensing terms and support model depend on both. Confirm the license of each candidate (for example, the AGPL-3.0 of ONLYOFFICE Docs or the MPL-2.0 of the Collabora Online server code) and whether your use requires a commercial edition for embedding, clustering or support. Ask the vendor which edition carries signed security updates, long-term support and a service level, and confirm the supported platform versions. The output is a written selection record with the chosen editor, file platform, edition, user count and support contract, which becomes the basis for the procurement file.
Deploy the stack inside EU infrastructure
The implementation team installs the file platform, the document server and the database in an EU cloud region, your own data centre, or a sovereign provider you have assessed, following the vendor's supported installation method and version matrix. Storage, backups, logs and monitoring stay in the same jurisdiction, and the team confirms that no default telemetry or external content delivery is left enabled. Confirm the supported database and PHP versions before installing and document the exact image or package versions used. The output is a deployment record with the architecture diagram, the component versions and a list of the locations where data is stored.
Restrict WOPI traffic and session controls
The team limits which hosts can reach the WOPI endpoint, restricts the WOPISrc values the editor will accept to known file platform hosts, and enforces TLS on every editing connection. Where the editor runs on several replicas, the load balancer is configured to route all editors of one document to the same instance, as the Collabora Online Helm chart requires for autoscaled or multi-pod setups. Session lifetimes, edit versus view rights, download and print permissions, and sharing links are set per group. The output is a configuration baseline with a tested list of allowed hosts, routing rules and permission matrix, plus test results that show unauthorized hosts are refused.
Decide on the optional AI assistant
The data protection officer, security lead and business owner decide whether an AI assistant may be enabled, which document classes it may see, and whether it may call only a model endpoint you host. Collabora Online 26.04 ships its assistant off by default, and administrators choose the provider and whether it is external or on their own infrastructure, so the decision is a configuration choice rather than a product change. Record the decision, the approved endpoint location, the logging rules and the groups allowed to use the feature. The output is a signed AI decision record, and if the answer is no, the configuration shows the feature disabled and the test evidence confirms it.
Pilot with fidelity tests on your templates
A pilot group edits the organization's own templates, contracts, forms, spreadsheets with complex formulas and presentations, and a sample of documents received from customers and partners. Each file is opened, edited, saved in the Office formats your partners use, and compared against the original in desktop Office, with differences logged by document type. The pilot also tests concurrent co-editing, the session timeout behavior and the access rules from the previous step. The output is a fidelity and access test report with a list of accepted gaps, known workarounds and documents that must stay in desktop Office, signed off by the business owners.
Cut over with retention and exit evidence
Users are moved to the new service in groups, and the old cloud suite is set to read-only or retired according to the migration plan, with documents copied and checksums compared. The team applies the retention rules from the data flow register to versions, backups and audit logs, and confirms that deleted and migrated copies follow the documented schedule. An exit plan records how documents, metadata and configuration can be exported and moved to another provider, using the switching rights the EU Data Act gives customers of data processing services. The output is a cutover record, a retention schedule, an audit log sample and a tested export procedure that the compliance team files with the processing records.

Evidence that supports a sovereignty and transfer assessment

This table maps each piece of evidence a transfer or sovereignty assessment will ask for to the component that produces it and the question it answers. DeployOpen prepares and organizes this evidence inside your environment, but your controller, your data protection officer and any auditor or supervisory authority decide whether it is sufficient. Use it as a checklist to agree record ownership before the build starts.

Evidence item	Producing component	What the assessor will test
Transfer impact assessment inputs	Architecture record and processor register	Whether any personal data, remote view or backup leaves the EEA, and whether third-country law could compel access
Processor and sub-processor register	Contracts and hosting provider records	Every entity that can reach document content, including support staff and managed hosting providers
Hosting location records	Infrastructure inventory (cloud region, data center or on-premises site)	That the document server, storage, database and logs run only in the locations you have approved
WOPI host allow-list	Nextcloud or other WOPI host configuration and Collabora or ONLYOFFICE server settings	That only known hosts can open editing sessions, so no unapproved platform can start a session against your document server
Access and admin audit logs	Nextcloud audit logging, editor server logs and central log store	Who opened, edited and downloaded a document, and who changed editor or storage settings
Support access approvals	Written support procedure and access request records	That remote access from outside the EEA is blocked or approved case by case, with a record of each approval
AI setting records	Collabora Online 26.04 configuration and assistant provider settings	Whether the optional assistant is off, which provider it uses, and whether that endpoint is inside your infrastructure
Backup location and encryption records	Backup tool configuration and key management records	Where backup copies sit, who holds the encryption keys and whether restores stay inside the EU
Switching and exit plan under the Data Act	Documented export formats and migration runbook	That you can move documents and settings to another provider or on-premises infrastructure within the notice and transition periods

What EU teams ask before hiring help with sovereign document editing

What drives the cost of self-hosted document editing for an EU team?

