Microsoft Corporation is a US company headquartered in Redmond, Washington. Under the CLOUD Act (18 U.S.C. § 2713), every Teams meeting, Copilot AI transcript, and Teams Chat message handled through Microsoft infrastructure is subject to US government compelled disclosure — regardless of data centre location. In June 2025, Microsoft's own executive admitted this under oath before the French Senate. Switzerland's data protection commissioners have formally restricted Microsoft 365 for sensitive data. France is migrating to a sovereign Matrix-based alternative.
The same meetings, AI transcripts, and persistent messaging — with one critical difference: who has legal access to everything your organisation says.
| Feature | Teams Essentials $4/user/mo | M365 Business Basic $6/user/mo | M365 Business Standard $12.50/user/mo | M365 E3 Enterprise $36/user/mo | AMVLET · Matrix Sovereign |
|---|---|---|---|---|---|
| Meetings & Video | |||||
| Video conferencing | ✓ | ✓ | ✓ | ✓ | ✓ |
| Max attendees | 300 | 300 | 300 | 1,000 | Unlimited |
| Screen sharing | ✓ | ✓ | ✓ | ✓ | ✓ |
| Breakout rooms | ✓ | ✓ | ✓ | ✓ | ✓ |
| Webinars & large events | ✗ | ✗ | Add-on | ✓ | ✓ |
| Recording & Storage | |||||
| Meeting recording | ✗ | Microsoft cloud only | Microsoft cloud only | Microsoft cloud only | Your sovereign storage |
| Recording jurisdiction | — | Microsoft / US | Microsoft / US | Microsoft / US | Your jurisdiction |
| SharePoint & OneDrive storage | ✗ | Microsoft / US | Microsoft / US | Microsoft / US | Your jurisdiction |
| AI & Transcription | |||||
| AI meeting summaries | ✗ | Copilot — add-on | Copilot — add-on | Copilot — add-on | Optional — on-prem |
| AI transcription | ✗ | Microsoft processes content | Microsoft processes content | Microsoft processes content | Optional — sovereign |
| AI action items & follow-ups | ✗ | Microsoft AI — US jurisdiction | Microsoft AI — US jurisdiction | Microsoft AI — US jurisdiction | Optional — sovereign |
| AI data jurisdiction | — | Microsoft / US | Microsoft / US | Microsoft / US | Your jurisdiction |
| Messaging & Calling | |||||
| Persistent team messaging | ✓ | ✓ | ✓ | ✓ | ✓ |
| Voice & video calling | ✓ | ✓ | ✓ | ✓ | ✓ |
| Phone (PSTN calling) | ✗ | Add-on | Add-on | Add-on | ✓ |
| End-to-end encryption | 1:1 calls only | 1:1 calls only | 1:1 calls only | 1:1 calls only | E2EE by default |
| Sovereignty & Security | |||||
| Data jurisdiction | Microsoft / USA | Microsoft / USA | Microsoft / USA | Microsoft / USA | Your jurisdiction |
| CLOUD Act exposure | YES — Microsoft | YES — Microsoft | YES — Microsoft | YES — Microsoft | NO |
| GDPR Art. 48 conflict | YES | YES | YES | YES | None |
| PDPL (Saudi Arabia) conflict | YES | YES | YES | YES | None |
| Gag order risk (§ 2705(b)) | YES | YES | YES | YES | Not applicable |
| Executive admission under oath | French Senate 2025 | French Senate 2025 | French Senate 2025 | French Senate 2025 | Not applicable |
| Swiss DPO restriction | Restricted | Restricted | Restricted | Restricted | Not applicable |
| Cryptographic key ownership | Microsoft | Microsoft | Microsoft | Partial BYOK | You |
| Self-hostable | ✗ | ✗ | ✗ | ✗ | ✓ |
| Air-gapped deployment | ✗ | ✗ | ✗ | ✗ | ✓ |
| Open Standard & Federation | |||||
| Open standard protocol | Proprietary | Proprietary | Proprietary | Proprietary | Matrix (open) |
| Interoperable federation | ✗ | ✗ | ✗ | ✗ | ✓ Cross-org |
| Vendor lock-in | Microsoft | Microsoft | Microsoft | Microsoft | None |
| Interchangeable clients | ✗ | ✗ | ✗ | ✗ | ✓ |
| NIS2 supply-chain compliance | Cannot satisfy | Cannot satisfy | Cannot satisfy | Cannot satisfy | Full documentation |
| EU Tech Sovereignty Package ready | No | No | No | No | Yes |
Microsoft Corporation is headquartered in Redmond, Washington. Every service it provides — regardless of data centre location — falls under US jurisdiction. This is not speculation. It is what Microsoft's own executive confirmed under oath before the French Senate on 18 June 2025.
