The whole office is rented. Who’s the landlord?
Email, documents, meetings, chat — for almost every UK business, the entire working day happens inside software rented from one of two American companies. We looked inside thirty-one productivity, collaboration and business-email products to ask what that means, whether the escape routes are real, and what the new AI assistants do to even the most carefully fenced-in data.
Every other article in this series is about a category with dozens of credible choices. This one is different. For the software where your business actually happens — the inbox, the documents, the meetings — the realistic shortlist for most UK organisations is Microsoft 365 or Google Workspace. The sovereignty question is therefore not “which vendor keeps data in Britain?” but “what exactly have we accepted, and what would leaving cost?”
This refresh widens the lens. The first version looked at fourteen products; the audited cohort behind it now runs to thirty-one companies across two jobs — productivity and collaboration, and business email and calendar. Widening the field does not widen the ownership map. Of the thirty-one, exactly one is controlled from the United Kingdom. The rest are owned from the United States, Germany, France, Switzerland, Canada, Singapore, the Netherlands, Belgium, Norway and Australia. The flag almost never flies over Britain.
The Microsoft 365 versus Google Workspace duopoly diverges
Start with a fact that surprises most people: the two giants treat the UK completely differently. Microsoft 365 offers a genuine UK data region — a UK customer’s mailboxes and documents at rest can be kept in Britain, on Microsoft’s cloud, with customer-managed encryption keys available. Google Workspace, by its own data-regions documentation read this month, offers a choice of only two locations: the United States or Europe. There is no UK option on Google. Britain’s favourite “lighter” office suite cannot keep British data in Britain even if you ask for it.
Then the AI layer takes some of Microsoft’s advantage back. Copilot runs largely on Microsoft’s own AI service — but Microsoft’s own Copilot privacy documentation now states plainly that “Anthropic models are out of scope for the EU Data Boundary.” In plain terms: a business that paid for UK or EU data residency, and assumed the boundary held, may find some of its AI requests routed beyond it. The fence is real; the AI gate in the fence is new, and it is documented in the small print, not the marketing.
The same pattern runs through the challengers. Slack (owned by Salesforce) offers a London data region — but only on its pricier plans, and it does not name its AI model suppliers in its public security writing. Zoom holds UK meetings data outside Britain today (Germany and the Netherlands), with AI assistance drawing on Anthropic and OpenAI. Notion keeps UK customers in the United States by default, with European residency reserved for enterprise plans. Dropbox holds most data on its own US infrastructure, with European storage in Paris and Hamburg. And Atlassian — Jira and Confluence — offers a UK realm on Amazon’s London cloud, with OpenAI inside its AI features; its corporate irony is that it was a UK-incorporated company until 2022, when it re-domiciled to Delaware. The flag moved the other way for once.
The thirty-one, at a glance
The audited cohort splits into two jobs. The first table is productivity and collaboration suites; the second is dedicated business email and calendar providers. “Owned from” is the country of ultimate control, audited and then re-checked this session against the company’s own registry filing or corporate page. “UK data” means a data-at-rest residency option inside the United Kingdom. “AI inside” lists disclosed AI suppliers; “not disclosed” means the vendor does not publish them.
