French Region Dumps Microsoft for Sovereign Hexagone Suite | Data Privacy

The Communauté de communes Causses et Vallée de la Dordogne, a local government collective in the Lot department of Occitanie, France, is transitioning away from Microsoft 365 in favor of Hexagone, a collaborative suite developed by Interstis Solutions. This move, reported earlier this week, reflects a growing concern among European organizations about digital sovereignty and the potential risks associated with reliance on US-based technology providers.

Digital Sovereignty and the Risks of Extraterritorial Laws

The decision stems from findings by the consulting firm Lecko, which revealed that approximately 80% of French companies with over 250 employees utilize digital solutions originating in the United States. This dependence exposes these organizations to the reach of US extraterritorial laws, such as the Cloud Act and the Foreign Intelligence Surveillance Act (FISA). Interstis, the creator of Hexagone, emphasizes that this isn’t merely a legal concern, but too a financial one. They point to potential cost increases associated with Microsoft’s subscription model, citing a potential 50% rise in total costs over a five-year period for organizations using Microsoft’s E3 offering due to successive price revisions and the addition of recent features.

The concept of digital sovereignty – the idea that a nation or organization should have control over its own data and technological infrastructure – is gaining traction globally. Concerns about data privacy, security, and the potential for foreign government access to sensitive information are driving this trend. The European Union, for example, has been actively promoting initiatives like GAIA-X, a project aimed at creating a secure and federated data infrastructure for Europe. The Causses et Vallée de la Dordogne region’s move with Hexagone aligns with this broader push for greater technological independence.

Hexagone: A Regional Solution

The EPCI lotois (Etablissement Public de Coopération Intercommunale) chose Hexagone after consulting resources provided by the Agence Nationale de la Sécurité des Systèmes d’Information (ANSSI), the French national cybersecurity agency. Notably, Interstis Solutions maintains a presence in Montpellier, France, making Hexagone a partially regional solution. This localization is a key benefit for the Causses et Vallée de la Dordogne, as it supports local businesses and reduces reliance on foreign entities.

Hexagone offers a suite of collaborative tools including email, calendar, document editing, and video conferencing. According to Thomas Balladur, CEO and co-founder of Interstis Solutions, Hexagone now matches Microsoft’s functionality for approximately 98% of use cases. The remaining 2% primarily concerns advanced users who rely on complex Excel macros. This suggests that for the vast majority of users, the transition to Hexagone should be relatively seamless.

Deployment and User Adoption

The rollout of Hexagone to the more than 200 employees of the EPCI is being implemented progressively, accompanied by training and support. Weekly presentations are being used to facilitate user adoption and familiarize staff with the new tools. Early feedback indicates that the video conferencing feature is particularly well-received, praised for its simplicity and ease of use. The Causses et Vallée de la Dordogne is a region rich in heritage and landscapes, and effective communication tools are vital for managing tourism and local services.

Beyond Functionality: Security and Data Control

Although functional parity is important, the primary driver for the switch to Hexagone is enhanced security and data control. By using a European-based solution, the EPCI lotois reduces its exposure to US legal frameworks that could compel the disclosure of data to US authorities. This is particularly relevant for organizations handling sensitive citizen data or confidential government information. Hexagone’s architecture is designed with data sovereignty in mind, ensuring that data remains within the jurisdiction of the European Union.

The Cloud Act, for example, allows US law enforcement to compel US-based technology companies to provide data stored on their servers, regardless of where those servers are located. Similarly, FISA allows for the surveillance of foreign intelligence targets, potentially including data held by US companies. These laws raise concerns about the privacy of European citizens and the potential for undue government access to data.

The Broader Trend of Sovereign Tech

The Causses et Vallée de la Dordogne’s decision is part of a larger movement towards sovereign technology solutions in Europe. Several other organizations and governments are exploring alternatives to US-dominated platforms in areas such as cloud computing, messaging, and operating systems. The Lot department, where the EPCI is located, is known for its commitment to preserving its cultural heritage and promoting sustainable development, and this move aligns with those values.

This trend is not without its challenges. Developing and maintaining sovereign technology solutions requires significant investment and expertise. Interoperability with existing systems and the need to build a critical mass of users can be obstacles to adoption. However, the growing awareness of the risks associated with digital dependence is driving momentum behind these initiatives.

What Comes Next: Rollout and Potential Expansion

The EPCI lotois will continue to monitor user feedback and refine the Hexagone deployment process. The focus will be on ensuring a smooth transition for all employees and maximizing the benefits of the new platform. The success of this project could serve as a model for other organizations in France and across Europe looking to enhance their digital sovereignty. Further evaluation will likely focus on long-term cost savings, security audits, and the integration of Hexagone with other local government systems. The region’s experience will be closely watched as a case study in the practical implementation of digital sovereignty principles.