When your contract comes up for renewal, pick a project your team knows well. Ask who can read its messages, where copies are kept and how to retrieve the whole record if you leave.
Digital sovereignty can start with these questions. To make a decision, translate it into capabilities you can verify: knowing which organisations are involved, choosing the terms of access, and retaining a practical ability to change how the service is organised.
Map a message's journey
Ask your provider to follow an email from arrival to archiving. The map should include transport, spam filtering, active storage, backups, technical support and, where used, AI processing. For each stage, record the operator, country, retention period and people authorised to intervene.
This prevents the discussion from being reduced to a data centre address. France's data protection authority, the CNIL, recommends examining backups, remote access and possible data flows to providers and their subprocessors as well. CNIL, identifying transfers outside the EU.
Work through a real business case, such as a confidential tender. You can then distinguish what the service needs to operate from what should be restricted. Include a user in the discussion: they know about file copies and workarounds that a technical diagram may miss.
Read the commitments behind the labels
A software company's origin, the location of its servers, application security and compliance of data processing answer different questions. Request evidence for each: the organisations involved, the architecture, contractual commitments and control measures.
The French cybersecurity agency ANSSI explains that SecNumCloud qualification applies to a cloud offering and does not establish the security of every application hosted on it. When a qualification is presented, check the exact service, version and scope it covers. ANSSI, SecNumCloud FAQ.
For personal data, the agreement with the processor also needs scrutiny. The CNIL highlights responsibilities, security measures, incident notification, and arrangements for returning or destroying data. Those commitments should be assessed against how your business actually operates. CNIL, managing data processors.
Test the exit before committing
A demonstration usually shows how to find a message. Also ask how to leave with a complete project record. Prepare a sample containing attachments, several participants, shared permissions and older messages. Have it exported, then check whether another tool can use it in practice.
The EU Data Act includes provisions intended to make switching between data processing service providers easier. Their application depends on the service and contract concerned; they do not, by themselves, make two applications interchangeable. European Commission, Data Act explained.
Your project should therefore specify who manages migration, which elements are transferred and which need separate handling. Recovering email history does not automatically reproduce rules, delegated access or filing habits. Budget for user support and for any period when two environments may need to run alongside one another.
Assign responsibility for local storage
Keeping exchanges on local storage over the long term can give the business direct control over its archives. This option needs an operating model: a named owner, controlled access, separate backups and recovery tests that have actually been completed. Establish what remains available if a workstation, server or internet connection fails.
Orvile Mail is commercially available and keeps correspondence over the long term in working folders on the company’s local storage. When planning your installation, it is still essential to describe message transit, any temporary copies and associated services. The word “local” does not describe every stage of processing on its own.
Decide through three real situations
Before choosing, bring management, the IT lead and two users together for three exercises: finding a project record after a colleague has left, restoring a deleted message, and preparing an export to move to another tool. Agree what success looks like before the demonstration starts.
Finally, ask for the important commitments to be included in the documents supplied to your business. This gives everyone a common basis for choosing an email service, planning its deployment and checking over time that the expected level of control is being delivered.