The cost depends on scope, user count, file platform integration, the support edition and the hosting work. Most of the spend is labor: planning the data flows, deploying the editor and document server, wiring it to your file platform through WOPI, testing fidelity on your own templates, and documenting the result. Recurring costs include infrastructure in your own cloud or data center, the editor subscription or support plan if you choose a supported edition, and ongoing patching and upgrades. The free Collabora CODE edition is not recommended for production by its vendor, so ask every quote to separate the one-time build from the recurring support and maintenance lines.

Can our internal team run EU document editing without outside help?

A capable platform team can run it alone if it already operates containers, reverse proxies, a file platform and identity integration. The harder parts are usually not the install. They are restricting WOPI traffic to known hosts, sizing editor pods, setting up sticky routing so all editors of one document reach the same pod, testing Office format fidelity, and keeping the legal record of where personal data flows. Before deciding, check whether your team has time for ongoing upgrades and security updates, since Nextcloud and the editor each publish releases on their own schedules.

How long does a sovereign document editing project usually take?

The duration depends on the number of users, how many systems the editor must connect to, how much your templates need format testing, and how fast your data protection and legal reviews move. No single timeline applies across these variables, so DeployOpen agrees a fixed scope and timeline in writing before work starts. Ask any partner to break the plan into discovery, build, testing, cutover and handover, and to name which steps depend on your legal or DPO sign-off. Those approval steps often set the pace more than the technical work.

What do we need to provide for a sovereign editing engagement?

You need to provide a data map, input from your legal team and data protection officer, and access to the infrastructure where the platform will run. The data map should show which document types contain personal data, which groups edit them, where the file store sits, and which third parties can see editing sessions. Legal input is needed to confirm transfer conditions and the role of each processor. Infrastructure access covers the cloud accounts, data center networks or Kubernetes clusters where the editor and document server will be deployed, along with DNS, certificates and identity provider settings.

Do we need Collabora Enterprise or Nextcloud Enterprise for EU hosting?

Not necessarily. Hosting on your own EU infrastructure does not require a paid edition. The paid editions change what you receive: support hours, maintenance windows, long term support, signed security updates and customer portal access. Collabora's Business plan is listed at 3 euros per user per month for up to 99 users, and Nextcloud Enterprise is sold in tiers with a 100-user minimum, with list prices starting at 71.29 euros per user per year for Standard. Decide based on the support obligations your regulator, customers and internal risk process expect, and confirm current prices directly with each vendor.

Does an EU-hosted editor remove the need for a transfer assessment?

No. Hosting in the EU narrows the transfer question but does not eliminate it. Under EDPB Guidelines 05/2021, remote access from a third country, even only displaying data on a screen for support, counts as a transfer, so vendor support staff and any US-based service providers still need review. The guidelines also say that using an EU processor subject to third-country law is not itself a transfer, but complying with a third-country authority request would be, so you should assess that exposure before engaging the processor. Document the answer for each vendor and support path.

What should we check in a partner's proposal before signing?

Check that the proposal names the editor, the file platform, the hosting location, every support path that could expose data, and the owner of each upgrade and patch. Ask how the partner handles WOPI host restrictions, sticky routing, backup of the document store, and the audit trail of who edited what. Confirm which parts are fixed-scope deliverables and which are retainers for ongoing support. DeployOpen plans, implements, hardens and documents self-hosted platforms in your own infrastructure, and does not issue audit reports or certifications, so ask your independent auditor to confirm the evidence you will need.

Questions to ask an implementation partner about EU editing

Start with location, because it decides whether the design is an EU transfer question at all. Ask the partner to name every host that touches a document or an editing session: the document server, the storage back end, the WOPI host, the database, backups, logs, and any AI endpoint. For each, ask which country and which legal entity operates it, and whether any support session, including remote troubleshooting, can display data from outside the EU. EDPB Guidelines 05/2021 treat remote viewing from a third country as a transfer, so a support engineer working from abroad is part of your data map. Ask for the answer as a written component list, not a verbal assurance, and ask how the partner will prove the list stays current after each change.

