Collaboration Under Your Control. Made and Hosted in Germany.
xworks.365 is the German answer to Microsoft 365 and Google Workspace. Keep your business data, communication and documents under your own control – GDPR-compliant, BSI-certified and operated in German high-security data centers.
Certified & Trustworthy
ISO 27001
Certified
GDPR
Compliant
Made in
Germany
What is digital sovereignty?
Digital sovereignty is an organisation’s ability to decide independently about its data, the technology it uses and how its IT is operated – without becoming legally, technically or economically dependent on single vendors or third countries.
The term is often used interchangeably with "data sovereignty". In practice digital sovereignty is broader: beyond the storage location it covers the provider’s legal entity, the operations and support chain, control over encryption keys and the ability to leave a solution at any time.
For companies and public sector buyers, digital sovereignty is therefore not merely a data centre question but a procurement and architecture decision: which dependencies are created, how can they be limited, and which evidence do you require from the provider.
The four dimensions of digital sovereignty
Data sovereignty
All primary, backup and log data stays in the EU. You decide who has access, how long data is retained and when it is deleted.
Legal sovereignty
The contracting party is governed exclusively by EU law. No extraterritorial disclosure obligations such as the US CLOUD Act.
Technological sovereignty
Open standards and documented interfaces instead of proprietary formats. Switching providers remains technically feasible at all times.
Operational sovereignty
Operations, administration and support are delivered from the EU – including everyone who can access systems during an incident.
How do you achieve digital sovereignty?
Six steps for companies and public authorities to increase their digital sovereignty systematically.
Inventory your dependencies
Record every cloud service in use along with its legal entity, storage locations and subprocessors. This regularly surfaces unplanned shadow IT.
Define the protection level of your data
Classify data by confidentiality and criticality. Not every document needs the same protection level – but every class needs a decision.
Review the legal framework
Assess GDPR compliance, Schrems II risks and the reach of the US CLOUD Act per provider. The legal entity matters more than the server location.
Select a sovereign platform
Ask for verifiable evidence: EU legal entity, EU data centres, EU support, certifications such as ISO/IEC 27001 and BSI Grundschutz, plus open interfaces.
Plan the migration in waves
Start with a pilot group, then migrate department by department. Parallel operation via open standards such as IMAP and CalDAV reduces risk.
Keep your exit capability alive
Test a full data export regularly – not only when terminating. Open formats and documented APIs keep a switch possible at any time.
The steps apply to any provider. With xworks.365, steps 3 to 6 are already covered by legal entity, certifications and open standards.
Why digital sovereignty matters now
Avoid Vendor Lock-in
Many companies depend on US clouds. xworks.365 offers an independent alternative with proprietary technology and open standards.
GDPR & Schrems II
Data stays in Germany. No transfer to third countries, no unsafe data processing practices.
Reduce Shadow IT
Give employees one central, secure platform instead of uncontrolled tools that create compliance risks.
Sovereignty You Can Measure
Eight pillars on which xworks.365 delivers digital sovereignty for businesses.
German Hosting
Operated in German high-security data centers with redundant locations.
No External CDNs
We do not load trackers or third-party scripts. Privacy by design.
GDPR & GoBD
Fully GDPR-compliant and GoBD-capable for audit-proof archiving.
BSI IT Security Label
Certified according to BSI Grundschutz for trustworthy communication.
ISO 27001
Certified information security management for your mission-critical data.
Open Standards & APIs
IMAP, POP3, CalDAV, CardDAV and REST APIs for maximum interoperability.
End-to-End Encryption
Secure communication with modern encryption across all channels.
Roles & Permissions
Granular access control for administrators, teams and external partners.
Everything Teams Need – In One Sovereign Platform
xworks.365 unites the most important business functions under your control.
For Organizations That Take Sovereignty Seriously
Law and compliance at a glance
The regulations that determine whether a cloud solution is truly sovereign.
GDPR-compliant cloud
Data processing under Art. 28 GDPR, documented technical and organisational measures, deletion concepts and data subject rights – fully implemented inside the EU.
US CLOUD Act
xworks.365 is operated by a German company and is not subject to extraterritorial disclosure obligations towards US authorities.
Schrems II
No third-country transfer, no standard contractual clauses and no supplementary measures required, because processing never leaves the EU.
BSI Grundschutz
Security architecture following BSI requirements, awarded the BSI IT security label for trustworthy communication services.
ISO/IEC 27001
Certified information security management system covering operations, data centre and development processes.
Gaia-X and the European cloud
Open standards, data portability and transparency across the operations chain – the principles European data infrastructures build on.
Key terms around digital sovereignty
Data sovereignty, sovereign cloud, data residency – the essential terms explained.
- Data control
- The right and the practical ability to dispose of your own data: access, sharing, retention and deletion remain in your hands.
- Data sovereignty
- The enforceability of data control in day-to-day operations – technically through encryption and permission models, legally through contracts and jurisdiction.
- Sovereign cloud
- A cloud environment operated entirely under EU law: EU legal entity, EU data centres, EU support, key custody with the customer or the European operator.
- Data residency
- Describes only the geographic storage location. Data residency in Germany alone does not make a solution sovereign.
- US CLOUD Act
- US law requiring US providers to hand over data to US authorities – regardless of storage location and including European subsidiaries.
- Schrems II
- The 2020 CJEU ruling that invalidated the Privacy Shield and requires additional safeguards for data transfers to third countries.
- Gaia-X
- European initiative for a federated, interoperable data infrastructure with shared rules on transparency, portability and self-determination.
- Vendor lock-in
- Dependency on one provider because data, formats or processes cannot be migrated without substantial effort.
Frequently asked questions about digital sovereignty
The key answers for decision makers.
Related questions
Further answers on digital sovereignty, data sovereignty and compliance.
Data sovereignty & sovereign cloud
What is a sovereign cloud?
A cloud environment with a European legal entity, storage and processing in the EU, operations and support from within the EU, and full customer control over keys, configuration and data export.
See the twelve-point checklistWhere is my data stored?
Exclusively in our own ISO/IEC 27001-certified data centre in Germany (Ahaus, Münsterland) – with no data transfer to third countries.
Learn about security and our data centre
Compliance & law
What does the US CLOUD Act mean for European companies?
US companies must hand over data on request from US authorities – regardless of storage location and including their European subsidiaries.
Go to the US CLOUD Act topic pageWhat does the Schrems II ruling mean for cloud services?
Data transfers to the US require additional safeguards and case-by-case assessments. Processing exclusively inside the EU avoids these obligations.
Go to the Schrems II topic pageWhat makes a cloud GDPR compliant?
A data processing agreement under Art. 28 GDPR, documented technical and organisational measures, transparent sub-processors, clear retention periods and a complete data export.
See the GDPR cloud checklistWhat role do Gaia-X and BSI IT-Grundschutz play?
Gaia-X provides a European framework for interoperable cloud services, BSI IT-Grundschutz concrete building blocks for technical and organisational protection.
Go to the Gaia-X topic page
Alternatives & migration
Is there a sovereign alternative to Microsoft 365?
xworks.365 covers email, calendar, contacts, files, document editing and video conferencing in one integrated platform – operated by a German company in Germany.
See all features at a glanceHow do I avoid vendor lock-in?
Open standards (IMAP, SMTP, CalDAV, CardDAV, WebDAV), open document formats and a complete self-service export – contractually settled during selection.
Compare sovereign cloud approachesWhat does a sovereign migration look like in practice?
A model scenario for a municipal administration shows the architecture, migration plan and measurable KPIs of a sovereign collaboration platform.
Read the public administration case study