1. Introduction

Almost every organization we meet runs its working life inside Microsoft 365. The files are in OneDrive and SharePoint, the mail and calendars in Exchange Online, the meetings in Teams, the documents in Word, Excel and PowerPoint, and increasingly the assistant in Copilot. It is a capable, integrated suite, and for many organizations it is a reasonable choice. We are not here to pretend otherwise. We are here to argue that for a large and growing class of organizations it is no longer the right choice, and that there is now a serious alternative that too few leaders have properly considered.

This is a position paper, and the position is plain: for organizations that care about controlling their own data, their own costs and their own roadmap, Nextcloud is the Microsoft 365 alternative we recommend, and migrating to it is a solved problem when it is run as a project. We hold this position not as open-source ideologues but as a practical IT partner that has watched the cost, the dependency and the legal exposure of the big cloud suites grow year on year, while the open alternative has quietly become good enough, and in the ways that matter most to a European organization, better.

Two things have changed. The first is that the case against renting your entire workplace from a single foreign vendor has sharpened: subscription costs compound, lock-in deepens with every integration, and the data sits under legal regimes that a European organization does not control. The second is that Nextcloud has matured from a file-sync tool into a complete collaboration platform, files, communication, groupware and online office, that an organization can host where its own law reaches and extend as it likes. Put those together and the question is no longer whether a credible alternative exists, but how to move to it without disrupting the people who do the work. That second question is the one this paper, and Nashua’s offer, is really about.

We proceed in the open. Section 2 sets out why organizations are looking past Microsoft 365. Section 3 says what Nextcloud is and why we back it. Section 4 maps the two suites against each other, honestly. Sections 5 and 6 make the sovereignty and the cost cases. Section 7 is candid about where Microsoft is still ahead and what you take on by leaving. Sections 8 to 9 are the practical core: how Nashua implements, migrates, supports and, above all, manages the human change. Section 10 answers the objections we hear most, and Section 11 is a call to act.

2. Why organizations are looking past Microsoft 365

The discontent is rarely about features. It is about control, and it has four strands.

Cost that only goes up. A per-seat subscription is predictable until it is not. List prices rise, the useful capabilities migrate into the higher tiers, and the newest value, the AI assistant above all, arrives as yet another per-user add-on. An organization that has standardized on the suite has no leverage in that conversation, because the cost of leaving is exactly what the pricing counts on. The bill is an annuity to the vendor, and it is designed to grow.

Lock-in that deepens with use. The suite is integrated, which is its great convenience and its great trap. Every workflow built on SharePoint, every automation in Power Automate, every identity wired through Entra, every document whose formatting assumes Microsoft’s renderer, raises the cost of ever leaving. Lock-in is not a clause in a contract; it is the accumulated weight of a thousand small dependencies, and it is the product working as intended.

Data under someone else’s law. This is the strand that has changed most, and it matters most to a European organization. When your files, mail and documents live in a US-headquartered provider’s cloud, they are reachable, in principle, by US legal process regardless of where the data center sits, under the CLOUD Act (2018). The Court of Justice of the European Union made the tension explicit when it struck down the EU–US Privacy Shield in the Schrems II judgment (Case C-311/18, 2020), and the European Data Protection Board’s supplementary-measures guidance (EDPB, 2021) has kept the question live ever since. For organizations bound by the GDPR (Regulation (EU) 2016/679), and increasingly by sector and security rules such as the NIS2 Directive (Directive (EU) 2022/2555), “where does the data actually live, and whose courts can reach it” is no longer a theoretical question.

A roadmap you do not steer. Features arrive, change and are retired on the vendor’s schedule, not yours. Interfaces are redesigned, defaults are changed, AI is switched on, and the organization adapts, because it has no other option. You are a tenant in a building whose landlord keeps renovating.

None of this makes Microsoft 365 a bad product. It makes it a rented product, and rent, paid forever, on terms you do not set, over data you do not fully control, is a poor foundation for an organization that wants to own its future.

3. Our position: Nextcloud

Nextcloud is an open-source collaboration platform, licensed under the AGPL, that an organization can run on its own servers or on hosting it chooses, in its own country, under its own law. It began as file sync and share, the open answer to OneDrive and Dropbox, and has grown into what its makers call a Hub: files, real-time communication, groupware and an integrated online office, in one coherent platform that a user signs into once.

What it offers, in the terms that matter to a workplace:

• Files. Sync-and-share across desktop, web and mobile, with sharing, versioning, team folders and external collaboration, the direct replacement for OneDrive and SharePoint document libraries.

