Why file sharing after a merger or acquisition is a different job
Consolidating two file estates after a merger or acquisition is a sequencing job before it is a software job. The buyer should move both companies onto one self-hosted platform in phases, starting with an inventory of what exists and a single identity layer that both estates can authenticate against. Nextcloud is the default candidate because it covers sync, sharing, external storage and office integration under one administrative model. Seafile is the better fit where library-based sync is the priority. The first weeks after close are about knowing what data exists, who owns it and which regulators apply to it, not about moving files.
Regulatory obligations decide the order of work. The SEC staff allow management to leave a newly acquired business out of its internal control assessment for up to one year, but only with disclosure, and the IT general controls over access to programs and data that support financial reporting still need documenting, so the access model for the acquired estate must be written early (SEC staff FAQ on management's ICFR report). In the EU, NIS2 entities must report changes to their competent authority within two weeks, and DORA requires financial entities to keep a register of ICT arrangements and tested exit strategies. Under EDPB Guidelines 05/2021, remote access to EU personal data from a third country is a transfer, so acquirer staff should not reach target systems until a transfer tool is in place. If the target holds ePHI, a business associate contract under 45 CFR 164.314(a) must be in place before any hosting partner handles it.
The transition service agreement sets the clock. Until its end date, each company's data must stay separated while the other side still depends on shared services, so the first build decisions are the tenant or instance boundaries, group-based access and an audit trail for each estate. Ask any implementation partner to show how these boundaries are documented, which evidence each control produces and who signs off on the permission mapping. DeployOpen plans, implements and hardens self-hosted platforms inside the client's own infrastructure and prepares controls and evidence for compliance assessments. It does not issue audit reports, attestations or certifications; the independent auditor or certification body does that work.
Which obligations change the consolidation plan
This table lists the regulatory duties that apply while two companies' file storage is being combined, with the source for each and what it means for the build. Read each row as a question to answer before permissions are mapped and migration waves are scheduled, because several duties set deadlines or evidence requirements the consolidation must meet.
| Obligation | What the source requires | What it means for the build |
|---|---|---|
| SEC acquisition exclusion from ICFR | Management may exclude a newly acquired business from its ICFR assessment, but not beyond one year from the acquisition date or from more than one annual report, and the exclusion and its significance must be disclosed (SEC ICFR FAQ, Question 3). | Set a dated plan to bring the target's financial file repositories under the acquirer's access and change controls inside that window, and record which folders hold financially relevant records. |
| IT general control areas (Release 33-8810) | Release 33-8810 names program development, program changes, computer operations and access to programs and data as example ITGC areas, limited to controls addressing financial reporting risks. | Document who can change the platform configuration, who can grant access to finance folders, and how migration changes are approved and logged before cutover. |
| Form 8-K Item 1.05 and third-party oversight | SEC registrants must file Item 1.05 for a material cybersecurity incident, generally within four business days after materiality is determined, and describe oversight of third-party service provider risk (17 CFR 229.106). | Agree incident escalation paths with any hosting or migration partner so the acquirer can meet the four-business-day clock, and log which vendors touch target data. |
| DORA register and exit plans | Financial entities must keep a register of ICT service arrangements (Article 28(3)) and tested exit strategies and transition plans for services supporting critical or important functions (Article 28(8)). | Record the target's existing cloud drives and file servers as arrangements to be retired, and keep a documented exit path for the TSA-hosted platform during the transition. |
| NIS2 change notification | Entities must give their competent authority contact details, IP ranges, sector and service Member States, and notify changes without delay and within two weeks at most (Directive (EU) 2022/2555, Article 3(4)). | Track changes to domains, IP ranges and legal names created by the merger, and build the notification step into the cutover checklist. |
| EU Data Act switching rights | Data processing providers must support switching to another provider or on-premises infrastructure, with a maximum two-month notice period, a 30-day transitional period, porting of exportable data and no switching charges from 12 January 2027 (Regulation (EU) 2023/2854, Articles 23, 25 and 29). | Confirm the notice and porting terms in the target's cloud drive contracts before deciding which data leaves the vendor, since these terms set how fast files can be moved out. |
