Email, documents, meetings, chat — for almost every UK business, the entire working day happens inside software rented from one of two American companies. We looked inside fourteen productivity and collaboration products to ask what that means, whether the escape routes are real, and what the new AI assistants do to even the most carefully fenced-in data.
Every other article in this series is about a category with dozens of credible choices. This one isn’t. For the software where your business actually happens — the inbox, the documents, the meetings — the realistic shortlist for most UK organisations is Microsoft 365 or Google Workspace. The sovereignty question is therefore different here: not “which vendor keeps data in Britain?” but “what exactly have we accepted, and what would leaving cost?”
The duopoly diverges
Start with a fact that surprises most people: the two giants treat the UK completely differently. Microsoft 365 offers a genuine UK data region — a UK customer’s mailboxes and documents at rest can stay in Britain, on Microsoft’s cloud, with customer-controlled encryption keys available. Google Workspace, per its own data-regions page (updated this month), offers no UK region at all: the choices are the United States or the EU. Britain’s favourite “lighter” office suite cannot keep British data in Britain even if you ask.
Then the AI layer takes some of Microsoft’s advantage back. Copilot runs on Microsoft’s own AI service — but Microsoft’s own documentation now lists Anthropic as a Copilot supplier explicitly outside the EU Data Boundary. In plain terms: a business that paid for UK data residency and assumed the boundary held may find its AI requests routed beyond it. The fence is real; the AI gate in the fence is new, and it’s documented in the small print, not the marketing.
The same pattern runs through the challengers. Slack offers a London data region — but only on its pricier plans, and it won’t name its AI model suppliers. Zoom announced a UK data centre last November; it isn’t live yet, so UK meetings data today sits in Germany and the Netherlands, with AI from Anthropic and OpenAI via Amazon. Notion keeps UK customers in the US by default (EU residency is enterprise-only). Dropbox holds most data on its own US infrastructure, with European storage in Paris and Hamburg and UK-specific storage gated. And Atlassian — Jira and Confluence — offers a UK realm on Amazon’s London cloud, with OpenAI inside its AI features; its corporate irony is that it was a UK-incorporated company until 2022, when it re-domiciled to Delaware. The flag moved the other way for once.
The fourteen, at a glance
| Product | Owned from | UK data | Runs on | AI inside |
|---|---|---|---|---|
| Microsoft 365 [1] | USA (listed) | UK region | Microsoft end-to-end | Microsoft + OpenAI; Anthropic outside the EU boundary |
| Google Workspace [2] | USA (listed) | No UK option (US/EU) | Google end-to-end | Gemini built in |
| Slack [3] | USA (Salesforce) | UK optional (higher tiers) | Amazon | Suppliers not named |
| Zoom Workplace [4] | USA (listed) | No (Germany/NL; UK DC announced, not live) | AWS/Oracle | Zoom + Anthropic + OpenAI |
| Atlassian (Jira/Confluence) [5] | USA (listed; UK-incorporated until 2022) | UK realm optional | Amazon (London) | OpenAI; keys: BYOK available |
| Notion [6] | USA (VC-backed) | No (US default; EU enterprise-only) | Amazon | Anthropic + OpenAI |
| Dropbox [7] | USA (listed) | Optional, gated | Own infrastructure (US/FR/DE) + AWS | OpenAI listed |
| Zoho Workplace [8] | India (family-owned) | No (Amsterdam/Dublin, own servers) | Zoho’s own | Zoho’s own |
| Proton Mail/Drive [9] | Switzerland (foundation-owned) | No UK — Swiss/German/Norwegian servers, end-to-end encrypted | Proton’s own | Optional, Proton-run |
| Nextcloud [10] | Germany (founder-led) | Your choice — fully open source, self-host or any provider | Yours / any host | Optional, your choice |
| Element (Matrix) [11] | UK (London, VC-backed) | UK option (cloud on AWS London) — or self-host | AWS or yours | n/a |
| Collabora Online [12] | Cambridge brand — Canadian-controlled | Self-host / via partners | Yours | n/a |
| LibreOffice [13] | Germany (foundation) | Your own computer | Your own computer | n/a |
| ONLYOFFICE [14] | Latvia label — Russian controller until 2023, now Singapore holdco | Self-host or its cloud | varies | — |
The escape routes are real — and partial
This category has the strongest European alternatives in the whole series, each sovereign in a different way. Proton is owned by a Swiss foundation — the investor-proof structure again — and end-to-end encrypts everything, so even Proton can’t read your mail; but its servers are Swiss, German and Norwegian, never British. Nextcloud is fully open source under a German founder: residency is whatever you make it. Element is the British one — London company, open code, UK cloud region, built on the Matrix protocol. LibreOffice, under a German foundation, brings back the desktop answer: documents on your own machine.