### Productivity and collaboration
| Product | Owned from | UK data | Runs on | AI inside |
|---|---|---|---|---|
| Microsoft 365 [1] | USA (listed) | UK region | Microsoft end-to-end | Microsoft + OpenAI; Anthropic out of the EU Data Boundary |
| Google Workspace [2] | USA (listed) | No UK option (US/Europe) | Google end-to-end | Gemini built in |
| Slack [3] | USA (Salesforce, listed) | UK optional (higher tiers) | Amazon | Suppliers not disclosed |
| Zoom Workplace [4] | USA (listed) | No (Germany/Netherlands) | Amazon / Oracle | Zoom + Anthropic + OpenAI |
| Jira (Atlassian) [5] | USA (listed; UK-incorporated until 2022) | UK realm optional | Amazon (London) | OpenAI; bring-your-own-key available |
| Confluence (Atlassian) [5] | USA (listed; UK-incorporated until 2022) | UK realm optional | Amazon (London) | OpenAI; bring-your-own-key available |
| Notion [6] | USA (venture-backed) | No (US default; EU enterprise-only) | Amazon | Anthropic + OpenAI |
| Dropbox [7] | USA (listed) | Optional, gated | Own infrastructure (US/France/Germany) | OpenAI listed |
| Dropbox Dash [7] | USA (listed) | No (US) | Own infrastructure | OpenAI listed |
| Zoho Workplace [8] | India (family-owned) | No (Amsterdam/Dublin, own servers) | Zoho’s own | Zoho’s own |
| Proton Drive for Business [9] | Switzerland (foundation-owned) | No UK — Swiss/German/Norwegian servers, end-to-end encrypted | Proton’s own | Optional, Proton-run |
| Nextcloud Hub [10] | Germany (founder-led) | Your choice — open source, self-host or any host | Yours / any host | Optional, your choice |
| Element [11] | UK (London, dispersed ownership) | UK option (cloud on Amazon London) — or self-host | Amazon or yours | Not disclosed |
| Element Matrix Services [11] | UK (London, dispersed ownership) | UK option (cloud on Amazon London) | Amazon | Not disclosed |
| Collabora Online [12] | Cambridge brand — Canadian-controlled | Self-host / via partners | Yours | Not applicable |
| LibreOffice [13] | Germany (foundation) | Your own computer | Your own computer | Not applicable |
| ONLYOFFICE Docs [14] | Singapore holding company (Russian controller until 2023) | Self-host | Varies | Bring-your-own model |
| ONLYOFFICE DocSpace [14] | Singapore holding company | No (US/EU cloud) or self-host | Varies | Bring-your-own model |
| Open-Xchange (OX App Suite) [15] | Germany (venture-backed) | Optional (via host) | Yours / any host | OpenAI + Anthropic (or self-hosted) |
| Tresorit [16] | Switzerland — owned by Swiss Post | Optional (regional residency) | Own / cloud | None (AI-free) |
| CryptPad [17] | France (founder-led, XWiki) | Optional (self-host) | Yours | Not applicable |
| Twake Workplace (Linagora) [18] | France (founder-led) | Optional (self-host) | Yours / any host | Mistral |
| Jalios Workplace [19] | France (founder-led) | Optional | Yours / host | OpenAI / Mistral (your choice) |
| Jamespot [20] | France (founder-led) | No (France) | France | Not disclosed |
| Stackfield [21] | Germany (founder-led) | No (Germany) | Germany | Not disclosed |
| Talkspirit [22] | France (founder-led) | No (France/EU) | France/EU | Not disclosed |
| Whaller [23] | France (founder-led) | No (France) | France | Mistral / OVHcloud |
| Wimi [24] | France (founder-led) | No (France) | France | Mistral |
### Business email and calendar
| Product | Owned from | UK data | Runs on | AI inside |
|---|---|---|---|---|
| Proton Mail for Business [9] | Switzerland (foundation-owned) | No — Swiss servers, end-to-end encrypted | Proton’s own | Optional, Proton-run |
| BlueMind [25] | France (founder-led) | Optional (self-host) | Yours / host | Not disclosed |
| Fastmail [26] | Australia (employee-owned) | No (US/own infrastructure) | Own infrastructure | None (no inbox AI) |
| Mailfence [27] | Belgium (founder-led) | No (Belgium) | Belgium | Not disclosed |
| Posteo [28] | Germany (founder-led) | No (Germany, green-powered) | Germany | Not applicable |
| Runbox [29] | Norway (employee-owned) | No (Norway) | Norway | Not disclosed |
| StartMail [30] | Netherlands (founder-led) | No (Netherlands) | Netherlands | Not disclosed |
| Tuta Mail & Calendar [31] | Germany (founder-led) | No (Germany, end-to-end encrypted) | Germany | Not applicable |
| mailbox.org [32] | Germany (founder-led) | No (Germany) | Germany | Not disclosed |
The escape routes are real — and partial
This category has the strongest European alternatives in the whole series, each sovereign in a different way. Proton is owned by a Swiss non-profit foundation — the investor-proof structure again, confirmed on Proton’s own foundation page: the foundation is the primary shareholder and no change of control can happen without its consent. Proton end-to-end encrypts everything, so even Proton cannot read your mail; but its servers are Swiss, German and Norwegian, never British. Nextcloud, a German company led by its founder, is fully open source: residency is whatever you make it. Element is the British one — a London company on the Matrix protocol, with a UK cloud region or self-hosting; Companies House records no controlling shareholder, just dispersed founder and investor holdings. LibreOffice, under a German charitable foundation, brings back the desktop answer: documents on your own machine.