• Communication. Nextcloud Talk provides chat, voice and video calls and screen sharing, self-hosted, the place Teams occupies in Microsoft’s world.

• Groupware. Calendar and contacts natively, on the open CalDAV and CardDAV standards, and mail through Nextcloud’s mail app paired with a standards-based mail server, together covering the Exchange and Outlook functions.

• Online office. Real editing of Word, Excel and PowerPoint documents in the browser, through an integrated office engine, Collabora Online or ONLYOFFICE, so that .docx, .xlsx and .pptx files are created and edited in place rather than exported.

• Extensibility. An app ecosystem and an open API, so the platform can be extended, integrated and automated by the organization itself rather than only by the vendor.

We back Nextcloud specifically, out of the wider open-source field, for three reasons. It is complete: it covers the whole working surface, not one corner of it, so it can be the platform rather than a point tool. It is sovereign by construction: because you host it, the data is where you put it and the keys are yours. And it is proven at scale, including in demanding public-sector environments across Europe that have chosen it precisely to regain control of their digital workplace. It is not a toy, and it is not a compromise made only to save money; it is a different, and for many organizations a better, way to own the tools people work in.

4. Does it really replace Microsoft 365?

The fair question any decision-maker asks is whether the alternative actually does the job. Our honest answer is: for the work that most people do most of the time, yes, and we will be equally honest in Section 7 about where it does not. Table 1 maps the suites component by component.

The point of the table is not that every box is a perfect like-for-like, it is that the working surface an ordinary employee touches in a day, open a file, co-edit a document, send mail, check the calendar, join a call, chat with a colleague, is covered. Most people are not power users of any single application; they are users of a workplace, and that workplace Nextcloud provides.

5. The sovereignty case

For a European organization this is, in our view, the decisive argument, and it is the one Microsoft cannot answer by adding a feature.

When you self-host Nextcloud, or have it hosted for you in the Netherlands or elsewhere in the European Union, the data physically and legally lives where you chose to put it. There is no foreign parent company that can be compelled to hand it over, no transfer mechanism to document and defend, no dependence on the current state of a transatlantic adequacy arrangement that has twice been struck down. The GDPR question “where is the personal data and who can access it” has a simple, demonstrable answer. For organizations facing NIS2 and sector-specific obligations, that demonstrability is not a nicety; it is the compliance position itself.

This is why so much of the momentum behind Nextcloud and the wider sovereign-workplace movement has come from European public administrations, which are both acutely bound by these rules and unwilling to make their core operations permanently dependent on a single non-European vendor. The examples are concrete and multiplying: Germany’s public administration has built a sovereign workplace, openDesk, that uses Nextcloud for its files (ZenDiS, 2024); the state of Schleswig-Holstein is migrating its administration off Microsoft to open source, Nextcloud included, having already moved tens of thousands of mailboxes (Land Schleswig-Holstein, 2025); France’s Ministry of Education runs a Nextcloud-based file platform for several hundred thousand users (French Ministry of Education, 2025); and the European Data Protection Supervisor hosts Nextcloud for its own institution. These are not gestures by the indifferent; they are deliberate choices by organizations that are heavily regulated and determined to keep control of their own information, and Nextcloud’s file platform has been independently security-certified for government use, holding France’s ANSSI CSPN certification (Nextcloud, 2024). The same logic applies to any organization that handles sensitive data, answers to a European regulator, or simply judges that control of its own information is a strategic asset rather than an IT detail. Sovereignty is not anti-American and it is not nostalgia; it is the plain proposition that an organization should be able to say where its data is and who can reach it, and mean it.

6. What it costs, and what it saves

The economics follow from the ownership. A Microsoft 365 subscription is an operating cost that recurs per user, per month, forever, and trends upward. A Nextcloud platform is mostly a different shape of cost: hosting (your own or a provider’s), and the support and operations to run it well, with no per-seat license to the platform itself, because the platform is open source.

We are careful not to oversell this. Running a platform is not free; it trades a license fee for an operational responsibility, and that responsibility has a real cost, which for most organizations is best met by a partner rather than hired in. But the shape of the cost is fundamentally healthier: it is predictable, because it is not a per-seat annuity that grows with every price rise and every new add-on; it is under your control, because you choose the hosting and the scale; and it does not punish success, because adding users does not multiply a license bill. For an organization of any size, the total cost of ownership over a few years is frequently lower, and, more importantly, it is yours to manage rather than the vendor’s to escalate.