| EDPB transfer rules for acquirer staff | Remote access to EU personal data from a third country, including for support or administration, is a transfer under EDPB Guidelines 05/2021, so it needs a Chapter V transfer tool. | If non-EEA acquirer administrators or engineers can open EU target folders, document a transfer mechanism or restrict access to EEA-based staff before granting it. |
| GDPR Article 28 instructions for TSA processing | Processors act only on the controller's documented instructions, including for transfers (Article 28(3)(a)), and records of processing describe Article 32 measures where possible (Article 30). | Write the TSA data instructions covering who may process target files, where, and for which migration tasks, and update the records of processing to name the consolidated platform. |
| HIPAA business associate terms | A business associate contract must require Security Rule compliance, flow terms to subcontractors handling ePHI, and require reporting of security incidents to the covered entity (45 CFR 164.314(a)). | Confirm that any partner, hosting provider or TSA party that handles target ePHI is covered by a business associate contract before migration begins. |
| PCI DSS validation | Payment brands, not the PCI SSC, decide which entities must comply and validate, and validation uses official templates such as a Report on Compliance or Self-Assessment Questionnaire with an Attestation of Compliance (PCI SSC FAQs 1004 and 1220). | Ask the payment brands or acquirer which entities and environments are in scope, because card data found in target file shares changes the segmentation and evidence plan. |
What to inventory in Google Drive, OneDrive and file servers before moving anything
The inventory is the first deliverable in any file consolidation, because every later decision (permission mapping, migration order, regulatory scope) depends on knowing what exists. Start by enumerating every source: Google Drive shared drives and personal My Drive folders, OneDrive for Business accounts, and Windows file server shares. For each, record the owner, the size, the number of files, the last modified date and the sync clients that touch it. Personal drives matter as much as shared ones, because in an acquisition they often hold the only copy of working documents. Ask each platform's administrator for an export of ownership and sharing metadata, and confirm what that export includes in your own tenant, since the available fields differ between Google Workspace and Microsoft 365 editions.
Two surprises appear in almost every inventory. The first is owner-less folders: content whose creator has left the target or the acquired company, or whose account was deleted, so no one can approve its move or its deletion. Assign a business owner to each one before migration starts, or freeze it. The second is stale external links: public or guest links that still resolve, sometimes years old, pointing to contracts, pricing or patient records. Export every link with its audience, expiry and last access, and treat any link without an expiry as a finding. Also capture legal hold and retention settings in each source, since a hold that exists in one platform may not be visible from the other.
The inventory then drives three decisions. It feeds permission mapping, because NTFS permissions on file servers, Google sharing and OneDrive roles must be translated into one model before anything moves. It identifies which files fall under DORA, GDPR or HIPAA scope by flagging folders that hold client, cardholder or patient data, and that tagging should be reviewed with compliance staff rather than inferred from folder names. Finally, it sets the migration waves: low-risk, owned, non-regulated content goes first, and regulated or legally held content goes last, once controls are proven. Confirm with counsel which holds and retention periods apply to the acquired company before any deletion step is approved.
How data stays separated during a transition service agreement
In this model the parent company runs the target's files on its own self-hosted Nextcloud or Seafile under a transition service agreement (TSA). The target is effectively a customer of the parent's platform, so the parent's infrastructure team operates the servers, but the target still owns its data. Separation depends on the contract and on how the platform is configured, not on network location alone.
- Administrator rights: Keep the parent's platform administrators apart from the target's data owners. Grant the target a named data administrator role for its own groups and spaces, and log every use of break-glass or server-level access.
- Group and folder permissions: Create a dedicated group per target entity and mount target shares only inside that group. Confirm that sharing and search cannot expose target folders to parent users who have no business need.
- Documented instructions: Where EU personal data is involved, the parent acts as a processor under Article 28(3)(a) of the GDPR. Its TSA processing instructions must cover storage, support, transfers and deletion, and the target must be able to amend them.
