Digital sovereignty in practice: what small and mid-sized organisations can do today

Digital sovereignty is your ability to decide for yourself about your data, your tools and your providers. It does not mean doing everything yourself or never using a service from outside the EU. It means knowing your dependencies and keeping your options open.

For small and mid-sized organisations this is less about strategy papers and more about a short list of decisions: where your data is stored, who may access it, what happens to it in AI features, and whether you can take it with you.

Start with an honest inventory. For each tool your team uses every day, write down:

• Which data it holds – messages, files, recordings, contacts, customer data.
• Who your contract partner is and where it is based – including its parent company.
• Which subprocessors it uses and in which countries they process data.
• Whether you have a data processing agreement (Art. 28 GDPR) where one is needed.
• What happens if prices or terms change: how quickly could you move?

A single tool that holds everything is convenient, but it is also your biggest dependency. That is fine, as long as you know it and have a way out.

Where data is stored matters, but it is not the whole picture. What also counts is which law applies to the provider. The GDPR only allows transfers of personal data outside the EU/EEA under the conditions of its Chapter V – for example an adequacy decision or standard contractual clauses. See third-country transfer.

Two references come up in almost every discussion: the US CLOUD Act of 2018, which lets US authorities require providers under US jurisdiction to disclose data in their control – even if it is stored outside the USA – and the Schrems II judgment of the Court of Justice of the EU of 16 July 2020.

• Ask where your content is stored and processed – not only where the company has an office.
• Ask which parts leave the EU, for example network protection, payments, e-mail or support tools.
• Ask on which legal basis such transfers happen.

Open standards reduce lock-in. If sign-in runs over SAML or OpenID Connect, phone lines over SIP and calls over WebRTC, you can replace one piece without rebuilding everything.

1. 1

   Test the export now

   Export a real set of data once and open it. Is it complete? Can another tool read it?

2. 2

   Write down an owner

   Name the person who can trigger an export and knows where the admin access is.

3. 3

   Keep accounts in your hands

   Central sign-in and user provisioning from your own directory make it easier to switch tools later.

4. 4

   Check notice periods

   Know how long your contracts run and how long data stays available after cancelling.

Transcripts, summaries and assistants are useful – and they process exactly the content you care about most. Before you switch them on, check:

• Where the models run and which provider processes the content.
• Whether your content is used to train models.
• Whether individual people can opt out, for example of transcription.
• Whether you can switch AI features off for sensitive rooms.

Short and factual – the details, including every subprocessor, are on Why a European collaboration platform.

Operator

Developed and operated in Luxembourg (Made in Luxembourg).

Servers

Web app, database, files and media servers run in data centres in Germany.

AI

Transcription, translation and summaries run on our own servers. Content is not sent to external AI providers.

Encryption at rest

Every space has its own key (AES-256-GCM). This is server-side encryption, not end-to-end.

End-to-end encryption

Available for end-to-end encrypted rooms and direct messages – without AI, search or recordings in those rooms.

DPA

Organisations can conclude a data processing agreement under Art. 28 GDPR.

Export

Personal data export and a full space export as a ZIP archive with a PDF report.