Checked against the sources linked below on 23 October 2026. We make Beebeeb, a competitor, so we say where a sentence is our own reading and where we could not check something.
The OneDrive problem is not OneDrive
OneDrive is good software: the sync client is mature and the Office integration is useful. The question for an EU team holding client records or special-category data is jurisdiction. Microsoft is a US company, and that decides which legal process can reach files it holds. This post is for teams already on Microsoft 365 who want an EU-jurisdiction home for their most confidential files. It is not a teardown.
Residency is not the same as jurisdiction (our reading)
Microsoft’s EU Data Boundary is about where data is stored and processed. Microsoft documents that it has exceptions: its own page on Copilot flex routing mentions “limited pseudonymized data” stored outside the boundary and ongoing partial transfers (Microsoft Learn: Copilot flex routing). That is a residency question. Who can be served legal process is a separate question that depends on the company’s jurisdiction.
The US CLOUD Act (18 U.S.C. § 2713) says providers subject to US jurisdiction must disclose the contents of communications and records in their “possession, custody, or control” regardless of whether the data is located inside or outside the United States, subject to legal process (statute text). How that interacts with the GDPR is a legal analysis we are not giving here; the statute does not by itself decide it.
What Microsoft told the French Senate
On 10 June 2025, at a French Senate inquiry commission on public procurement, Microsoft France’s legal and public-affairs director Anton Carniaux was asked, under oath, whether he could guarantee that data held via the public-procurement body Ugap would not be passed to the US government without explicit French authorisation. According to the Senate record he answered: “Non, je ne peux pas le garantir, mais, encore une fois, cela ne s’est encore jamais produit” (“No, I cannot guarantee it, but, once again, it has never happened so far”). (Senate record) The question concerned Ugap data, not all French citizens’ data. We read the answer as an acknowledgement that no guarantee is possible; Microsoft may read it differently.
Copilot flex routing
Microsoft’s documentation says that, with flex routing on, “LLM inferencing may occur in the United States, Canada, or Australia during times of peak demand.” It says flex routing is on by default for eligible tenants created after 25 March 2026, that older tenants are encouraged to check their setting, that admins can change it at any time, and that data at rest stays in the EU Data Boundary apart from limited pseudonymized data. (Microsoft Learn) This concerns Copilot inference, not OneDrive file storage. We mention it because it shows the boundary has settings an admin has to know about.
What the EDPB says
The European Data Protection Board’s Recommendations 01/2020 on supplementary measures describe encryption as an effective measure for transfers only where the keys stay solely under the control of the data exporter or of an entity in the EEA or an adequate country (EDPB Recommendations 01/2020). That is the EDPB’s position as we understand it; we did not re-read the full text for this post, so check it before relying on it. The EDPB has also said, as we understand it, that a third-country court order is not by itself a basis for a transfer under the GDPR; Article 48 requires an international agreement.
The lock-in is real (our reading)
OneDrive is one part of a suite: identity in Entra ID, mail in Exchange, collaboration in SharePoint and Teams. Leaving means unpicking sync clients, known-folder redirection and permissions that were not built to be portable. In our experience that makes moving a project, not a switch. The practical goal is not ripping out Microsoft 365 overnight; it is moving the files that matter to a place where the legal question has a cleaner answer.
What Beebeeb does, and what it does not
Beebeeb encrypts files on your device with AES-256-GCM before upload and derives your keys with Argon2id, so we store ciphertext and cannot read your files. The apps (web, desktop, iOS and the CLI) are open source; the server is not. Beebeeb is operated by an EU company and files are stored in the EU. See the encryption page for the detail.
Now the limits. Beebeeb does not replace Microsoft 365: no Word, no Excel, no Teams, no shared mailbox. It replaces the storage layer for files you want kept private. There has been no independent security audit yet. We have no investors and pay for Beebeeb from our own savings and income, and so far that money has gone into building Beebeeb, not into an audit. Because the web, desktop, iOS and CLI apps are open source, you can review the code yourself. We cannot recover your files if you lose both your password and your recovery phrase. Our Teams plan is coming soon, so today we are better suited to individuals and small groups than to a company-wide rollout. There is no free plan, only a free trial. On ecosystem depth Microsoft is far ahead. For pricing, see our plans and the dated price comparison; we have not put Microsoft’s prices in this post because we could not read them from Microsoft’s page when we checked.
How teams usually start
Move the sensitive subset first (HR records, client deliverables) and leave routine Office collaboration where the tooling is strong. Encrypted sharing with expiry, passphrase and revocation covers much of what teams use SharePoint links for. For the wider field, see European cloud storage and our side-by-side comparisons.
Common questions
Is OneDrive GDPR compliant? We are not giving a legal opinion. Microsoft publishes its own compliance documentation, and the question for many teams is jurisdiction and transfers, not whether OneDrive has GDPR features.
Is OneDrive end-to-end encrypted? We did not verify Microsoft’s current key-custody documentation for this post, so we make no claim either way; check Microsoft’s own pages.
Where does OneDrive store EU data? Microsoft says its EU Data Boundary keeps EU customer data in the EU, with documented exceptions such as limited pseudonymized data.