The dedicated email field deepens the European bench. Tuta (Hanover) and mailbox.org (Berlin) are German founder-run providers; Posteo is another, green-powered and famously minimal; StartMail (Netherlands), Mailfence (Belgium), Runbox (Norway, employee-owned) and Fastmail (Melbourne, employee-owned) round it out. None offers a UK data region — the encrypted European mailbox keeps your data in continental Europe, not Britain.
And the ownership checks matter more here, not less, because “European alternative” is the whole sales pitch. Three are worth saying plainly:
- Collabora Online — the Cambridge-branded office suite inside many Nextcloud deployments — is majority-controlled from Montreal. Companies House records Philippe Kalaf Holdings Inc, incorporated in Canada, holding 75% or more of Collabora Limited. British engineering, Canadian ownership.
- ONLYOFFICE carries the most important correction to the earlier article. It is marketed from Latvia, and its UK entity (Ascensio System Limited, 05718967) once had a Russian controlling shareholder — RK-Technology JSC of Nizhny Novgorod — on the register. That entity ceased on 29 May 2023, was briefly succeeded by an individual holder (an Uzbek national, May–August 2023), and since 7 August 2023 the controlling shareholder has been ONLYOFFICE Capital Group Pte. Ltd., a private company incorporated in Singapore (registered office 68 Circular Road, Singapore 049422), holding 75% or more. The control has moved from Russia to Singapore; the previous article’s “Russian controller until 2023” is now history, not the current position.
- Tresorit, the Swiss encrypted-storage name, is now part of Swiss Post — its own About page states it plainly. A Swiss state-owned postal operator sits behind the brand.
What buyers should take from this
For most UK organisations the realistic outcome is staying with a US giant — so the buyer questions become configuration questions: is our tenant pinned to the UK region; do we hold our own encryption keys; which AI features are switched on, and do their suppliers sit inside the data boundary we paid for; what would an exit to open formats cost us? That last one is cheap insurance: documents held in open formats (which LibreOffice, Nextcloud and ONLYOFFICE read natively) keep the exit door oiled even if you never use it.
The dial applies one last time. Take the duopoly default with the UK region pinned and AI suppliers checked. Add an encrypted layer for the genuinely sensitive — Proton for board matters, or Tuta for a small confidential mailbox, are real patterns. Or self-host the open stack (Nextcloud plus Collabora or ONLYOFFICE, with Element for chat) and accept the homework. What this category adds to the series is the sharpest version of its central lesson: even when you have bought the fence — UK region, data boundary, the lot — the AI features are a gate in it, and the gate is where to look now.
Sources
All facts are taken from each vendor’s own published documentation (data-residency, security and sub-processor pages) and from company registries, read directly during June 2026. One primary reference per vendor.
