Module 2 · 2.4

English

Nederlands English Deutsch Français Español

Comparing providers without being swayed

Module 2: What is a European cloud, really? · Reading time: 11 minutes

Learning objective: After this lesson you can use your own requirements list to compare European providers on substance, judge the value of certifications, and choose between an all-in-one service, separate services or self-hosting.

Key concepts: requirements list (must, should, could), ISO/IEC 27001, scope, ISO/IEC 27701, NEN 7510, BSI C5, SecNumCloud, SOC 2, SLA, availability, support language, trial period, references, all-in-one, separate services, self-hosting

Your requirements first, then the providers

If you start by browsing providers' websites, you let yourself be guided by whatever they want to show off: a huge storage number, an AI button, a sleek logo. So start with yourself instead. Bakkerij De Korrel first wrote down what it actually needed, and only then started looking around.

Use three levels to do this:

Must: without this, the provider is out. For example: data and backups in the EEA, European owner, data processing agreement with a sub-processor list, mail on your own domain, IMAP and CalDAV, two-factor authentication.
Should: important, but you can work around it. For example: an online office suite in the browser, support in your own language, a phone app for photos.
Could: nice to have. For example: video calling, forms, AI assistance.

Keep the must-list short. Nobody manages a must-list of thirty points, and then you end up choosing on gut feeling anyway.

Three types of offering

European cloud services broadly come in three forms.

Form	What it is	Advantages	Watch out for
All-in-one	One provider delivers mail, storage, calendar, documents and chat together, like the suites from large American providers	One contract, one login, everything works together	You're tied to a single party again; check the export options extra carefully
Separate services	Mail with one provider, files and calendar with another, chat with a third	The best choice for each part; less dependency	More contracts, more logins, more management
Self-hosting	You run open source software (for example Nextcloud) on your own server or a rented server	Maximum control	You handle updates, security and backups; that takes knowledge and time, every week

Many small organisations choose a middle way: a managed service running on open source software. Then a provider manages the server, but you can move to a different provider or to self-hosting with the same software if that's ever needed. Self-hosting is only a good idea if someone has structural time for it and knows what they're doing. A Nextcloud that goes a year without updates is less secure than a well-managed service, European or not.

Certifications: what they do and don't say

Providers love to mention certifications. They're useful, but you need to know what they actually mean.

Certification	What it says	What to check
ISO/IEC 27001	The company has a management system for information security: risks mapped out, measures in place, annual review by a certification body	The scope: does it apply to the service you're taking, or only to the data centre or one department? Is the certificate valid and from an accredited body?
ISO/IEC 27701	Extension of 27001 for privacy management	Same questions about scope
NEN 7510	Dutch standard for information security in healthcare	Only relevant if you process healthcare data; then often a requirement. This is a Dutch standard: your own country may have an equivalent requirement for the healthcare sector
BSI C5	German requirements catalogue for cloud services from the Bundesamt für Sicherheit in der Informationstechnik	A report with findings, not a simple "pass"
SecNumCloud	French qualification from ANSSI for cloud services, with requirements against access under laws from outside the EU	Strict; says a lot about legal independence
SOC 2	American audit report (AICPA) on security measures	Not a certificate but a report; ask for the report, not just the logo

Two pitfalls. First: the data centre is certified, but the provider itself isn't. Then the certificate says something about power, cooling and access gates, but nothing about who can access your data. Second: a certification doesn't answer the five questions from lesson 2.1. An American service can hold ISO 27001 and still fall under the CLOUD Act.

Small providers sometimes lack certification because it costs a lot. That doesn't make them unsafe. Instead, ask specifically what measures they take: two-factor authentication for administrators, encryption, backups at a different location, update policy, a procedure for reporting data breaches.

Reading the SLA

An SLA (service level agreement) describes what a provider promises: availability, support response time, maintenance windows, and what you get if it doesn't keep its promise.

Always convert availability into actual time. 99.9% per month sounds almost perfect, but it means the service may be unreachable for just over 43 minutes a month. At 99%, that's over seven hours. Also check whether planned maintenance counts, and what the compensation is: often a small credit, not a reimbursement of your damages.

Also read what's missing. Important points that belong in an SLA or the terms:

how long and where backups are kept, and whether you can restore something yourself;
how quickly a security vulnerability is fixed;
how you're informed during an outage (status page, email);
what happens to your data after you cancel (lessons 2.3 and 8.2).

Try it, ask, test

Paper is patient. So don't compare based on the website alone:

Take a trial period or a small package, and put a real test set into it: a few mailboxes, a calendar with recurring appointments, a folder with your trickiest documents (lesson 6.5).
Ask support a real question, for example "How do I export everything if I leave?" Pay attention to the speed, the language, and whether the answer is correct.
Request the documents: data processing agreement, sub-processor list, SLA, certificates with their scope.
Ask for references from an organisation similar to yours, and call them.
Do an export test before you sign.

A comparison table that works

Put providers in columns and your requirements in rows. Fill each cell with a fact and its source, not an impression. Example of a few rows for the bakery:

Requirement	Level	Provider A	Provider B	Provider C
European owner	must	yes (trade register)	no (parent in the US)	yes (annual report)
Data and backups in the EEA	must	yes (DPA annex 1)	yes	yes, backup in CH (adequate)
IMAP, CalDAV, CardDAV	must	yes (tested)	own app only	yes (tested)
Export of everything in standard formats	must	yes (tested)	partly	yes
Online office suite	should	yes	yes	no
Support in your own language	should	yes	no	yes

Provider B is out on two must-requirements, however good the rest looks. Between A and C, you decide based on the should-requirements.

In practice: what it looks like with a provider

A WebOké Nextcloud is an example of a managed service running on open source software: you can choose between a shared environment and your own server per package, and the software is the same Nextcloud you can also run with other providers or by yourself. Other European providers offer comparable forms: all-in-one services with mail, storage and calendar (for example mailbox.org, Infomaniak, Proton or IONOS), separate mail services (for example Posteo or Tuta), and servers for self-hosting (for example from Hetzner, OVHcloud, Scaleway or STACKIT). This course won't choose for you: use your requirements list.

Summary

Start with your own requirements, split into must, should and could. Keep the must-list short.
Choose deliberately between all-in-one, separate services and self-hosting; self-hosting takes structural knowledge and time.
A certification mainly says something within its scope, and doesn't answer the ownership question.
Convert availability into actual time and read what's missing from the SLA.
Test with a trial period, a real support question and an export test before you sign.

Quiz

Exercise

Exercise E2.4: Your own list of requirements and comparison. Create a requirements list with at least five must-requirements and three should-requirements. Use it to compare two or three providers in a table like the one above, with a fact and a source in each cell. Explain in three sentences which provider you would choose and why.

Exercise E2.4: Your own list of requirements and comparison

Draw up a list of requirements and compare two or three providers (columns: requirement, level must/should/could, provider 1, 2, 3).

I've checked a quality mark against its scope.
I've converted the SLA availability into minutes per month.
I've done or planned an export test.
I've asked support a real question.

Your list of requirements: at least 5 must-haves and 3 should-haves, per must-have per provider yes / no / unknown with source.

Conclusion in 3 to 5 sentences: which provider and why; which provider fails on a must-have?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing