Microsoft OneDrive for Business vs Nextcloud Files (Nextcloud Hub)

Microsoft OneDrive for Business

Windows and Mac sync apps plus iOS and Android apps are documented, with Files On-Demand in File Explorer and Known Folder Move for desktop and documents folders — my staff's machines are covered. However, I found no public information on a Linux client, on access via WebDAV, SFTP or S3, on block-level sync, on file size limits, or on full-text search inside documents, so the evidence reaches a mid level.

Nextcloud Files (Nextcloud Hub)

Sync clients for Windows, Linux and Mac plus Android and iOS with automatic photo and video upload and selective sync are documented, a virtual drive keeps files visible on demand, full-text search runs on ElasticSearch or Solr, and WebDAV, SFTP and S3 access is described. We found no public information on block-level or delta sync, file size limits, or large-folder performance figures, which keeps it short of the top band.

Microsoft OneDrive for Business

File requests let my clients upload receipts without an account, Anyone links can be forced to expire and restricted to view-only, domains can be allowed or blocked up to 5,000 entries, guest access expires on an admin-set clock with revocation typically within one hour, and identity verification for new guests is documented. Password-protected links, download limits and no-download view are not described, and the record of who opened or downloaded what appears only as viewer information retained for administrator audit — close to data-room practice, but not all of it is on the page.

Nextcloud Files (Nextcloud Hub)

This is what my practice needs: File Drop upload links with password, expiry and a unique link per customer, even into end-to-end encrypted folders, alongside enforced passwords and expiry, hide-download, watermark-protected secure view, video verification before access, a data room with audit log, guest accounts, file locking, co-editing with Collabora named, and an Outlook add-in. We found no public information on per-link download limits, comments, or revocation that reaches copies already opened.

Microsoft OneDrive for Business

TLS in transit and AES 256-bit at rest with unique per-file keys, FIPS 140-2 Level 2 validation of the encryption process, a 93-day recycle bin, restore of files to any point over the past 30 days, and Conditional Access with real-time identity risk detection are all documented. For my §203 duty the decisive point: encryption at rest runs inside Microsoft's service, Customer Key in Azure Key Vault is a documented option, and I found no public information on end-to-end encryption that would keep files unreadable to the provider, nor a named independent audit or ISO 27001, SOC 2 or BSI C5 certification with scope on these pages.

Nextcloud Files (Nextcloud Hub)

End-to-end encryption is opt-in at folder level rather than default, but the server is documented as zero-knowledge, keys sit with the user as a 12-word mnemonic with an optional offline master recovery key for administrators, and a whitepaper invites scrutiny of the cryptography; TLS and AES-256, enforceable two-factor including FIDO2, SAML single sign-on, a $10K bug bounty on HackerOne, and ISO 27001, BSI IT-GRUNDSCHUTZ and an ANSSI CSPN certification are stated, with the compliance documents covering the Enterprise edition only. We found no public information on ransomware detection or restoring a whole account to a point in time.

Microsoft OneDrive for Business

The SharePoint admin center covers organisation-level sharing settings, default storage per user, access control by unmanaged device or network location, and retention of deleted users' data (default 30 days), while Purview adds retention policies and labels, eDiscovery hold that blocks deletion, records with proof of disposition for up to seven years, and DLP conditions — deep enough for a practice like mine. Remote wipe, SCIM provisioning verbatim, export of the audit log and SIEM streaming are not described on the captured pages.

Nextcloud Files (Nextcloud Hub)

Provisioning from LDAP, Active Directory and Azure AD, configurable retention rules with tag-based control, automatic classification labels, File Access Control by location, group and file type, remote wipe, ownership transfer when someone leaves, team folders with quotas, and a full audit log that can be written to its own file are all documented. We found no public information on SCIM, legal hold or streaming to a SIEM, and a captured community answer states the audit app cannot log directly to syslog, which keeps this short of the top band.

Microsoft OneDrive for Business

Connecting is excellent: a documented Microsoft Graph REST API with SDKs across many languages and platforms, webhooks, a delta API, file picker and file handler SDKs, PowerShell, and integrations with Outlook, Teams and Excel. On leaving, I found no public information on bulk export of all files with the folder structure, migration tools from a named provider, open-protocol access, a self-hosted edition, or what happens to the data after cancellation.

Nextcloud Files (Nextcloud Hub)

The product is fully open source on GitHub and runs self-hosted on the customer's own infrastructure, WebDAV, S3 and SFTP make migration tool-independent, a REST (OCS) API and a 600-plus app store exist, and a dedicated migration service covers Microsoft 365, Google Workspace, DRACOON, Box, Dropbox and ownCloud, with a user migration app for moves between instances. We found no public information on SDKs, webhooks or deletion terms on termination, and captured community answers state that shares cannot generally be re-created on another system and that the user migration app must be installed first.

Microsoft OneDrive for Business

The EU Data Boundary commits to storing and processing customer data in named datacenter countries including Germany, and the Data Protection Addendum is published and downloadable. But this is a US-headquartered vendor, residency is conditional — forfeited when Multi-Geo is purchased and subject to stated limited transfers outside the boundary — and I found no public information on the contracting entity's jurisdiction or on a subprocessor list with locations, so the chain is only partly evidenced as European.

Nextcloud Files (Nextcloud Hub)

The contracting entity is Nextcloud GmbH of Stuttgart, registered at AG München, which offers no hosting and states its employees never gain access to customer data — files stay on the customer's own servers; the vendor's own subprocessors for portal, support and licensing are listed with their locations and transfer mechanisms, a data processing disclosure is published, and ISO 27001 and BSI IT-GRUNDSCHUTZ are stated for the Enterprise edition. Not the top band: parts of the vendor's own chain run through providers in the United States and Korea, and the certifications are scoped to Enterprise with the hosting party responsible.

Microsoft OneDrive for Business

Storage per plan is public — 1 TB per user on the business plans and E3/E5, increaseable to 5 TB on E3/E5, 2 GB on F3 — and the Multi-Geo add-on carries a stated licensing rule of at least 5% of eligible users through Enterprise Agreement, Web Direct or CSP, with a free 30-day trial available. But I found no public per-user prices in currency on the captured pages, additional tenant storage goes through a Microsoft representative, and minimum term and VAT treatment are not stated, so I cannot compute an annual cost for eleven staff from these pages.

Nextcloud Files (Nextcloud Hub)

Three tiers are public with prices quoted exactly as Standard starting at 100 users for 71.29€/user/year, Premium at 104.99€/user/year and Ultimate at 204.75€/user/year, alongside 200-user prices of 53.17€, 81.99€ and 183.75€, prices in Euro per year net/excl. VAT, a stated minimum of 100 users, and a feature matrix showing which tier carries Assistant, Flow, clustered support or SLA on fixes. We found no public information on what the separately purchasable optional components cost or on the minimum contract term.