SharePoint, kDrive or Nextcloud: Which Solution for Storing Your Data in Switzerland?

TL;DR

SharePoint dominates in terms of integration and reliability, but exposes your data to the US Cloud Act. This is a real risk for Swiss fiduciaries, lawyers and doctors. kDrive offers a sovereign alternative at a competitive price, with synchronisation that still has room for improvement. Nextcloud guarantees total sovereignty, but requires technical expertise and genuine internal conviction. There is no universal solution: the right choice depends on your legal risk profile, your IT resources and your tolerance for complexity.

---

Introduction

Storing files in the cloud seems trivial until the day your client asks where their data is hosted and under which law. For a law firm in Geneva, a fiduciary in Zurich or a medical practice in Lausanne, the question is far from trivial: Swiss professional secrecy imposes concrete obligations on the confidentiality of data entrusted to you.

Since 2021, we have been using and testing SharePoint Online, kDrive by Infomaniak and Nextcloud as part of digital transformation projects with SMEs and regulated professions in Switzerland. In this article, we share what several years of experience and client feedback have taught us.

---

Legal framework: GDPR, nLPD and Swiss professional secrecy

Before comparing the solutions, it is important to understand the legal framework your activity is subject to.

GDPR and nLPD: two complementary regimes

The new Federal Act on Data Protection (nLPD), in force since September 2023, largely aligns with the European GDPR. It requires in particular:

• Data processing based on a lawful basis
• Clear information to data subjects
• The ability to exercise rights (access, rectification, erasure)
• Appropriate technical and organisational measures (including the choice of hosting provider)

A cloud hosted in Switzerland does not automatically satisfy the nLPD if the operator is subject to foreign legislation that can compel the disclosure of data without prior notification.

The US Cloud Act: a concrete threat

The Clarifying Lawful Overseas Use of Data Act (CLOUD Act), adopted in the United States in 2018, authorises US authorities to compel a cloud service provider subject to US jurisdiction to produce data stored anywhere in the world, including Switzerland, without the company concerned or its clients necessarily being informed.

Microsoft, Google, Amazon: all are subject to this law. Concretely, this means that even if your SharePoint data is physically located in a datacenter in Zurich, Microsoft could legally be compelled to transmit it to US authorities. (source)

For an ordinary company, the risk may seem abstract. For a lawyer, doctor or notary, it represents a potential violation of professional secrecy with criminal consequences under Swiss law (art. 321 SCC).

Swiss professional secrecy: a reinforced duty of care

Professional secrecy (art. 321 SCC for lawyers, doctors, clergy; art. 47 BA for bankers) does not prohibit the use of the cloud. It does, however, require choosing solutions that guarantee, to a reasonable extent, the confidentiality of information entrusted to you. A provider subject to the US Cloud Act does not meet this requirement for data covered by strong professional secrecy.

Is hosting in Switzerland enough? Most providers put forward Swiss hosting as a compliance argument. It is necessary, but not sufficient. The legal nationality of the operator and the law applicable to its registered office matter as much as the physical location of the server.

---

SharePoint Online: the reference, but under US jurisdiction

Strengths confirmed in use

SharePoint Online is the solution we have been using since 2021 in various contexts. Its reliability is real. Outages are rare and brief. It is worth noting that some clients seem more affected by synchronisation issues than others, without our being able to explain why.

Integration with Teams, Outlook and the entire Microsoft 365 suite is unrivalled: internal communication, rights management and real-time co-editing all work coherently.

Storage (1 TB per organisation, expandable) is included in most Microsoft 365 Business licences, making the marginal cost almost zero for companies already equipped.

Ease of use

SharePoint remains the easiest tool to deploy for teams accustomed to the Microsoft environment. The SharePoint Online web interface is not appreciated by users, but it is replaced by Ketl in day-to-day use.

Synchronisation via OneDrive is robust and integrates natively with Windows File Explorer. Users can continue to access their files in the traditional way, which keeps the learning curve low. Administration (management of sites, permissions, hubs) can however become complex at scale if best practices are not followed.

