We examined twenty CRM systems sold to UK businesses to answer one question: can you keep your customer data under UK control? Not one offers a simple, fully British answer. Ownership is slippery — Pipedrive, Estonian-born, is US private-equity-owned; Norwegian SuperOffice is now Danish-held. And the flag rarely follows the data: Manchester’s Capsule stores customer records in the US on Amazon, while US-owned Pipedrive defaults new UK data to London. Most of the cohort runs on Amazon, Microsoft or Google — all American, all within reach of the US CLOUD Act. The most sovereign option proves to be SuiteCRM, a free, Scottish-stewarded open-source fork that outlived its parent company’s liquidation. Sovereignty here is a dial, not a yes/no decision — and the flag on the website almost never tells you where your customer list actually lives.

Making Tax Digital pushed UK businesses’ books into the cloud — but nobody said where they would end up. We traced twenty-one accounting packages through their own documents, and the headline is uncomfortable: owning the vendor and holding the data have almost nothing to do with each other. Sage, Britain’s listed champion, stores mid-market Sage Intacct data in the EU on Amazon; New Zealand’s Xero keeps UK books in the United States. Meanwhile American QuickBooks promises “your home country” and Oracle’s NetSuite runs UK data centres — the US giants often keep data in Britain better than the British brands do. The genuinely sovereign options are the unfashionable ones: desktop Sage 50 and GnuCash keep the ledger on your own machine. And the AI now reading the ledger, via Amazon Bedrock and OpenAI, is the least disclosed layer of all.

Payroll holds the most sensitive data a business owns — salaries, bank accounts, National Insurance numbers — and files it to HMRC every payday. We looked inside nineteen payroll and HR systems. For once, Britain has real choices: Zellis, MHR and Cintra hold UK data on UK clouds, and Moneysoft’s desktop payroll means the vendor holds nothing at all. But the fashionable newcomers quietly move the payslips abroad — Rippling to the US, Employment Hero to Australia, HiBob to Ireland and Germany — while ADP and Workday simply don’t say. SD Worx shows a rare investor-proof model: majority-owned by a Belgian foundation. This is the one category where a UK business can straightforwardly choose British at every layer — owner, data and computers — which makes the decisions that export everyone’s bank details look more like defaults accepted than trade-offs made.

For the software where the working day actually happens — email, documents, meetings, chat — most UK organisations have just two realistic choices: Microsoft 365 or Google Workspace. We examined sixteen productivity tools. The duopoly diverges: Microsoft offers a genuine UK data region; Google, by its own page, offers none. But the AI layer takes Microsoft’s advantage back — its own documentation lists Anthropic as a Copilot supplier explicitly outside the EU Data Boundary. You can buy the fence and find the AI is a gate in it. The European escape routes are real but partial: Proton (Swiss foundation, encrypted), Nextcloud (open-source, self-host) and Element (UK, London). Two cautionary tales: “Cambridge” Collabora is Canadian-controlled, and Latvia’s ONLYOFFICE had a Russian controller until 2023. Where “European alternative” is the whole pitch, the ownership check matters most.