The office reality in German offices
Microsoft 365 is widely used in German offices. This raises the question of which law governs the processing of the data. LibreOffice is GDPR-compliant, but comes with neither AI nor live collaboration. What a modern European office suite must deliver so that German SMEs can genuinely migrate.
In almost every SME in Germany, the working day starts with the same three programs: Word, Excel, PowerPoint. Over recent years, Microsoft 365 has become so deeply embedded in the world of work that, for most managing directors, the question “What do you use to write your contracts?” is no longer a question but a given.
This taken-for-granted status brings with it data protection issues that have occupied supervisory authorities for years. Microsoft 365 is a service of the US group Microsoft. This means that US laws such as the CLOUD Act and FISA 702 also apply to the provider; under certain conditions, these laws give US authorities access to data, even if the servers are located in Europe.
Since the Schrems II ruling of the Court of Justice of the European Union, the German data protection supervisory authorities have been issuing increasingly clear warnings. On 24 November 2022, the Conference of the Independent Data Protection Supervisory Authorities of the Federal Government and the Federal States (DSK) formally determined that, on the basis of the Data Protection Addendum of 15 September 2022 provided by Microsoft, it cannot be demonstrated that Microsoft 365 is operated in compliance with data protection law, as long as there is a lack of transparency about the processing of personal data for Microsoft's own purposes and its lawfulness has not been proven (DSK determination of 24 November 2022). On 21 December 2022, the Federal Commissioner for Data Protection and Freedom of Information sent a circular along the same lines to the supreme federal authorities (BfDI circular). Both documents refer to the contractual terms in force at the time.
What is needed, therefore, is an alternative that combines three key requirements: functionality, AI and real-time collaboration.
What the GDPR actually requires of office tools
The GDPR is surprisingly specific when it comes to processors and transfers. For office software, this results in five strict requirements that cannot be circumvented through contractual clauses.
- Transparent data flow: Every data processor and every processing stage must be documented. A company that uses Word must know where the text goes while it is being typed: into memory, onto a hard drive, into the cloud, to a subprocessor.
- No uncontrolled third-country transfers: As soon as data is processed outside the EU, a valid legal basis is required: standard contractual clauses, an adequacy decision or another safeguard under Article 46 of the General Data Protection Regulation. Many US providers currently rely on the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795).
- Purpose limitation: Data may not be processed for purposes other than those for which it was collected. An employee who writes a personnel file in Word has not consented to that text ending up in an AI training dataset, not even if the provider's terms of use would allow it.
- Storage location and duration: Data protection authorities require clarity about the jurisdiction in which data is stored and for how long. Cloud providers that keep backups on US servers only partially meet this requirement.
- Audit trail and data subject rights: Who accessed which data and when? Who can request erasure? With an integrated cloud suite, this usually cannot be mapped without active configuration.
These five requirements are not a theoretical construct. They are the basis of every data protection impact assessment, and therefore the standard against which every office suite must be measured before it is put into production.
Microsoft's EU Data Boundary at a glance
With the EU Data Boundary, Microsoft has committed to storing and processing customer data and personal data of its enterprise online services, including Microsoft 365 and Azure, within the EU and EFTA. Microsoft lists limited cases in which data still leaves the boundary and describes, for each service, which configuration is required (Microsoft Learn: What is the EU Data Boundary?, accessed on 23 September 2026). For the legal position, it also remains decisive that Microsoft is a company headquartered in the USA.
CLOUD Act: Under 18 U.S.C. § 2713 providers of communication and cloud services that are subject to US law must preserve or disclose data in their possession or under their control when ordered to do so by US authorities. This obligation applies regardless of where the data is stored. The EU Data Boundary determines where data is stored and processed. Orders under US law remain unaffected by it.
Transfers outside the boundary: In the same documentation, Microsoft describes for each service the cases in which data leaves the EU Data Boundary. For your own assessment, what counts are the services actually used and their configuration.