Maintenance

Almost zero on the client side: Microsoft manages updates, security and infrastructure. This is one of the main advantages for SMEs without internal IT.

The decisive limitation: Cloud Act and sovereignty

Microsoft is an American company. It is subject to the Cloud Act. Even by choosing Swiss or European datacenters, you cannot contractually exclude the possibility that data may be transferred to servers located outside Switzerland for support or processing operations: Microsoft acknowledges this in its general terms and conditions.

Suitable for: companies without sensitive data covered by professional secrecy, already in the Microsoft ecosystem, with priority given to simplicity and productivity.

Problematic for: lawyers, doctors, fiduciaries, banks, any organisation managing data whose disclosure without consent can engage their criminal liability.

---

kDrive (Infomaniak): Swiss sovereignty at a competitive price

A Swiss player with genuine infrastructure

kDrive is developed and operated by Infomaniak, a Geneva-based company founded in 1994. Its datacenters are located in Switzerland, powered 100% by renewable energy, and the heat produced is reused for heating. Infomaniak publishes an audited environmental report annually. Infomaniak's reputation is excellent and its actions in favour of the environment and European technological sovereignty are concrete.

Infomaniak is subject exclusively to Swiss law. The US Cloud Act therefore does not apply. Data does not transit to third countries. This is the fundamental difference from SharePoint, and it is decisive for regulated professions.

Ease of use

The kDrive interface is modern and intuitive. The desktop synchronisation client runs on Windows, macOS and Linux. The kSuite integrates word processing, spreadsheet, presentation and messaging. It is a credible and complete alternative to Microsoft 365, even if the ecosystem of extensions and third-party integrations remains less developed. Recently, business and enterprise versions have also integrated Microsoft Online, useful if files present problems with the Open Office version offered in the kSuite.

For price comparison: kSuite with 3 TB of storage per user is offered at approximately one third of the price of an equivalent Microsoft 365 Business licence.

Maintenance

Like SharePoint, kDrive is a managed service: no infrastructure maintenance on the client side. Updates are managed by Infomaniak. Reliability is good, with a few documented synchronisation incidents we encountered in production. These are mainly related to the absence of native webhooks, which forces the client to poll the server periodically rather than being notified in real time. Infomaniak is working on this.

GDPR and professional secrecy

kDrive satisfies the requirements of the nLPD and GDPR for hosting in Switzerland by a Swiss operator. Infomaniak can sign GDPR-compliant data processing agreements (DPA). For professions subject to professional secrecy, this is a serious option, provided the sector-specific contractual clauses are verified with your legal advisor.

Suitable for: Swiss SMEs concerned with sovereignty, liberal professions, organisations wishing to leave the American ecosystem without blowing their budget or managing infrastructure.

---

Nextcloud: total sovereignty, for those who have the means

The principle: you control everything

Nextcloud is an open source software that you install on your own infrastructure: a server on your premises, a Swiss datacenter of your choice, or with a specialised hoster. No third party has access to your data. It is the only one of the three solutions that offers complete technical sovereignty, without dependency on an external provider for data management.

Nextcloud is supported by the Euro-Office project, a European initiative aimed at offering a sovereign alternative to Microsoft Office. This is a strong political and industrial signal regarding its sustainability.

Ease of use

For end users, the experience is comparable to kDrive: clean web interface, desktop and mobile clients, file sharing, calendar, contacts. The quality of experience depends strongly on the quality of deployment and configuration. A poorly configured Nextcloud is slow and unstable. Well configured, it outperforms the other solutions discussed here.

For administrators, the learning curve is real. Managing updates, plugins, the database and security requires technical skills that many SMEs do not have internally.

Maintenance: the critical point

This is where Nextcloud stands out negatively for many organisations. Major updates must be planned and tested. Third-party plugins can break between versions. Without internal IT competence or a trusted service provider, maintenance costs quickly exceed the savings made on licences.