- Microsoft (Microsoft 365) — data residency: https://learn.microsoft.com/en-us/microsoft-365/enterprise/m365-dr-overview ; Copilot privacy (Anthropic outside EU Data Boundary): https://learn.microsoft.com/en-us/copilot/microsoft-365/microsoft-365-copilot-privacy
- Alphabet (Google Workspace) — data regions (US/Europe only, no UK): https://support.google.com/a/answer/9223653
- Salesforce (Slack) — Slack security/AI: https://slack.engineering/how-we-built-slack-ai-to-be-secure-and-private/
- Zoom — AI/privacy and data locations: https://www.zoom.com/en/products/ai-assistant/resources/privacy-security/
- Atlassian (Jira/Confluence) — data residency: https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/ ; Delaware re-domicile (SEC): https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001650372&type=10-K
- Notion — data residency: https://www.notion.com/help/data-residency
- Dropbox (Dropbox / Dash) — privacy/data location: https://help.dropbox.com/security/privacy-policy-faq
- Zoho (Zoho Workplace) — data centre locations: https://www.zoho.com/know-your-datacenter.html
- Proton (Mail/Drive for Business) — foundation ownership: https://proton.me/foundation
- Nextcloud (Hub) — company/ownership (Impressum): https://nextcloud.com/impressum/
- Element (Matrix / EMS) — Companies House (no controlling person; UK): https://find-and-update.company-information.service.gov.uk/company/10873661/persons-with-significant-control
- Collabora Online — Companies House PSC (Philippe Kalaf Holdings Inc, Canada): https://find-and-update.company-information.service.gov.uk/company/05513718/persons-with-significant-control
- The Document Foundation (LibreOffice) — German foundation; desktop software: https://www.documentfoundation.org/
- ONLYOFFICE (Ascensio System Limited) — Companies House PSC (ONLYOFFICE Capital Group Pte. Ltd., Singapore, active 7 Aug 2023; Russian controller ceased 29 May 2023): https://find-and-update.company-information.service.gov.uk/company/05718967/persons-with-significant-control
- Open-Xchange (OX App Suite) — corporate site (German company): https://www.open-xchange.com/
- Tresorit — About (part of Swiss Post): https://tresorit.com/about-us
- CryptPad (XWiki SAS) — project/company site: https://cryptpad.org/
- Twake Workplace (Linagora) — corporate site (French open-source publisher): https://www.linagora.com/en
- Jalios (Jalios Workplace) — corporate site (French): https://www.jalios.com/
- Jamespot — corporate site (French): https://www.jamespot.com/
- Stackfield — corporate site (German): https://www.stackfield.com/
- Talkspirit — corporate site (French): https://www.talkspirit.com/
- Whaller — corporate site (French): https://whaller.com/
- Wimi — corporate site (French): https://www.wimi-teamwork.com/
- BlueMind — corporate site (French open source): https://www.bluemind.net/
- Fastmail — About (Melbourne, Australia): https://www.fastmail.com/about/
- Mailfence (ContactOffice Group) — corporate site (Belgium): https://mailfence.com/
- Posteo — corporate site (German, green-powered): https://posteo.de/en
- Runbox — About (Norway, employee-owned): https://runbox.com/about/
- StartMail — corporate site (Netherlands): https://www.startmail.com/
- Tuta (Tutao GmbH) — legal notice (Hanover, Germany): https://tuta.com/imprint
- mailbox.org (Heinlein Hosting GmbH) — legal notice (Berlin, Germany): https://mailbox.org/en/legal-information/
Data-residency sources (browser-render pass, June 2026): Dropbox Dash — AWS US only, no residency option (dropbox.com); ONLYOFFICE DocSpace — cloud regions Oregon/Frankfurt, no UK; self-host otherwise (onlyoffice.com); ONLYOFFICE Docs & DocSpace AI — bring-your-own model plugin (OpenAI/Anthropic/Mistral/Gemini/etc.) (onlyoffice.com/ai-assistants); Open-Xchange — OX AI Service integrates OpenAI ChatGPT and Anthropic Claude on AWS Bedrock, or self-hosted LocalAI (documentation.open-xchange.com); Tresorit — explicitly AI-free; never scans, analyses or trains on files (tresorit.com/m/us-no-ai); Twake (Linagora) — Mistral, fine-tuned within the customer perimeter (linagora.com); Jalios — JNLP is LLM-agnostic; connects OpenAI/Azure OpenAI/LightOn/Mistral, Mistral on OVHcloud (jalios.com); Whaller — (IA)ssistant powered by Mistral AI, with OVHcloud-hosted open-source models optional (whaller.com); Wimi — Wimi Neo powered by Mistral AI (wimi-teamwork.com); Fastmail — no AI in the inbox; mail is not processed by a model, optional MCP server for the user’s own AI client (fastmail.com).
Research notes: all facts from vendors’ own published documentation — data-residency pages, sub-processor lists, security documents — and company registries, read directly during June 2026. Locations and supplier lists change; check current documents before relying on them. This article reflects the opinions of the Information Matters team — human and AI — and should not be considered statements of fact.
If you have any questions or comments about this article please email info@informationmatters.net