- Audit logs: Logs must show who accessed or changed target data, including administrator actions, and be retained and reviewable by the target. Ask the parent how logs are exported per entity.
- Non-EEA staff access: If an acquirer's staff outside the EEA can reach EU target systems, including for support, that remote access is a transfer under EDPB Guidelines 05/2021 and needs a Chapter V transfer tool.
Before signing, confirm which entity holds each administrator role and how you would test that a parent user cannot open a target folder.
Both companies sit in one Nextcloud instance with separate libraries, groups and sharing rules. This is the fastest route to a single identity and file namespace, but it puts two legal entities on one set of administrators and one database. Separation is entirely logical, so the permission design has to carry the weight.
- Administrator rights: Limit global administrators to a small platform team. Delegate group administration per company so that one side cannot add members to the other side's groups.
- Group and folder permissions: Give each company its own groups and group folders, deny cross-company sharing by policy where the feature allows it, and test with a sample user from each side before go-live. Review default share settings, since open sharing can undo group separation.
- Documented instructions: Each company remains a controller for its own data. The platform team processes both sets of data, so document instructions per company in the processing record and in any intra-group agreement.
- Audit logs: Record access by company, not only by user, so that an auditor can filter one entity's activity from the other's. Confirm the logs cover administrator and sharing events, not only file reads.
- Non-EEA staff access: Shared administration often means one support team sees both companies' data. If that team sits outside the EEA and touches EU personal data, treat it as a transfer and scope its access to the minimum.
Check whether the financial and regulatory duties of each company can be met with logical separation alone, and record that decision.
Each entity keeps its own Nextcloud or Seafile instance until cutover, then data moves into one platform or stays apart. This gives the strongest isolation during the transition but doubles operations and creates a cutover event that must be planned carefully. It also keeps each company's upgrade cycle and evidence separate.
- Administrator rights: Each entity appoints its own administrators. Shared engineers, if any, need individually approved accounts with logging on both instances.
- Group and folder permissions: Separation comes from the infrastructure boundary, so there is no cross-company permission to misconfigure. Review any federation or external storage links between the instances, because they can re-create a path between companies.
- Documented instructions: When one entity's staff migrate files for the other, document the migration as processing on the controller's instructions and record it in each entity's processing register.
- Audit logs: Each instance must produce its own complete audit trail, and the migration tooling must log every copy, including the source and destination identifiers.
- Non-EEA staff access: Integration engineers working across both instances from outside the EEA may access EU data during migration. Treat that access as a transfer and document the transfer tool before the first sync run.
Confirm with the operators of each instance how upgrades are scheduled, since Nextcloud requires one major version at a time, and agree who signs off the cutover.
Which open-source platforms fit a merged estate and why
After a merger, the two companies usually arrive with different storage, identity and licensing positions. The four options below differ mainly in license model, support tiers and whether they can serve as a single target for both estates while the transition service agreement is still in force.
Nextcloud Server community edition
Nextcloud Server is licensed under AGPL-3.0, which makes the code free to run inside the combined company's own infrastructure with no per-user fee for the software itself. For a merged estate, the community edition works as a shared target only if the team can absorb upgrades on its own schedule. Nextcloud publishes a new major version every four months and supports each for one year, and administrators must upgrade one major version at a time with a backup before each step. Confirm who will run those upgrades and which third-party apps your estate depends on before choosing this route.
Nextcloud Enterprise tiers
Nextcloud GmbH sells Nextcloud Enterprise as a paid offering alongside the community version. It is sold in Standard, Premium and Ultimate tiers with a 100-user minimum, so a merged workforce below that size needs to check whether the minimum applies before costing it. Standard includes one year of maintenance, Premium adds a maintenance lifecycle of five or more years and clustered instance support, and Ultimate adds support up to 24/7. The tier choice sets how long the combined company can stay on one major version while integrations are rebuilt. Ask the vendor how the minimum applies across two tenants during a transition.