7. The honest trade-offs

A position paper that pretended the alternative were perfect would deserve no trust, so we are plain about the costs of our own recommendation.

The deep end of Office. For the power user who lives in advanced Excel, macros, pivot tables, the most intricate formulas and add-ins, or in the most elaborate PowerPoint, Microsoft’s desktop applications remain ahead of any browser-based editor, Collabora and ONLYOFFICE included. Most organizations have relatively few such users, and they can be accommodated, but it is a real gap and we name it.

The ecosystem and the integrations. Microsoft 365 sits in a vast ecosystem of third-party integrations and in-house habits. Some of those connections have a direct Nextcloud equivalent; some need rebuilding; a few will be retired as not worth keeping. That assessment is part of the work, not a surprise to be discovered later.

The operational responsibility. Self-hosting means someone is responsible for uptime, updates, backups and security. That is precisely the responsibility a managed service exists to carry, and it is the core of what Nashua provides, but it is real and it must be resourced, not wished away.

Familiarity. People know Microsoft. A new environment, however capable, is unfamiliar on day one, and unfamiliarity felt by hundreds of people is the single largest risk in any such move. It is not a software problem; it is a change-management problem, and Section 9 is about how we solve it.

None of these is a reason not to move. Each is a reason to move deliberately, with a partner who has seen them before.

8. How Nashua implements and migrates it

Our position would be empty advocacy if leaving Microsoft 365 were a leap in the dark. It is not. Done properly it is a project with well-understood phases, and Nashua runs the whole of it, so that the organization gets the destination without having to become an expert in the journey. Figure 1 shows the shape of an engagement.

Assess. We begin by understanding what you actually have and use: the data in OneDrive and SharePoint, the mail and calendars, the workflows and integrations, the identity setup, and the handful of genuine power-user cases that need special handling. The output is a clear picture of what moves cleanly, what needs rebuilding, and what can be retired, with no surprises left for later.

Pilot. We stand up a real Nextcloud platform, hosted where you want it, and run a pilot with a representative group. The pilot proves the platform in your environment, surfaces the real adoption questions early, and gives the organization something concrete to see rather than a promise to trust.

Migrate. We move the data, files from OneDrive and SharePoint, mail, calendars and contacts from Exchange, in waves, with structure and permissions preserved, verified as it goes, and with the old and new worlds kept compatible during the transition so that nobody is stranded mid-move. Migration is the part organizations fear most and the part that is, in fact, the most routine when it is done by people who have done it before.

Adopt and Run. The platform goes live for real, and then it is operated: hosted, patched, backed up, secured and supported under a service agreement, so that the organization has a workplace that simply works and a single accountable partner when it does not. Underneath every phase run the two bands of Figure 1, technical support and change management, which are the subjects of the next section, because they are what turn a migration into a success.

Where it runs. The same platform can sit wherever your sovereignty and operational needs put it, and we deploy and operate it across the whole range. We can host it for you in the Netherlands or elsewhere in the European Union; we can run it inside your own cloud tenancy; or, when you want the data physically within your own walls, we can roll it out entirely on-premises, on your own hardware in your own server room. For that on-premises case our preferred pattern is Nextcloud running on a Coolify server, an open-source, self-hosted application platform that gives us clean, repeatable deployments, updates and backups without tying you to any vendor’s cloud, provisioned on Dell PowerEdge server hardware sized to your user count and growth. You own the machines, the data never leaves the building unless you decide it should, and Nashua still carries the operation, the patching, monitoring, backups, security and support, under the same service agreement. It is sovereignty by physical location, run by people who do it for a living.

9. Change management: the part that decides success

We put this in its own section because it is where these projects are won or lost, and where, in our experience, they are most often under-resourced. The software can be flawless, the migration perfect, the hosting impeccable, and the project can still fail, because the people did not come with it. A workplace is not a set of applications; it is the daily habits of everyone who uses it, and changing habits is harder than changing software.

So Nashua treats adoption as a discipline, not an afterthought. We communicate early and plainly, so that people hear the why and the when from a clear source rather than the rumor mill. We train for the tasks people actually do, in their own context, rather than handing out a manual. We identify and support champions inside the organization, the respected colleagues whose everyday use and encouragement move a team faster than any memo. We phase the rollout so that confidence is built group by group rather than gambled on a single switch. We listen, through the pilot and through launch, and we fix the friction that early users find before it hardens into resentment. And we are honest with people that a new tool is unfamiliar for a short while and then simply becomes the way they work.

