Your data, their rules: Sovereignty washing at its finest

Nextcloud Hub 26 Summer:

Autonomy for Teams, Office on desktop, a fresh take on Photos

Explore what’s new in the release blog!

Read more

We were rather surprised to see an image resembling the Nextcloud logo being used by Microsoft to sovereign-wash their platform. Certainly, tens of thousands of public and private organizations look to Nextcloud for genuine sovereignty and control. Ministries in France and Austria are moving away from Microsoft, in Germany several states have canceled tens of thousands of licenses for their civil servants and the trend is not limited to Europe.

In response, Microsoft has announced “digital sovereignty” over and over again. “Comprehensive sovereign solutions” in June 2025, new services for “sovereign cloud capabilities” in November 2025, more in February 2026. None of it really changed anything. But that hardly explains why Douglas Phillips, a President and CTO at Microsoft, included some images very similar to our logo to announce another round of digital sovereignty-washing initiatives.

Why bother?

Microsoft claims that the growing importance of digital sovereignty is driven by the fact that “advanced cloud and AI capabilities move into public service”. But there’s a far more pressing concern: the US government is using Europe’s dependency on US tech companies as a bludgeoning tool to advance its political and economic interests. Whether it’s pressuring European governments in trade negotiations, challenging Europe’s position on Ukraine or pursuing other political or personal demands, the message is clear: technological dependence creates political leverage. And for our concerned customers that’s the kind of vulnerability digital sovereignty should address.

What these customers are certainly not asking for is more dashboards with ambitious names like Sovereign Control Panel that merely give the impression of control. They would like the ability to actually make meaningful decisions without having to color within the lines drawn by a single, monopolistic IT provider.

The chosen approach: daze and confuse

Microsoft’s approach to digital sovereignty is to confuse and complicate rather than address the underlying dependencies. Not under oath – then, suddenly, the firm has to admit they’d hand over European data in a heartbeat to the US government. But outside court, the company makes reassuring promises about customers keeping the keys, conveniently ignoring the limits of those safeguards. Holding the keys isn’t the same as owning the lock. The idea that External Key Management with Azure Managed HSM protects customer data against a lawful disclosure demand under US legislation is highly questionable. Names like Just-in-Time Access and Customer Lockbox are as meaningless as they are confusing.

So clearly the approach to address sovereignty concerns is to create more fancy product names and confusing terms. Data Guardian promises “oversight” by a trusted EU partner. Ownership doesn’t change, so that oversight can be shut the moment a US court demands it. Production Touch Ledger promises that you’d know about it – unless the usual gag order forbids that, in which case there surely is a way to disable the ledger.

Of course, a riff on our logo for a new round of sovereign-washing in a Microsoft blog certainly adds confusion.

Copilot the culprit?

Fancy a little experiment? Ask Microsoft Copilot to generate a header image for a blog about digital sovereignty and data control. Spoiler alert: there’s a chance you’ll end up with something that looks surprisingly like the Nextcloud logo. 

We can see why. At Nextcloud, we’ve been taking digital sovereignty seriously for years. And while the term has become a popular marketing phrase, its meaning is actually pretty clear: Full control over your data and the technology behind it. But control means nothing if you don’t decide who holds it.

So perhaps AI is to blame? We can only speculate at the prompt used to generate much of the blog:

“Create a convincing statement about digital sovereignty for a major US tech company. Make it sound like we’re giving customers more control, without actually addressing their concerns about vendor lock-in and technological dependency.”
 
 The result might sound remarkably similar to what was published.

The assumption seems to be that procurement departments won’t realize that contractual promises aren’t worth the paper they’re written on when the Whitehouse orders their accounts to be shut down or their data be handed over. Not that there is even an attempt to promise that all administrative access, every operational activity or every legal exposure is transferred to European control… 

Who believes it?

One wonders who falls for it. The Sovereign Private Cloud allows customers to further increase their dependency on Microsoft Azure by letting it infiltrate their data center (“Azure Local”) so even an on-prem setup is completely dependent on Microsoft. It is truly…

Your servers. Your building. Microsoft’s stack, licensing and rules.

Ultimately, Microsoft says sovereignty is about control over data, operations, technology dependencies and continuity. Yet its proposed solution is largely a collection of Microsoft products, including Azure, Microsoft 365, GitHub, Azure Local and Microsoft’s AI tooling.

Who controls the technology roadmap, licensing, updates, product availability and terms of service? Customers may control more settings – they certainly won’t get any control over the platform itself.

Those who fall for it could of course be ignorant of all the technological details. More likely, they would like to change but have not yet found an easy way, and they feel the risk of NIS2, CADA and other legislation that will force a move off of Microsoft at some point is still far enough to not require urgent action. It might end up being an expensive decision.