03 Module · Why Nextcloud

The shared drive that
needs no legal opinion.

Files, calendars, contacts, documents and calls — on a machine in Stockholm, under your own invoice. It is the layer every colleague touches daily, and the one where “where does the data live?” has historically had an uncomfortable answer.

First released: 2016
Written in: PHP & Vue
Company: Nextcloud GmbH, Stuttgart
Licence: AGPL v3

Most of an organisation's sensitive data does not sit in the database your engineers worry about. It sits in the shared drive.

Personnel files, board packs, contracts, the spreadsheet with everyone's salary in it, the folder marked Legal — do not circulate. That material is created by people who are not engineers, using tools chosen for convenience, and it is the first thing anyone asks about when a procurement questionnaire, a works council or a regulator comes calling.

The uncomfortable part is that the honest answer usually requires a transfer-impact assessment, a set of standard contractual clauses, and a paragraph explaining why a foreign disclosure statute does not really apply. That paragraph is where a lot of European compliance effort goes, and it defends an architecture rather than describing one.

Nextcloud replaces the paragraph with a sentence: the disk is in Stockholm, the provider is incorporated in Sweden, and the invoice is in your name. It is not a better answer because it is open source. It is a better answer because it is short.

Argumenten · The case

Eight reasons,
in order of how often they matter.

Ranked by what comes up once it is deployed and two hundred non-technical colleagues are using it every day.

01 The jurisdiction answer is one sentence

Data at rest in the EU or EEA, on a provider incorporated in the EU or EEA, with keys you hold. No foreign disclosure statute has a hook, so the compliance section stops being an argument and becomes a description.

02 Everyone already knows how to use it

Files sync to Windows, macOS and Linux desktops the way Dropbox does. Calendars and contacts arrive over CalDAV and CardDAV in Outlook, Thunderbird and every phone. Nobody is retrained to open a folder.

03 One system, not six subscriptions

Files, calendar, contacts, document editing, video calls, forms and group chat — one login, one backup, one thing to patch. Most organisations we meet pay four vendors for that surface area.

04 Storage costs what storage costs

You buy terabytes at European object-storage prices instead of per-user tiers. The team that generates video or CAD files stops being a budget conversation, and nobody deletes things to stay under a quota.

05 External sharing without a shadow account

Share links with passwords, expiry dates and upload-only drop folders, plus federation to another Nextcloud. The alternative is staff quietly using a personal Dropbox, which is the actual risk you are managing.

06 The audit trail is yours

Who opened what, from where, and when — in your own logs, retained on your own schedule, queryable without an enterprise tier. Retention and legal hold are configuration rather than a support ticket.

07 A European vendor, if you want one

Nextcloud GmbH is in Stuttgart, and an enterprise subscription buys support in the same jurisdiction as the data. You can also take the AGPL version and never speak to them. Both are real options, which is the point.

08 It is the tested path

This stopped being a brave choice some years ago. Several European governments run it at a scale far beyond yours, so the failure modes are documented and the migration path is well-trodden.

Jämförelse · Side by side

Against a hosted suite

Costs are for a 200-person organisation with 20 TB, which is roughly where the arithmetic stops being theoretical.

Concern	Google Workspace / Microsoft 365	Nextcloud, as we run it
Where the data rests	Their region, their entity	Your disk, your jurisdiction
Transfer-impact assessment	Required, and contested	Not applicable — no transfer
Cost at 200 users, 20 TB	€2,400–€5,000 / month	Servers and storage: a few hundred
Storage model	Per-user tiers	Terabytes at object-storage prices
Document co-editing	Excellent	Good — Collabora or OnlyOffice
Search across everything	Excellent	Adequate; weaker on large corpora
Mobile apps	Excellent	Solid, not delightful
Audit log and retention	Enterprise tier	Included, and queryable
Who patches it	Them	Us, or you, on your schedule
Cost of leaving	An export and a rebuild	The files are already files on your disk

Hur vi driftar · Our install

What a Chenborg Nextcloud actually contains.

The difference between a Nextcloud people like and one they complain about is almost entirely sizing and caching. A default install on the cheapest VPS is where this software earned its bad reputation, and it is a self-inflicted one.

PostgreSQL and Redis, never SQLite — the single most common cause of “Nextcloud is slow”
File blobs in S3-compatible object storage at a European provider, so storage grows without resizing disks
Collabora or OnlyOffice self-hosted alongside, for co-editing that stays inside the perimeter
SSO against your existing directory, enforced 2FA, per-device revocation
Desktop and mobile clients configured — including for Ubuntu Touch, Sailfish OS and postmarketOS
Migration from Google Workspace, Microsoft 365 or Dropbox with folder structure and shares intact
Nightly encrypted backups to a second European region, restore-tested monthly

The Nextcloud engagement in detail

nextcloud.nix

# The office suite, declared once.
services.nextcloud = {
  enable         = true;
  package        = pkgs.nextcloud31;
  hostName       = "files.example.se";
  https          = true;
  configureRedis = true;

  database.createLocally = true;
  config.dbtype = "pgsql";

  # blobs live in Stockholm, not on this disk
  settings.objectstore.s3 = {
    bucket   = "chenborg-nc-files";
    hostname = "s3.eu-sto.example";
    region   = "se-sto-1";
  };
};

services.collabora-online.enable = true;

# 200 users, 20 TB, one file.

I gott sällskap · In good company

European governments
got here first.

If you are worried this is an eccentric choice, it stopped being one some years ago. These are public-sector deployments operating well beyond the scale of most private companies.

300k+

Users across the German Federal Administration, operated by ITZBund as the Bundescloud — among the largest Nextcloud deployments anywhere.

French Ministry of the Interior

Hosted internally and unreachable from the public internet, alongside the French state's Nubo cloud.

Schleswig-Holstein

The German state's programme to move its administration off proprietary software and onto open source.

Research & education networks

Dutch and Nordic university sectors running shared drives for entire institutions.

Our parent company's survey of European open-source adoption

Ärligt talat · Honestly

When Nextcloud is the wrong answer.

This is the service where expectations do the most damage, so it is worth being blunt. Nextcloud is not a drop-in replacement for Google Workspace, and an organisation told otherwise will be unhappy by month three.

Co-editing is good, not Docs. Collabora and OnlyOffice handle simultaneous editing properly, but a team that lives inside Google Docs all day will feel the difference in latency and polish.
Search is the real gap. Full-text search across hundreds of thousands of documents is adequate rather than excellent. If instant search over a huge corpus is the daily workflow, weigh that carefully.
Undersizing ruins it. Almost every “Nextcloud is slow” story is SQLite, no Redis, and a €5 VPS. The software gets blamed for a decision made to save forty euro a month.
Somebody must own the machine. Self-hosting means patching, monitoring and restoring. If the answer is “nobody, and no budget”, buy the hosted suite honestly rather than run this badly.
Deep Microsoft integration is a real dependency. If finance lives in Excel with Power Query against SharePoint lists, that is not a file-sync problem and Nextcloud will not solve it.
Under about fifty people the licence saving rarely justifies the operational overhead. The sovereignty argument might — be honest about which one you are buying.

The case is strongest for organisations of a hundred or more, holding personal or regulated data, with a procurement or works-council conversation already underway, and at least one person happy to own a server.