Understanding what an Outlook alternative actually needs to do to keep mail in Europe

Switching your inbox region doesn't change who owns the data

If you've ever ticked "EU data region" in Microsoft 365 or Google Workspace and considered the jurisdiction problem solved, here's the uncomfortable part: it isn't. The US CLOUD Act (2018) says a provider under US jurisdiction must hand over data under its possession, custody or control when a US court orders it, regardless of which country the servers physically sit in. The law tracks the company, not the data centre. Let's get into why that matters for anyone planning a real outlook alternative, and what actually has to change under the hood.

The jurisdiction problem, in plain terms

Outlook is the client. Microsoft 365 is the service. For most orgs those have merged into one experience, but legally they're two different things, and the service is what matters here.

• Microsoft Corporation: American company, subject to US law
• Google LLC: American company, subject to US law
• CLOUD Act: applies based on custody, not server location

Meanwhile GDPR Chapter V (Articles 44-50) restricts personal data leaving the EEA without an adequacy decision or safeguards like SCCs. Article 48 is the key detail most teams miss: a foreign court order doesn't automatically make a transfer lawful. Article 24 puts the compliance burden on you, the controller, not the vendor.

These two legal regimes don't reconcile cleanly, and the courts have said so three times:

1. Safe Harbor, struck down by the CJEU in 2015
2. Privacy Shield, struck down in Schrems II (July 2020), over FISA Section 702 giving EU citizens no real remedy against US government access
3. EU-US Data Privacy Framework, adopted 10 July 2023, currently in force, but under active challenge: dismissed by the EU General Court on 3 September 2025, appealed 31 October 2025, and now pending before the CJEU

If you want the sworn-testimony version of this: on 10 June 2025, Microsoft France's director of public and legal affairs, Anton Carniaux, was asked under oath before a French Senate inquiry whether he could guarantee French citizens' data would never be handed to the US government without French authorisation. His answer: "Non, je ne peux pas le garantir" ("No, I cannot guarantee that"), while noting it hadn't happened so far. No guarantee, no known incident. Both halves matter.

Where the exposure actually lives in the mail pipeline

When mail moves through Microsoft 365, it typically passes through multiple Microsoft-controlled systems, each one a separate copy:

Send -> Exchange Online mailbox
     -> Spam/malware filtering
     -> Journaling/compliance archive
     -> Legal hold / eDiscovery store (if applicable)

Every one of those is under Microsoft's custody regardless of region settings. Picking an EU data centre changes the postal address of the hardware. It does not change who has custody.

What a real migration actually requires

Say you're moving a 40-person org off Microsoft 365: Outlook, OneDrive, Teams, plus a shared info@ mailbox watched by three people. Here's the checklist, piece by piece:

Protocols the new provider must support:

IMAP / SMTP   -> mail
CalDAV        -> calendar
CardDAV       -> contacts

If the replacement is web-app-only with no protocol support, you've just swapped one lock-in for another.

Shared mailbox permissions: info@ needs multi-user access control without issuing separate logins per person.

DNS/auth records to rebuild:

SPF record  - sender authorization
DKIM record - message signing
DMARC record - policy enforcement

Get these wrong and your outgoing mail gets flagged as spam.

Client UX: People are used to the three-pane layout (folders / message list / reading pane). Force everyone into a browser tab and adoption drops, independent of how solid the backend is.

File sync: Needs to replicate "files on demand" behavior, files show as available without consuming local disk until opened.

Meetings: Guests need to join via browser link, no install required, since you can't mandate your internal tooling on every client or supplier.

How Binadit Workspace addresses this

Binadit Workspace covers that full checklist as one product, one login, on the customer's own domain:

• Mail/calendar/contacts over IMAP, SMTP, CalDAV, CardDAV, and JMAP, so existing clients keep working
• Shared mailboxes with per-colleague permissions
• DNS records (MX, SPF, DKIM, DMARC, autoconfig) placed automatically via Binadit's own DNS tool
• Northmail: free macOS/Windows mail client in the familiar three-pane layout, connects to Workspace, on-prem Exchange, and Gmail simultaneously, useful during phased migrations

Bottom line

An outlook alternative isn't about finding a nicer inbox UI. It's about finding a provider under a different legal jurisdiction, one that actually replaces the full protocol stack your org depends on, not just the icon on the desktop.

Full writeup with the legal citations: https://binadit.com/blog/outlook-alternative-keeps-mail-in-europe

Originally published on binadit.com