The measure of success is not that the migration completed; it is that, some weeks later, people reach for the new workplace without thinking, and would not want to go back. Getting an organization to that point is not a by-product of the technical work. It is the work, and it is as much a part of what Nashua delivers as the platform itself.

10. Objections and replies

“Our people only know Microsoft.” Today, yes, and that is a change-management fact, not a software verdict. The everyday actions, open a file, write a document, send mail, join a call, are the same actions in a different place, and with proper communication, training and champions, people cross that gap quickly. The familiarity of Microsoft is real; it is also exactly what a good adoption program is designed to transfer.

“Self-hosting is risky.” Running infrastructure badly is risky; running it well, with a competent partner carrying uptime, updates, backups and security under an agreement, is not riskier than depending on a single foreign vendor whose outages, price changes and roadmap you also do not control. The question is not risk versus no risk; it is which risks you would rather hold and be able to manage.

“Nextcloud isn’t as polished as Microsoft.” In a few deep corners, that is fair, and Section 7 named them. Across the working surface that most people use all day, the gap is small and shrinking, and for most organizations it is comfortably outweighed by control, cost and sovereignty. Polish in a feature you never use is worth less than ownership of the tools you use constantly.

“This is an open-source crusade.” It is not. We are a practical IT partner recommending the option we believe serves a particular kind of organization best, and being candid about which organizations that is and where the trade-offs lie. Where Microsoft 365 is genuinely the better fit, we will say so. For the organization that wants to own its workplace, we recommend Nextcloud, and we can deliver it.

11. Conclusion: own your workplace

The digital workplace is too important to rent indefinitely from a single foreign vendor on terms you do not set, over data whose location and legal reach you do not fully control. For a growing class of organizations, and in our firm view for most European organizations that handle sensitive data or value their independence, there is now a serious, complete and proven alternative, and it is Nextcloud. It covers the work people actually do, it keeps the data where your own law reaches, it replaces a compounding per-seat rent with a cost you control, and it hands the roadmap back to you.

The reason more organizations have not moved is not that the alternative is inadequate; it is that leaving feels hard. It is not, when it is run as a project by people who have run it before. That is Nashua’s offer, and the whole of it: we assess what you have, pilot the platform in your environment, migrate your data out of Microsoft 365, host and support and secure the result, and, above all, lead the human change so that your people adopt the new workplace rather than merely tolerate it. Own your collaboration, your data and your costs. We will help you do it, and we will stay to run it. Talk to us.

References

Court of Justice of the European Union (2020). Data Protection Commissioner v Facebook Ireland Ltd and Maximillian Schrems (“Schrems II”), Case C-311/18, judgment of 16 July 2020, ECLI:EU:C:2020:559. https://curia.europa.eu/juris/liste.jsf?num=C-311/18

United States Congress (2018). Clarifying Lawful Overseas Use of Data Act (CLOUD Act), enacted as part of the Consolidated Appropriations Act, 2018, Pub. L. No. 115-141, Division V.

Collabora Productivity (2026). Collabora Online: enterprise-ready online office. https://www.collaboraonline.com/

European Data Protection Board (2021). Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (version 2.0, adopted 18 June 2021). https://edpb.europa.eu/

European Parliament and Council (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union, L 119, 4 May 2016. https://eur-lex.europa.eu/eli/reg/2016/679/oj

European Parliament and Council (2022). Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the European Union, L 333, 27 December 2022. https://eur-lex.europa.eu/eli/dir/2022/2555/oj

French Ministry of Education (2025). Nuage: a Nextcloud-based file-sharing platform for schools (as reported by Computerworld). https://www.computerworld.com/article/4187951/

Land Schleswig-Holstein (2025). Digitale Souveränität: Umstieg der Landesverwaltung auf Open-Source-Software. https://www.schleswig-holstein.de/

Nextcloud GmbH (2026). Nextcloud Hub: documentation and feature overview. https://nextcloud.com/hub/

Nextcloud GmbH (2024). ANSSI CSPN and BSI IT-Grundschutz security certifications. https://nextcloud.com/blog/

Ascensio System SIA (2026). ONLYOFFICE Docs: online document editors. https://www.onlyoffice.com/

Zentrum für Digitale Souveränität der Öffentlichen Verwaltung (ZenDiS) (2024). openDesk: the sovereign workplace for public administration. https://opendesk.eu/