In addition, there is the question of whether the EU-US Data Privacy Framework will endure. Its predecessor, the Privacy Shield, was declared invalid by the Court of Justice of the European Union in 2020. On 3 September 2025, the General Court of the EU dismissed an action for annulment against the new adequacy decision (Case T-553/23, Latombe v Commission), so the decision remains in force. The Commission monitors the framework on an ongoing basis and can suspend, amend or repeal it if the legal situation in the USA changes. If the decision ceases to apply, companies must base their data transfers to the USA on a different legal basis.
What LibreOffice alone does not provide
There is an obvious alternative to Microsoft 365 that has existed for more than two decades: LibreOffice. The Document Foundation's open-source suite is GDPR-compliant by design. It runs locally, sends no telemetry, has no cloud dependency and is available in dozens of languages. It natively supports the Microsoft formats of Word, Excel and PowerPoint and is already in use in some German state administrations.
Why, then, has LibreOffice not long since displaced Microsoft 365? The answer does not lie in the core functions (they are mature), but in what has been added to modern everyday office work and what the open-source suite does not provide out of the box.
- AI integration. Anyone writing a document today expects a story coach that improves the structure, a writing assistant that suggests wording, and a research function that finds sources at the push of a button. LibreOffice has no integrated AI.
- Real-time collaboration. Several people working simultaneously in the same document with visible cursors is not part of the local suite. Files are saved and passed on.
- Cloud storage. Microsoft 365 comes with OneDrive, Google Workspace with Drive. LibreOffice does not include cloud storage. Sharing relies on email attachments or a separate sync service, which must be assessed separately under data protection law.
- Windows integration. Drive integration in Windows File Explorer, quick access from the notification area and single sign-on with identity providers are not included.
In many migration projects, the central question is therefore: “How will we work together in future?” The three pillars in the next section answer this question.
The three pillars of a modern European office suite
An office suite that can genuinely replace Microsoft 365 must rest on three pillars. Anyone who fails to meet even one of them merely passes the problem on.
Pillar one: a GDPR-compliant foundation. The foundation must be open source, because only open source guarantees full transparency about the processing logic. It must be able to run locally, because otherwise control does not lie within the company itself. And it must be compatible with the dominant office formats, so that migration is possible without data loss. LibreOffice fully meets this pillar.
Pillar two: native AI in every app. By default, the AI should use a European language model that processes requests in Europe, and it must be deeply integrated into the applications. A sidebar in the word processor that helps with wording. A sidebar in the spreadsheet that explains formulas and builds pivot examples. A sidebar in the presentation software that works as a story coach and writes speaker notes.
Pillar three: real-time collaboration with controlled sync infrastructure. Several people must be able to work in the same document at the same time. Cursors and avatars must be visible live. Changes must merge without conflicts. And the sync layer must lie entirely within your own jurisdiction: no detour via US cloud services, no US subprocessor passing the editing events through.
Only when all three pillars are in place is migration possible without loss of functionality. Until then, every alternative remains a compromise.
Live collaboration without a third-party cloud: how it works technically
For years, live collaboration was regarded as the killer feature that only cloud providers such as Google or Microsoft could deliver. In fact, the underlying technology is not new, and it is not tied to any particular cloud.
At its core is a pattern from distributed computing: conflict-free replicated data types, or CRDTs for short. They allow several editors to work on a document at the same time without their changes overwriting each other. Every change carries a timestamp and an identifier, and the order of the changes is provably convergent. No matter in which order the events arrive, in the end all editors see exactly the same document.
What is added is a lightweight sync server that transports the events between the editors, typically via a WebSocket connection. This sync server can run on any standard server. It can be located in a German data centre, on your own hardware or with a European hosting provider that is not owned by a US group. At no point does the data leave the European jurisdiction.
In practice, it looks like this: a tax adviser and her client open the same annual report. Both see each other's avatars at the top of the window. Anyone who clicks in a cell immediately sees the other person's cursor if that person is already working there. Comments appear live. A note on page three pops up for the other person without the file having to be saved or sent.
At Nexoria, files and the knowledge index are located in Germany, and AI answer generation is handled by Mistral AI in France. Other services, including technical error monitoring via Sentry, and enabled integrations are listed under Security.