Next, ask how remote access is restricted and logged, and how updates reach an environment that may have no direct internet path. Ask which administrative accounts can reach the editor and storage hosts, whether access is time-limited and approved per session, and where session records are kept. For updates, ask how packages and container images are verified before they cross into the environment, who holds the signing keys, and how the partner would apply a security update in an EU-only network without a path back to a public registry. Ask for the actual procedure with its roles, not a summary. Also ask for the Collabora or ONLYOFFICE support edition in writing, since the supported build determines which security fixes you receive.

Finally, ask for the evidence package your DPO and auditors will receive, and how the design supports a switching path. Ask for a fidelity test on your own templates, covering the Office files you exchange and the formats you must keep, with results recorded per file type and a list of known differences. For the Data Act, ask how the design keeps data exportable in open formats, which configuration exports documents and metadata, and how a move to another provider or to on-premises infrastructure would be executed within the notice and transition periods the regulation sets. Ask for data flow diagrams, the access and change logs, the backup and restore records, and a written statement of the controls you own versus the ones the partner operates. DeployOpen prepares this evidence for assessment, but independent auditors and your own legal team decide whether it meets your obligations.

Integration points and deployment pattern for EU-only editing

Keeping editing sovereign depends less on the editor itself than on the systems around it: where the document server runs, how it is reached from the file platform, and where content, logs and support sessions end up. Each card below is a point where data can leave the EU, and each has a check to run in your own environment before go-live.

EU-located hosting

The document server, the file platform and any AI endpoint should run in EU data centers that you or your processor control, in accounts you can audit. Browser editing sends document content to the editor on every keystroke, so the editor's location matters as much as the storage location. Confirm the physical region of every compute node, load balancer and managed service, including the regions used for failover and snapshots.

File platform with identity integration

The file platform, such as Nextcloud, holds the document and decides who may open it, so it is the first control point for access. Connect it to your directory through LDAP, OpenID Connect or SAML so that editing rights follow your existing joiner and leaver process. Confirm that revoked users lose editing sessions, not only new logins, and that guest accounts cannot reach the editor.

WOPI connection with host allow-listing

WOPI is the protocol that lets the file platform hand a document to the editor and receive changes back. Restrict which hosts can call the editor and which hosts the editor can call back, so that traffic stays on the internal network and the EU-hosted file platform. Confirm the allow-list in the editor configuration, and test that a request from an unlisted host is refused.

Storage and backup location

Document files, version history, thumbnails and backups are copies of personal data, and each one is a possible transfer if it lands outside the EEA. Keep object storage, databases and backup repositories in EU regions, and encrypt backups with keys held inside the EU. Confirm that cloud snapshots, replication targets and offsite copies are included in the data map, and that restore tests run in the same jurisdiction.

Logging and SIEM

Access logs, editing session events and administrator actions show who opened which document and when, which supports both accountability and breach investigation. Send these logs to a SIEM you host in the EU, and set retention to match your records policy rather than the default of the cloud product. Confirm that log entries do not store document text, and that log shipping does not cross a border you have not assessed.

Support access controls

Vendor and integrator engineers who troubleshoot the editor may view document content on screen, and under the EDPB's guidance remote viewing from a third country is itself a transfer. Require named accounts for support, just-in-time elevation, session recording and approval before any screen share. Confirm where support staff sit, and what contract clauses cover their access.

How DeployOpen scopes and supports sovereign document editing

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For document editing, that means the editor, its document server and the storage behind them run where you decide, with the work agreed in writing before it starts.

How we scope

Map every place document content and editing sessions travel, including browser traffic to the editor and any WOPI callbacks
Record which storage, editor and AI components sit in the EEA and which operator controls each one
Agree in writing whether an optional AI assistant is off, restricted to a self-hosted endpoint, or excluded entirely
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts; ongoing support is available as a retainer

How we build

Deploy the chosen editor and file platform in your EU infrastructure with no hidden external calls to public services
Configure WOPI host allowlists so only known file platform hosts can open documents in the editor
Set up access controls, audit logging and version retention that match your transfer and records assessment
Test Office format round trips and fonts on your own templates before rollout, and document the results

How we hand over

Deliver architecture diagrams showing data flows, hosting locations and sub-processors for your records of processing
Provide runbooks for updates, backups, restores and rotating editor and storage credentials under your control
Document the evidence your auditors or assessors will ask for, such as configuration baselines and access reviews
Train your administrators on what to log, what to restrict and how to verify that traffic stays inside the boundary

How we support

Apply security and maintenance updates to the editor and file platform on a schedule agreed in the written scope
Re-check data flows and sub-processor lists after each upgrade or change in the editing stack
Keep the configuration baseline current so compliance evidence stays accurate between assessments
Review new AI features or external integrations before they are enabled, and confirm the decision in writing