Seafile under GPLv2
Seafile server is released under GPLv2 with an additional permission to link with OpenSSL, and it is built around library-based sync rather than the app model used by Nextcloud. For a merger, Seafile is a file-sync choice that may suit a narrow scope, such as moving a file server estate, but it does not provide the same office editing, calendar and collaboration surface as a broader suite. Check how it handles the directory integration the acquirer already uses, how permissions from the target's file shares will be represented, and whether the internal team has the skills to support it. Confirm the support model with the vendor before choosing it as the consolidated platform.
ONLYOFFICE Docs or Collabora Online
Browser editing is often the first thing users notice after a merger, because Word, Excel and PowerPoint files from both estates need to open and change in one place. ONLYOFFICE Docs is licensed under AGPL-3.0 and Collabora Online source code is under MPL 2.0, and both are built to edit Office Open XML formats. Test both on samples from each company, because formatting, macros and external links behave differently across editors. Confirm how each editor connects to the chosen file platform, how its license applies if you modify it, and which edition the support contract covers.
How identity, legacy shares and audit logging connect to the platform
After a merger, the new platform has to authenticate two directories, keep legacy shares reachable while users move, and produce audit evidence from day one. Each integration point below has a distinct deployment pattern, and each depends on the edition and installation method you choose.
Directory consolidation through LDAP
Nextcloud's LDAP app lets Active Directory users appear in the instance and sign in with their directory credentials. In a merger, the practical question is which forest or domain becomes the source of truth, and whether the second company's accounts are bound read-only during transition. Confirm how group membership maps to Nextcloud groups, how disabled accounts are deprovisioned, and how the bind account is secured and rotated. Identical usernames across two directories are a common collision point, so test them before the cutover.
Federated sign-in with OpenID Connect or SAML
Nextcloud documents OpenID Connect and SAML user authentication backends. Where the two companies run different identity providers, federating both into one login path lets users keep their home credentials while the new company gets a single session policy and MFA enforcement. The decision is which provider issues the authoritative identity and how claims map to groups and quotas. Confirm which backend app your edition supports and whether it is available in your installation method before you commit to a design.
Legacy shares through external storage
During a transition, files still sit on the acquired company's SMB file servers or cloud drives. Nextcloud's external storage can mount those locations so users reach them from the new platform without a bulk copy on day one. Mounted storage keeps the source system's permissions outside Nextcloud's model, so the design must state which share is read-only, which is writable, and who owns the mount configuration. Confirm the supported storage backends and the authentication method for each source with your edition.
Office editing servers
Browser editing of Office files depends on a separate document server connected to the file platform. In a merged estate, both legacy document formats and the editing traffic of acquired staff must reach it, and the server must be reachable only from the internal network if the data is sensitive. Plan one editing service for the combined organization, check which editor each user group can open, and confirm the connector version and certificate trust between the two services with the chosen editing product.
Backup and antivirus in All-in-One
Nextcloud All-in-One is the official installation method and bundles BorgBackup-based backups and ClamAV antivirus alongside caching, PostgreSQL and full-text search. For a merger, this matters because files from two environments arrive with unknown history, and the backup set must cover the migrated data before legacy systems are retired. Confirm the backup target and retention you need, test a restore into a separate instance, and verify that ClamAV scanning covers the upload paths used by acquired users and external mounts.
Audit logging for the combined estate
Audit logs must show who accessed or shared files from both legacy environments, and they must survive the cutover. Regulated acquirers also need evidence for the period when an acquired business sat outside their internal control assessment. Decide where logs are forwarded, how long they are kept, and how they are protected from administrators whose actions they record. Confirm which events the logging app records in your version, whether external mount access is logged, and how log retention maps to your records schedule.
How a phased migration moves two estates onto one platform
The sequence turns two sets of file stores, identities and permissions into one self-hosted platform in controlled waves, with separation kept intact during the transition service agreement. Each phase closes with a signed-off output so the next one starts from evidence, not assumptions.