An alternative: entrust deployment to a specialised Nextcloud hoster (there are some in Switzerland). You recover part of the sovereignty without taking on all the maintenance. The price remains reasonable and saves you from spending your time managing your data storage rather than working for your clients: this is the solution we recommend to small and medium-sized structures.

GDPR, nLPD and professional secrecy

Self-hosted Nextcloud on your own premises or in a Swiss datacenter of your choice is the most legally solid solution. You are the operator and the hoster: no data sub-processing, no Cloud Act, no transfer to unwanted third countries. This is the level of control required by certain regulated professions or sensitive public mandates.

Security is never automatic. Although potentially the safest and most confidential, Nextcloud is not a "plug-and-play" solution for compliance. Security depends on your configuration: encryption at rest, TLS certificate management, backup policy, access logs. A poorly secured Nextcloud installation is more risky than a well-configured SharePoint. Ask your provider for a clear answer on encryption and backups before starting any use.

Suitable for: organisations with internal IT competence or a trusted technical partner, strong sovereignty requirements (public sector, regulated professions with high legal risk) and willingness to invest in the initial setup.

---

Comparison table

---

FAQ

Does storing my SharePoint data in a Swiss datacenter protect against the Cloud Act?

No. The Cloud Act applies to Microsoft as an American company, regardless of the physical location of the servers. Data hosted in Switzerland via SharePoint remains technically accessible to US authorities if Microsoft receives a legal injunction. Swiss hosting reduces other risks (latency, applicable law for civil disputes), but does not neutralise the Cloud Act.

Can a lawyer or doctor legally use SharePoint in Switzerland?

Using SharePoint remains possible, but carries a residual risk for data covered by professional secrecy. Several cantonal bar associations and the FMH have published recommendations on this subject. The cautious position is to use a hoster subject exclusively to Swiss law for sensitive data. Consult your professional association and a specialised legal advisor for your specific situation.

Is Nextcloud really free?

The software is open source and free. The real cost comes from deployment, maintenance, infrastructure and support. For a 20-person SME without internal IT, entrusting a Nextcloud to a specialised Swiss hoster typically costs CHF 5 to CHF 40 per user per month, a price comparable to kDrive or Microsoft 365 depending on the options chosen.

Is kDrive compatible with GDPR for European clients?

Yes. Switzerland is recognised by the EU as offering an adequate level of protection for personal data transfers from the EEA. Infomaniak can also sign standard contractual clauses (SCC) for specific processing operations that require them.

Can you migrate from SharePoint to kDrive or Nextcloud without losing everything?

Yes, but the migration requires serious planning. Access rights, workflows and integrations do not migrate automatically. Count on a project of 4 to 12 weeks depending on the volume and complexity of your current organisation.

---

Conclusion

The best solution is the one adapted to your legal, technical and budgetary context.

If you are an SME without sensitive data and already in the Microsoft ecosystem, SharePoint remains hard to beat in terms of productivity and simplicity.

If you practise a regulated profession or manage data covered by Swiss professional secrecy, kDrive is the most accessible compromise between sovereignty, cost and ease of use.

If you have the technical resources and a requirement for maximum control, Nextcloud is the only option that gives you full control of your infrastructure.

Concrete next step: before choosing, map your data by sensitivity level (public data, personal data, data covered by professional secrecy). This mapping alone will often be enough to eliminate one or two options. If your documents require intelligent processing in addition to sovereign storage, Ketl integrates natively with all three solutions to automate classification and document search.

Need help evaluating your situation or preparing a migration? We have been supporting Swiss SMEs and liberal professions in their digital transformation projects since 2019. Contact us or contact@ketl.ch

---

Sources:

• Cloud Act - official text (Congress.gov)
• nLPD - Federal Data Protection and Information Commissioner (FDPIC)
• Nextcloud Euro-Office initiative
• Infomaniak - Ecological commitment and sovereignty

Related pages

• Swiss alternative to Google Drive and OneDrive: an honest comparison of sovereign storage options
• Swiss alternative to DocuWare: an honest comparison for regulated sectors
• Swiss document management system: why hosting alone is no longer enough