Microsoft 365 is the dominant cloud productivity suite, used by more than 400 million paid users worldwide (Microsoft Investor Relations, 2023). For most organisations, it delivers genuine value: familiar tools, deep integration and a large partner ecosystem. However, for IT managers, CISOs and Data Protection Officers operating under GDPR or sector-specific data residency obligations, the platform presents a structural problem that no contractual addendum fully resolves: your data is processed under US legal jurisdiction.
What Qsentinel offers that Microsoft 365 does not
The core distinction is architectural, not just a matter of certifications. Qsentinel delivers a managed workspace built on Nextcloud Enterprise, layered with post-quantum encryption and hosted either in Switzerland or on your own premises. Each of these elements addresses a specific gap in what Microsoft 365 can offer regulated organisations.
Data residency with legal certainty
Microsoft operates under the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act), which allows US law enforcement to compel Microsoft to disclose data stored anywhere in the world, including EU data centres. The European Data Protection Board has stated clearly that contractual measures cannot substitute for the absence of equivalent legal protection in the destination country. Swiss hosting sits outside this framework: Switzerland is not subject to the CLOUD Act, and EU-to-Switzerland data transfers are permitted under an EU adequacy decision without additional safeguards.
Post-quantum encryption
Microsoft 365 uses current TLS and AES encryption, which is robust against today’s threats. It does not, as of this writing, apply post-quantum cryptographic algorithms at the application layer for customer data at rest. In August 2024, NIST finalised its first three post-quantum standards: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA). Dustin Moody, mathematician on the NIST Post-Quantum Cryptography project, has warned: “Adversaries are already harvesting encrypted data today with the intent to decrypt it once sufficiently powerful quantum computers become available.” For organisations managing long-retention data, trade secrets or patient records, this is not a theoretical concern.
Private AI without data leaving your boundary
Microsoft Copilot processes user prompts and document context on Microsoft’s own infrastructure. This means organisational content is sent to US-controlled servers for inference. A private AI deployment, integrated into a sovereign Nextcloud workspace, runs entirely within the Swiss or on-premise environment. Queries, documents and outputs never cross a legal or physical boundary outside the organisation’s control. For DPOs assessing AI systems under the EU AI Act, this distinction is directly relevant to transparency and data minimisation obligations.
Cost per user: a realistic comparison
Microsoft 365 pricing is well-documented. The Business Standard plan is priced at around EUR 12.50 per user per month (as of 2024), while Microsoft 365 E3, the plan most commonly deployed in regulated enterprise environments, lists at approximately EUR 36 per user per month. These prices do not include advanced compliance add-ons, Azure Information Protection or Defender for Endpoint, which are often required to meet enterprise security baselines.
| Factor | Microsoft 365 E3 | Sovereign workspace (Nextcloud-based) |
|---|---|---|
| Indicative list price per user/month | ~EUR 36 | Varies by deployment; typically EUR 10 to 20 managed |
| Security add-ons required | Often yes (Defender, AIP) | Included in managed bundle |
| Data jurisdiction | US (CLOUD Act applies) | Switzerland or on-premise |
| Post-quantum encryption | Not at application layer | Available |
| Private AI | Copilot (Microsoft cloud) | On-premise inference |
Total cost of ownership calculations should also factor in data migration costs, staff retraining and compliance audit overhead. Organisations that have invested in Microsoft-specific workflows face real switching costs, but these are typically one-time. Ongoing legal risk exposure from jurisdiction issues is a recurring liability.
What happens to your data under each platform
Under Microsoft 365, your data is stored in Microsoft-operated data centres. Microsoft’s Data Processing Addendum governs what Microsoft can and cannot do with that data. However, Andrea Jelinek, Chair of the European Data Protection Board, has noted: “Organisations that rely solely on contractual safeguards for international data transfers are exposed to legal uncertainty that no data processing agreement can fully eliminate.” Microsoft is a US company subject to US law, and no DPA overrides that.
Under a Nextcloud-based sovereign workspace, the data processing chain is fundamentally different. The open-source Nextcloud codebase is auditable. When hosted in Switzerland or on your own infrastructure, you retain full legal and physical control. Encryption keys are held by the customer, not the provider. There is no telemetry sent to a third-party cloud, no training data extracted from your documents, and no dependency on a foreign jurisdiction for law enforcement access.
Frequently asked questions
Is Microsoft 365 compliant with GDPR?
Microsoft holds various certifications and offers a Data Processing Addendum, but transfers of EU personal data to US infrastructure remain subject to GDPR Chapter V requirements and the US CLOUD Act. The legal risk is not eliminated by contractual measures alone, as the EDPB has repeatedly clarified.
What is post-quantum encryption and why does it matter for enterprise workspaces?
Post-quantum encryption uses cryptographic algorithms, such as those standardised by NIST in August 2024 (FIPS 203, 204, 205), that resist attacks from quantum computers. For enterprises, it protects against “harvest now, decrypt later” attacks where adversaries collect encrypted data today to decrypt it in the future.
Can Nextcloud be self-hosted?
Yes. Nextcloud is open-source and can be deployed on your own infrastructure, in a private data centre, or through a managed provider. This gives organisations full control over the physical and legal location of their data.
What does Swiss hosting mean for data protection?
Switzerland is not an EU member state but has an adequacy decision from the EU Commission, meaning data transfers to Swiss processors are permitted under GDPR without additional safeguards. Swiss law does not fall under the US CLOUD Act, providing a meaningfully different legal environment compared to US-based cloud services.
How does private AI in a sovereign workspace differ from Microsoft Copilot?
Microsoft Copilot processes prompts and context through Microsoft’s cloud infrastructure, meaning organisational data is sent to and processed on US-controlled servers. A private AI deployment running on Swiss-hosted or on-premise infrastructure ensures that queries, documents and outputs never leave the organisation’s legal and physical control boundary.
Hoe Qsentinel dit oplost
Qsentinel is the managed Nextcloud Enterprise workspace, enhanced by Qsentinel with post-quantum encryption and sovereign private AI, hosted in Switzerland or on-premise, out of reach of the CLOUD Act.