Inventory both estates and classify the data
Map every source: Google Drive and OneDrive tenants, file servers, mapped drives, local sync folders and any shares held by partners. For each, record owner, size, file count, sharing links, external collaborators and the data classes it holds, including any regulated categories. The working team is the target platform partner with named people from each company's IT and the business units that own the data. Done when every source has an owner, a classification and a retirement or migration decision, and the inventory has been reviewed by both legal teams.
Design the identity bridge and naming rules
Decide how users from each directory will sign in: directory federation through LDAP or Active Directory, OpenID Connect or SAML, or a staged mix. Agree on account naming, group naming, and how duplicate identities across the two companies are matched. The output is a written identity design and a list of exceptions such as shared mailboxes or service accounts. Done when the identity owners of both companies have signed the design and a test login succeeds for a sample of users from each side.
Separate environments under the transition service agreement
Before any data moves, define which tenant, group or instance each company's data lives in, who administers it, and which staff from the selling company may see which data during the transition service agreement. Where a non-EEA acquirer's staff would access EU personal data, document the transfer mechanism before access is granted. The output is an environment and access design, a separation matrix and an administrator roster. Done when access reviews confirm no cross-company visibility beyond what the agreement permits.
Sign off the permission model and mapping
Translate existing sharing into the target model: group-based shares, folder ownership, guest accounts for external parties and expiry rules for links. Each source permission is mapped to a target role, and anything that cannot be mapped is listed for a decision by the data owner. The output is a permission mapping workbook with sign-off from data owners. Done when a sample of folders has been checked by owners and every unmapped permission has a recorded decision.
Run a pilot migration with restore tests
Migrate one department with representative content, including large folders, long file paths, versions and files that Office editing depends on. Run a full restore from backup into a separate environment and compare file counts, checksums and permissions against the source. Confirm that the target version and its database, PHP and web server match the vendor's current system requirements. The output is a pilot report and a tested restore runbook. Done when the restore reconciles and the pilot users confirm their workflows.
Migrate business unit waves and keep legacy read-only
Move business units in waves, each with a freeze, a delta sync, a reconciliation report and a user cutover window. After cutover, the legacy location is set to read-only for a defined period so late changes are caught and users can still retrieve files. Plan the platform version against the Nextcloud release calendar: Nextcloud 33 support ends in February 2027, and Nextcloud does not allow skipping major releases, so the platform is upgraded one major version at a time and backed up before each step. The output is a wave log per unit. Done when each wave's reconciliation is signed by the unit owner.
Decommission legacy stores and retain evidence
Once the read-only period closes and the owners confirm, legacy shares, tenants and sharing links are removed according to the agreed retention policy. Before deletion, retain the inventory, permission mappings, reconciliation reports, restore test results, access reviews and the separation record, since auditors and regulators may ask how data moved and who could see it. The output is a decommissioning record and an evidence archive. Done when the records are stored in the platform's controlled location and the transition service agreement exit is closed in writing.
What auditors and regulators ask for during the integration
This table lists the evidence an ICFR reviewer, a DORA supervisor, a HIPAA assessor or a data protection authority typically asks for during a file consolidation, and which component produces it. Read the owner column first: platform evidence can be exported on demand, while migration sign-offs and contract terms must be filed deliberately.
| Evidence item | Who produces it | What the reviewer checks |
|---|---|---|
| Source inventory of Google Drive, OneDrive and file servers | Migration team | Complete list of repositories, owners, sizes and data classes, with the scope boundary stated |
| Permission mapping from source to target | Migration team, checked against platform group data | Each legacy sharing right traced to a target group, with exceptions approved by the data owner |
| Identity and access review records | Platform (directory and SSO logs) and the identity team | Accounts from both companies reviewed, orphaned or duplicate accounts removed, and approvals dated |
| Separation design under the transition service agreement | Solution design document, agreed with both companies | Tenants, groups and storage kept apart during the TSA, and who can cross the boundary and how that is logged |
| Audit log extracts for migration and admin actions | Platform audit logging | Records of bulk moves, permission changes and admin access, retained for the period the auditor samples |
| Migration sign-off and restore test results | Migration team, with the data owner signing | Row-level or sample-based reconciliation of counts and checksums, plus a dated restore test from backup |
| DPA or BAA terms with the TSA provider | Contract (legal and procurement) | Processor instructions, sub-processor flow-down, incident reporting and transfer terms covering any non-EEA remote access |
| Entry in the register of ICT arrangements | Contract and third-party risk team, fed by the platform inventory | The arrangement recorded at the right consolidation level, with the critical or important function status stated |
| Decommissioning certificate for legacy shares | Migration team, signed by IT operations | Evidence that legacy shares and cloud drives were made read-only, emptied, and removed from access lists on a stated date |
What buyers ask before bringing in a file sharing partner
What does it cost to consolidate file sharing after an acquisition?
