Comparisons
Microsoft 365 remains the sound choice when your lines of business genuinely use the breadth of the suite. A solution operated in Europe becomes the sound choice when you want a European company to hold your emails and files, and your usage fits within a narrower scope. Both statements can be true at the same time, for two different departments of the same company.
Each of the following points is a rational reason to stay, at least for part of the company.
A “sovereign solution” that promises the same scope without reservation is overselling its product. European and Swiss suites cover email, files, video and sometimes chat. They do not replace that island.
The cost of a change is not limited to the subscription: training, reworking templates, integrations to reconnect, a period of lower productivity. If the reason for leaving is a slogan, nothing offsets that cost.
Example. A 25-person accounting firm runs its audit files on macro-enabled Excel workbooks. Leaving Microsoft 365 wholesale would be a mistake. The useful question is narrower: should general email and the exchange of documents with clients remain with the same operator as the workbooks?
Microsoft is an American company. The EU Data Boundary, for eligible tenants, keeps customer data and pseudonymised personal data within the EU or EFTA, with documented exceptions: support, certain escalations, optional features. A Multi-Geo tenant is not covered, according to Microsoft. This answers part of the question “where are the disks”. It does not answer the question “who can be compelled, in the United States, to produce data it controls”.
The provision resulting from the CLOUD Act (18 U.S.C. § 2713) targets data that the provider holds or controls, including outside the United States. Article 48 of the GDPR, for its part, recognises a third-country decision requiring the disclosure of personal data only if it is based on an international agreement, such as a mutual legal assistance treaty, in force with the Union or the Member State. An American provider operating in Europe may therefore find itself caught between two laws, without the outcome of any specific case being written in advance.
On 10 June 2025, before the French Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee under oath that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an injunction from the American government, without the explicit consent of the French authorities. His answer: “No, I cannot guarantee it, but, once again, it has never happened yet.” Both halves of the sentence matter, and each management team weighs them.
Then there is the legal basis for transfers. As of 5 October 2026, adequacy decision (EU) 2023/1795 is in force. It is being challenged, as noted in commentary by law firms (DAC Beachcroft, WilmerHale); according to WilmerHale, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. The details are in protecting a company from the CLOUD Act and in GDPR and Microsoft 365.
Staying on Microsoft 365 is therefore not a “non-compliant” choice: the DPA, data residency and the record of transfers make it possible to document it. It is a choice that accepts an operator subject to two legal systems. It is a decision for management, not only for the IT department.
From a legal standpoint. An operator governed by European law. A contract whose court is European. If this operator does not depend on an American group for holding the data, nor on American processors, the injunction provided for by the CLOUD Act is not addressed to it. It remains subject to the law of its own country: this is a change of jurisdiction, not immunity. Ask for the list of processors (backups, support, email sending), the location of the people who access the data, and who holds the encryption keys.
From an operational standpoint. Support that is not, by design, that of an American group. Depending on the offer: hosting in France, in Germany, or on your premises. Also depending on the offer: the option of taking only email. A narrow scope is simpler to describe in the record of processing and to audit.
What it does not automatically provide. A SecNumCloud qualification: that applies to a specific offer in the ANSSI catalogue. Since version 3.2 of its framework (2022), SecNumCloud includes requirements for protection against non-European laws (registered office, control of capital, location, staff); a word on a brochure is no substitute. Nor equivalent office software, nor an invisible migration away from Teams. Finally, the software vendor may remain foreign (Zimbra is published in the United States): the contract must state that the software vendor does not access the content.
The choice is not binary. Three configurations are common.
Keep a Microsoft island for one line of business, move general email out. An industrial SME with two sites keeps Microsoft 365 licences for finance and the engineering department; the workshop, sales and administration move to email and file sharing operated in Europe. You then have to handle two directories, the routing of a single domain between two systems, cross-system calendar invitations, and a written rule: which data goes where. The common mistake is to let everyone choose as they go.
Keep the suite and place a filter in front of it. If the decision about the operator is not yet ripe but phishing is pressing, an MTA placed in front of Exchange filters incoming mail without touching the mailboxes. The content, however, remains with Microsoft. This is a security measure, not a change of operator.
Leave in stages. Email first, because it relies on standard protocols; then files; Teams for as long as customers require it. Each stage is judged on its results before committing to the next. The pages migrating from Microsoft 365 and migrating without downtime describe the order of operations.
| If the following statement is true | Direction |
|---|---|
| Teams produce their work in advanced Excel or Power BI | Keep Microsoft 365 for those teams |
| Customers and suppliers require Teams | Keep Teams, or be prepared to offer them another channel |
| The general need is email, files and online editing of them, video conferencing, a CRM, a telephone | An à la carte European suite is suitable |
| The call for tenders requires an offer that is specifically SecNumCloud-qualified | Choose that offer from the ANSSI catalogue, not an email service that uses the word “sovereign” |
| You want a filter in front of the mailboxes, without leaving Exchange | An MTA placed in front of Microsoft 365 is enough. The suite can stay |
| Management wants a European company to hold everyday emails and files | Move general email and files out, keep an island for the lines of business that need it |
| The tenant is Multi-Geo, or Copilot and connectors are enabled | Read the EU Data Boundary exceptions before concluding that residency is enough |
| The parent company mandates Entra ID and its applications | Keep Microsoft 365; the question is dealt with at group level |
| Nobody in-house can administer a server | Choose an operator that runs the service, not software to install yourself |
If two contradictory rows are true for you, the answer is almost always a mixed scenario.
The common mistake is to entrust the trial to the IT department alone: it validates the technology, not the usage. A free trial serves this purpose.
It can be used within a GDPR framework. The regulation does not prohibit American software vendors; it requires a DPA covering the services enabled, a legal basis for transfers and an up-to-date record. The nationality of the operator is a separate decision. See GDPR and Microsoft 365.
No. It describes where certain data is stored and processed. The CLOUD Act targets the provider that holds or controls the data, wherever the disk is located.
Yes, by keeping licences for the people who need them. Check beforehand what happens to calendars, Teams meetings scheduled from the email system, and shared mailboxes.
No. SecNumCloud qualifies a specific offer in the ANSSI catalogue. An email service operated in Europe can be relevant without it, unless your call for tenders requires it.
Klytic is one of the possible European solutions, not the only answer. Operated by Dedicace Software, a French company, it is suitable if you want to combine email, documents (a dedicated Nextcloud instance per customer, not a shared space, with sharing, online editing alone or collaboratively, and version history), video conferencing, CRM and telephony. Hosting in any geographical area matching the applicable jurisdiction, subject to the availability of the required services, for example in Europe or in Mauritius, or on the customer’s servers.
It is not suitable if the project is about finding Office again: it does not replace advanced Excel, Power BI or Teams. Klytic is not SecNumCloud-qualified, and a French operator remains subject to French law. The overview of other players is the 2026 guide.
This page describes a general framework. It does not constitute legal advice.
Accessed in October 2026.
Try Klytic for 30 days on your own email and files, with no commitment.
Welcome offer
No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.
