Technical privacy assessment of Nextcloud

As part of SURF’s evaluation of open-source alternatives to Office 365, I led the technical analysis of Nextcloud Enterprise and co-authored the technical appendix with Sjoera Nas of Privacy Company. I set up Nextcloud All-in-One on SURF Research Cloud and tested Files, the Office applications, Calendar and Talk, including selected AI features. I used scripted user scenarios to trace data flows, inspect server-side audit and interaction logs, and examine privacy settings, diagnostic and support features, cookies, email communications, and responses to data access requests.

My analysis focused on what information leaves an institution’s self-hosted environment, what administrators can configure, and what personal data Nextcloud processes through its own services. I found no customer content data being sent to Nextcloud. I did identify risks involving administrator and commercial contact details, support interactions, optional diagnostic reports, website activity, and email communications. Together with the assessment team, I documented mitigations and commitments, including clearer consent choices for optional reports, changes to email tracking, contractual controls, and guidance for institutions on configuration, data minimisation, log access, and retention.

The DPIA identified 15 risks, all assessed as low or resolved following the agreed measures. SURF consequently issued a positive recommendation for use of Nextcloud Enterprise under the tailored data processing agreement for Dutch education and research institutions. This gives institutions evidence to consider a self-hosted, open-source collaboration platform as part of their digital sovereignty strategy, while retaining responsibility for appropriate deployment and administration.