The cost is the sum of several components, and only some of them are one-time. The software is either a community edition at no license fee or a paid support subscription, such as Nextcloud Enterprise, whose list prices start at 71.29 euros per user per year for the Standard tier with 100 or more users, with a 100-user minimum (source: Nextcloud pricing page). Storage (disks or object storage), servers, the database and backup targets recur monthly or yearly and scale with the combined data volume. Migration labor is one-time and is paid to whoever performs the inventory, permission mapping and cutover. Administration time recurs. Ask any partner to quote each component separately, state which items are one-time, which recur, and which assumptions about user counts, data volume and support hours sit behind each line. Compare the total against the cloud subscriptions being retired, including any overlap during the transition.
How long does a file consolidation after a merger take?
Duration depends on the drivers, not a fixed number, so ask for a timeline tied to written scope. The main drivers are the total volume of data across Google Drive, OneDrive and file servers, how many shared folders carry inherited or nested permissions, how many identity systems must be joined, how many users need sync clients trained, and how many departments need sign-off before cutover. A consolidation that also keeps two companies separated during a transition service agreement usually adds phases. Ask the partner to show which steps depend on each other, such as identity consolidation before permission mapping, and which steps the client can run in parallel. Any date you are given should map to these dependencies.
What do we need from our own teams during the consolidation?
Three groups carry most of the work. Data owners must confirm which folders are current, which are archival and who approves access for each business unit. The identity team must agree how the two directories will be joined, which account is authoritative for each user, and how groups map to Nextcloud roles. Legal and compliance must sign off on retention, litigation holds and any records that must stay in place. Plan these reviews early, because they gate permission mapping and cutover. Where a regulated obligation applies, such as records retention for broker-dealers under 17 CFR 240.17a-4, compliance should confirm the retention rule before any data is deleted from the source systems.
Can an internal IT team consolidate file sharing without a partner?
An internal team can do it if it has people who have run Nextcloud or Seafile in production, can build and back up the database and storage tier, and can test restores. The skills most often missing are permission mapping across three source systems, directory integration, and upgrade discipline. Nextcloud does not allow skipping major releases, so administrators must upgrade one major version at a time, back up before each upgrade and disable third-party apps until they are confirmed compatible (source: Nextcloud upgrade manual). Nextcloud 33 is supported until February 2027, so any new deployment should target a currently supported major version. Ask a partner which parts of the work it would hand over and which it would leave with your team.
Do we need separate file instances during a transition service agreement?
Separate instances are not always required, but data separation must be designed, not assumed. Options include one instance with separate organizations, groups and storage quotas, or two instances during the TSA that exchange only the data each party is allowed to see. The deciding factors are how strict the TSA's data-access terms are, whether the acquirer's staff will need access to the target's data, and whether the two companies fall under different legal regimes. If a non-EEA acquirer's staff will remotely access EU personal data, EDPB Guidelines 05/2021 treat that as a transfer that needs a Chapter V transfer tool. Ask the partner to document the separation design and how it will be tested.
Is Nextcloud Enterprise support required for a consolidation?
Enterprise support is not required to run a consolidation, but it changes who is accountable for production issues after cutover. The community edition is free to use under AGPL-3.0, and Enterprise adds a paid subscription. Nextcloud sells Standard, Premium and Ultimate tiers, with Premium adding a maintenance lifecycle of five or more years and Ultimate adding support up to 24/7 with response times down to one hour, according to its pricing page. Decide which support level you need by comparing your internal on-call capacity with the outage cost of a shared file system. Ask partners whether their support is included in the implementation scope or sold as a separate retainer.
