Commentary: Digital Sovereignty? We already have it – we just lack the courage
Nextcloud implements digital sovereignty, but many decision-makers lack the will, says Moritz Förster. Technically, we're ready.
(Image: heise medien)
We could have been working digitally sovereignly without Microsoft & Co. long ago. But in the executive floors, the courage to draw the consequences is lacking. Yet, technically, we are already where we need to be. Let's take the latest Nextcloud release as an example.
Anyone who looks at the current Hub 26 quickly realizes: The argument that one is dependent on proprietary US suites for “technical reasons” is just a fig leaf now. Nextcloud offers comparable services, such as email, calendar, file storage, video conferencing, collaborative documents – and with each version, functions are added that classic SaaS providers do not deliver out of necessity, but out of business interest: true data sovereignty, federation instead of centralization, migration-friendly architectures. The message is clear: digital sovereignty is no longer a visionary future project; it is fully implemented – it's just not being used to the extent it could be.
No more counterarguments: The technology
Federation is a perfect example of how far Nextcloud has come: instances can connect across organizational boundaries, share files, calendars, tasks, or chats without a central platform collecting all the data. Projects can be organized across servers, file locks work across instances, and teams in different organizations collaborate. And all this without ever giving up their own infrastructure. Where entire government landscapes are currently chained together in Microsoft tenants, a network of Nextcloud servers could stand tomorrow, with each entity remaining controlling its data – and yet cooperating seamlessly.
The fact that Nextcloud has long been considered a serious business platform is also evident beyond the feature lists. In particular, the now-improved migration tools take the fear out of switching: emails, contacts, calendars, or projects can seamlessly move from one instance to another without a complete restart being necessary. The backend architecture optimized by ADA shows how seriously the developers take performance. End-to-end encryption in the browser, granular permissions, and finely adjustable compliance options address precisely those requirements that corporate lawyers and data protection officers have been demanding from cloud solutions for years. In short: excuses as to why one is “not ready yet” are wearing thin.
Videos by heise
Sovereignty is inconvenient
So why do we still see the same contract renewals with Microsoft 365 and Google Workspace in administrations and companies? Because too many still claim that MS Teams is absolutely necessary for their specific department. Unfortunately, in reality, this usually means, we don't dare to question our established ecosystem. It's not a technical necessity, but convenience, which is glorified into a supposed “lack of alternatives.”
Ultimately, too many people loudly demand digital sovereignty politically, but internally often perceive it as a disruption of the status quo. Introducing open-source software like Nextcloud on a large scale means challenging cherished habits, established suppliers, typically the informal influence of large corporations and their consulting arms. And sometimes, unfortunately, even the policies of one's own country. Germany now needs decision-makers who are willing to accept the extra work of a transition – and to take responsibility for an infrastructure where one cannot outsource all risks to a large provider.
Ironically, this very responsibility is the core of what digital sovereignty means. It cannot be bought like an additional license option; it only arises when organizations are willing to translate technical possibilities into organizational consequences. Nextcloud, like other open-source projects, provides the toolbox for this: federated instead of monolithic, open instead of proprietary, migratable instead of vendor-locked. What's missing is the will to actually use these tools.
As long as decision-makers prefer to sign what they know rather than shape what they could, digital sovereignty remains a PR term in strategy papers. Technically, it has been achievable for a long time. The bottleneck is not in the data center – it's in the conference room.
(fo)