Every Teams meeting recording — and every Copilot AI-generated transcript, meeting summary, action item, and follow-up — is stored on Microsoft-controlled US infrastructure. A single CLOUD Act order compels Microsoft to produce the complete contents of your most sensitive meetings: board sessions, legal strategy, M&A discussions, intelligence briefings, and diplomatic communications. Microsoft's own Transparency Reports confirm it regularly receives and complies with government data requests. Data centre location is legally irrelevant — the obligation follows Microsoft's corporate nationality, not its server geography.
On 18 June 2025, Anton Carniaux — Microsoft France's director of public and legal affairs — testified before the French Senate's inquiry into European digital sovereignty. Asked directly whether he could guarantee, under oath, that French citizen data could not be transmitted to the US government without France's consent, Carniaux answered: "No, I cannot guarantee that." No contractual commitment, no EU data centre, and no technical architecture Microsoft offers changes this. The CLOUD Act obligation is structural. Microsoft confirmed this under oath.
Teams messaging does not exist in isolation. Every Teams Chat message, SharePoint document, OneDrive file, and shared calendar entry is stored on Microsoft's US-jurisdiction cloud. For government organisations, this means the entire information architecture — policy documents, sensitive correspondence, financial data, personnel records, and classified attachments — sits within reach of US legal process. Switzerland's Conference of Data Protection Commissioners formally concluded that this structural exposure makes Microsoft 365 incompatible with sensitive public sector use, urging Swiss authorities to "heavily restrict" its use for sensitive data and to transition to self-hosted alternatives.
Saudi Arabia's Personal Data Protection Law (PDPL, Royal Decree M/19) restricts cross-border transfer of personal data outside the Kingdom without NDMO authorisation. When a US CLOUD Act order compels Microsoft to produce data of Saudi users or Saudi organisations — government ministries, financial institutions, healthcare providers — Microsoft must comply. There is no US–Saudi bilateral CLOUD Act executive agreement, no PDPL-compliant transfer mechanism for compelled disclosures, and no right to notify the data subject. The conflict is structurally identical to GDPR Article 48: following US law means violating Saudi law. No Microsoft contractual commitment resolves this — as Microsoft itself has now acknowledged under oath.
Under 18 U.S.C. § 2705(b), US authorities can attach a non-disclosure order to a CLOUD Act demand, legally prohibiting Microsoft from informing you that your data was requested or produced. This directly conflicts with GDPR's transparency obligations (Articles 13–14) and eliminates any practical ability to challenge the disclosure. Your ministry, legal department, or security services may have had their most sensitive discussions reviewed by a foreign government — and the law ensures you are never told. Microsoft Carniaux's Senate testimony acknowledged this risk directly: even Microsoft's challenge process does not protect against legally justified orders.
France's government has formally begun migrating to Tchap — a Matrix-based sovereign messaging platform built on the same open standard as AMVLET. Over 300,000 French civil servants are already on Tchap, with full migration from US cloud providers targeted by 2027. The EU Commission's "Tech Sovereignty Package" (CADA, May 2026) proposes restricting US cloud providers from processing sensitive EU public sector data — financial, judicial, health, and national security information. Microsoft, as a US-headquartered provider, falls directly within scope. The direction of European policy is unambiguous: Teams is being structurally excluded from the most sensitive government workloads.
The Matrix open standard (spec.matrix.org) delivers everything Teams offers — persistent messaging, video meetings, voice, file sharing, Copilot-equivalent AI — on an open, vendor-neutral protocol where your organisation controls its own server, its own data, and its own encryption keys. No Microsoft, no US jurisdiction, no CLOUD Act applicability at any layer.
France's government built Tchap on Matrix. Over 300,000 French civil servants already use it. The technology that Europe's governments are migrating to is the same open standard that powers AMVLET. This is not a theoretical alternative — it is proven, production-grade sovereign communication infrastructure deployed at national scale.
AMVLET is built on Element Server Suite (ESS Pro), the enterprise-grade implementation of the Matrix standard. For EU organisations subject to GDPR and the incoming CADA legislation, and for organisations in Saudi Arabia subject to PDPL, Matrix is the only architecturally sound path: a communications platform where CLOUD Act compelled disclosure is not a risk to manage — it is structurally impossible because no US company controls the data.
Read the Matrix specification →Replace Microsoft Teams with a sovereign communications platform that delivers every feature — without putting your most sensitive government conversations under US jurisdiction or in scope for the EU's incoming Tech Sovereignty legislation.