What should we ask a partner to quote for a file consolidation?
Ask for a written scope that lists each source system, approximate data volume per source as measured by your own inventory, number of users and groups, identity systems to join, and the number of migration waves. Request a separate line for discovery, permission mapping, identity work, migration, testing, cutover, documentation and handover. Ask which items are fixed-scope and which are billed on time, what changes would trigger a new quote, and what the partner needs from your team to keep the schedule. Also ask how the partner validates the migration, including checksums or sample audits of permissions. Finally, request the first-year recurring costs for software support, storage and administration, separately from the one-time migration fee.
Questions to ask an implementation partner before signing
Start with the inventory, because every later estimate depends on it. Ask how the partner will enumerate Google Drive, OneDrive and file server shares across both companies, and whether they will export a per-file or per-folder manifest with owner, size, last modified date and sharing state. Ask which tools they use to crawl Google Drive shared drives and OneDrive for Business sites without relying on a single admin's view, and how they handle files that are shared externally, orphaned by departed employees, or stored in personal drives. Ask who signs off the inventory and what happens to items nobody claims. A partner who cannot describe this step in writing is not ready to scope the migration.
Next, ask how permissions will be mapped across two directories. Request the method for matching groups and nested memberships from each Active Directory or identity provider, the handling of conflicting group names, and whether the partner will recreate shares as Nextcloud groups, team folders or external storage mounts. Ask how they keep the two companies' data separated under a transition service agreement: which tenants, groups, storage quotas and admin roles isolate each side, how the partner proves that a TSA user cannot see the other company's folders, and how the audit log records cross-company access. For any acquirer staff outside the EEA who will reach EU personal data, ask how the partner documents the processor instructions under GDPR Article 28(3)(a) and which Chapter V transfer tool covers that remote access, as EDPB Guidelines 05/2021 treat it as a transfer.
Finally, check the operating commitments. Ask how legal holds and retention rules are carried across the migration without losing version history or deleting files early, and whether the partner will hand over a retention matrix that the company's legal team has approved. Ask how upgrades will be scheduled, since Nextcloud requires one major version at a time with a backup before each step, and what release the partner will start on given the current Nextcloud 35 and 36 schedule, which you should confirm with the partner directly. Request the support tier, response times and named escalation path in writing. Last, ask for the exit plan: export formats, how files, permissions and audit records would be ported if the platform changes, and what a switching notice looks like under the contract.
How DeployOpen scopes and runs a file consolidation
DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure, so a merged company's files can move onto one Nextcloud or Seafile platform that the combined organization controls. Engagements are fixed-scope, and the written scope defines what is inventoried, migrated, documented and handed over.
How we scope
- Inventory every Google Drive, OneDrive and file server location from both companies, with owners, sizes and sharing patterns.
- Map existing permissions to target groups and folders, and record which exceptions need sign-off from each legal entity.
- Agree in writing which data stays separated during a transition service agreement and which data moves to the shared platform.
How we build
- Deploy the file platform in your own cloud accounts, data centers or air-gapped network, with the identity integration agreed in scope.
- Build migration waves by department or legal entity, with checksum comparison and permission verification after each wave.
- Test sharing controls, external link rules, antivirus scanning and restore paths against the documented requirements before users move.
How we hand over
- Document the architecture, permission model, migration log and per-wave evidence so auditors and internal teams can trace each move.
- Deliver a runbook covering upgrades one major version at a time, backup and restore, and decommissioning of the old drives.
- Walk administrators through day-two operations, and record any open items that remain with the client after handover.
How we support
- Offer ongoing support, upgrades and continuous testing as a retainer after the fixed-scope engagement closes.
- Keep scope changes, such as a later acquisition or a retired legacy tenant, under a new written scope agreed before work starts.
- Confirm with the client which support tier, response times and maintenance lifecycle apply before the platform goes live.