And two cautionary tales hide among the alternatives. Collabora Online — the Cambridge-branded office suite inside many Nextcloud deployments — turns out to be majority-controlled from Montreal: British engineering, Canadian ownership. ONLYOFFICE, marketed from Latvia, had a Russian controlling entity on the UK register until 2023 and now sits under a Singapore holding company. In the category where “European alternative” is the whole sales pitch, the ownership check matters more, not less.
What buyers should take from this
For most UK organisations the realistic outcome is staying with a US giant — so the buyer questions become configuration questions: is our tenant pinned to the UK region; do we hold our own encryption keys; which AI features are on, and do their suppliers sit inside the data boundary we paid for; what would an exit to open formats cost us? That last one is cheap insurance: documents held in open formats (which LibreOffice and Nextcloud read natively) keep the exit door oiled even if you never use it.
The dial applies one last time. Take the duopoly default with the UK region pinned and AI suppliers checked. Add an encrypted layer for the genuinely sensitive (Proton for board matters is a real pattern). Or self-host the open stack (Nextcloud + Collabora + Element) and accept the homework. What this category adds to the series is the sharpest version of its central lesson: even when you’ve bought the fence — UK region, data boundary, the lot — the AI features are a gate in it, and the gate is where to look now.
Sources
All facts are taken from each vendor’s own published documentation (data-residency, security and sub-processor pages) and from company registries, read directly during June 2026. One reference per vendor.
- Microsoft (Microsoft 365) — SEC 10-K: https://www.sec.gov/Archives/edgar/data/789019/000095017025100235/msft-20250630.htm ; data residency: https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-overview ; Copilot privacy (AI suppliers): https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy
- Alphabet (Google Workspace) — SEC 10-K: https://www.sec.gov/Archives/edgar/data/1652044/000165204426000018/goog-20251231.htm ; data regions (no UK): https://support.google.com/a/answer/13623623
- Salesforce (Slack) — SEC 10-K: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001108524&type=10-K ; Slack AI/security: https://slack.engineering/how-we-built-slack-ai-to-be-secure-and-private/
- Zoom — SEC 10-K: https://www.sec.gov/Archives/edgar/data/0001585521/000158552126000030/zm-20260131.htm ; AI/privacy & data centres: https://www.zoom.com/en/products/ai-assistant/resources/privacy-security/
- Atlassian — SEC 10-K (Delaware re-domicile): https://www.sec.gov/Archives/edgar/data/1650372/000165037225000036/team-20250630.htm ; data residency: https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/
- Notion — Companies House (UK entity): https://find-and-update.company-information.service.gov.uk/company/14189085/officers ; data residency: https://www.notion.com/help/data-residency
- Dropbox — SEC 10-K: https://www.sec.gov/Archives/edgar/data/1467623/000146762326000008/dbx-20251231.htm ; privacy/data location: https://help.dropbox.com/security/privacy-policy-faq
- Zoho (Zoho Workplace) — Companies House PSC: https://find-and-update.company-information.service.gov.uk/company/13424508/persons-with-significant-control ; data centres: https://help.zoho.com/portal/en/kb/accounts/manage-your-zoho-account/articles/data-center-for-zoho-account
- Proton — foundation ownership: https://proton.me/foundation
- Nextcloud — company/ownership (Impressum): https://nextcloud.com/impressum/ (fully open source; residency is self-determined)
- Element — Companies House: https://find-and-update.company-information.service.gov.uk/company/10873661 ; cloud regions: https://docs.element.io/latest/element-cloud-documentation/element-matrix-services/domains-and-ip-addresses/
- Collabora — Companies House PSC (Canadian control): https://find-and-update.company-information.service.gov.uk/company/05513718/persons-with-significant-control ; product: https://www.collaboraonline.com/built-on-libreoffice/
- The Document Foundation (LibreOffice) — foundation registration: https://www.lobbyfacts.eu/datacard/the-document-foundation?rid=770329810840-07&sid=21827 (German foundation; desktop, runs on your own machine)
- ONLYOFFICE (Ascensio System SIA) — Companies House PSC (UK register, prior Russian controller): https://find-and-update.company-information.service.gov.uk/company/05718967/persons-with-significant-control ; GDPR/data: https://www.onlyoffice.com/blog/2018/05/how-onlyoffice-complies-with-gdpr
Research notes: all facts from vendors’ own published documentation — data-residency pages, sub-processor lists, security documents — and company registries, read directly during June 2026. Locations and supplier lists change; check current documents before relying on them. This article reflects the opinions of the Information Matters team — human and AI — and should not be considered statements of fact. Please feel free to contact us if you would to suggest any corrections.