AI directly in the app: from writing to the slide story
A modern European office suite needs more than collaboration. It needs AI that sits within the workflow: not in a separate browser tab, not as a plugin, but as a permanent sidebar in every application.
In the word processor it looks like this: the AI understands the context of the document, helps with rewording, suggests synonyms and checks for readability. It can shorten paragraphs without distorting the content. It can translate a business letter into a friendly, direct tone, or vice versa. Anyone writing a contract gets pointers to typical clauses that are missing from the current draft.
In the spreadsheet it looks different: the AI builds complex tables from a description phrased in natural language. “Create a VAT calculation for our sales forecast”, and the application generates the right columns, formulas and sample data. Anyone who needs a pivot analysis describes the result instead of the steps. On request, the AI explains every formula in a single sentence, a bridge for everyone who would otherwise avoid Excel.
In the presentation software the AI takes on the role of story coach: it condenses raw bullet lists into statements, generates speaker notes, suggests story arcs for the current slide and can turn bullets into punchy pull quotes. Anyone who has entered a slide gets suggestions for the next one, based on what a professional presentation usually needs in that position.
At Nexoria, files, the knowledge index and semantic search are located in Germany. AI answer generation is handled by Mistral AI in France. The data that Nexoria transfers to Mistral AI is not used for model training; this exclusion is agreed in the individual data processing agreement. This statement refers to the Nexoria configuration and the contract with Mistral AI; it is not a general statement about all Mistral AI offerings. ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply. Additional services and enabled integrations are listed under Security .
The third building block: a controlled sync layer in Windows File Explorer
An office suite is only as good as the storage behind it. Anyone who passes files on as email attachments or on a USB stick immediately undoes the live collaboration from the previous section and creates a GDPR-relevant data transfer without an audit trail.
This is exactly where the third building block comes in: a virtual drive that integrates seamlessly into Windows File Explorer. In terms of ease of use, it works just like OneDrive: files are dragged, shared with a right-click, and the sync status appears as a small icon next to the file name. In the background, however, what runs is not a US cloud but a European sync server that belongs to the company or to a European service provider.
The most important features from a GDPR perspective: Versioning at file level with a configurable retention period. Offline availability for marked folders, which keeps working even without a network connection. Audit trail for every read, write and share action. Workspace separation between personal, team and cross-company areas, each with its own permission model.
What many underestimate: only this sync layer makes an office migration practical for everyday use. Without it, even the best GDPR-compliant word processor remains an isolated solution. With it, the word processor becomes part of an end-to-end workflow, from creation and editing through to joint review.
Five questions before any office migration
Before you evaluate an alternative to Microsoft 365, ask these five questions and take time to check the answers. Marketing claims are one thing; contractual commitments and technical reality are another.
First: Where does the AI processing take place, and on what infrastructure? If the answer is “on European servers of a US group”, that is not the same as “on European servers of a European provider”. The CLOUD Act applies regardless of the server's location as soon as a US group is responsible for operating it.
Second: Which language model is used, and who operates it? What matters is which law applies to the provider that operates the model. A provider based in the USA is subject to US law, even if its model is accessible via a European region. This distinction has direct consequences if the basis for data transfers to the USA falls away again.
Third: How does real-time collaboration work behind the scenes? Does the sync server run at the provider, at the customer or at a subprocessor? Which data is transferred at what point, and are editing events routed outside the EU? The answer should be set out in the contract, not merely exist as a marketing promise.
Fourth: Is there format lock-in? A suite that saves in its own format and exports to .docx, .xlsx and .pptx only to a limited extent is a migration trap. You can get in, but you cannot get out again. An open format strategy is the indicator of genuine vendor independence.
Fifth: What happens in the event of a Schrems III ruling? If the EU-US Data Privacy Framework falls tomorrow, will your provider still have a legal basis? If the answer is “no, but that won't happen”, you should remember the Schrems II ruling. Back then, too, people first said “won't happen”, until it did.