Digital Sovereignty Starts with Communication

Data protection focuses on the collection and use of personal data: Who has access to it? How is the data processed? It is not directly concerned with the actual protection of data—that is the subject of data security: How is it stored?

Since not all data is personal, data sovereignty refers to the entirety of the data generated by an individual, a company, or a public institution—in particular, control over this data. Around 400 million terabytes are generated worldwide every day, including 720,000 hours of video material on YouTube alone, approximately 5.3 billion photos and more than 376 billion emails sent.

Only those who retain control over their own data can ultimately exercise digital sovereignty and determine what happens to it, when, and how—provided they can use and manage their digital tools independently, without relying on cloud providers or foreign jurisdictions.

IT security protects systems technically (e.g., encryption, access controls), while digital sovereignty means legal, organisational, and technical control over systems and data. Only the combination of both creates true independence.

No. Storing data in Europe (data residency) does not automatically mean digital sovereignty. The decisive factors are whether providers or parent companies are subject to extraterritorial laws and whether administrative access or key management are beyond their control. Digital sovereignty therefore requires more than EU hosting. It requires legal, technical, and organisational independence.

Vendor lock-in describes dependence on a specific provider. Products or services tied to a particular vendor typically function only within a defined ecosystem, often integrated seemlessly with other products from the same provider, and may even create additional value when combined. Switching to alternative products frequently results in challenges—keyword: incompatibility—and/or significant costs. Examples of such communication platforms include Microsoft Teams and Zoom Phone:

• Microsoft Teams uses a proprietary signaling protocol. A SIP connection is only possible via certified session border controllers with "direct routing" or the fee-based "Operator Connect" route. Since Microsoft decides which SBC manufacturers are certified, customers are limited in their choice and dependent on Microsoft's certification policy. In addition, the use of Teams requires Azure Active Directory (Entra ID) as an identity provider. This means that the company directory is located in Microsoft's cloud and is therefore potentially vulnerable to attack.

• In contrast, Zoom Phone supports SIP trunking, but only via Zoom's own "BYOC" architecture, which routes traffic through Zoom's cloud infrastructure. True local SIP processing without cloud involvement is not provided. Even with SSO integration via SAML/OIDC, user data, user profiles, contact lists, and organisational structures are replicated in Zoom's cloud.

• XPhone does not lock customers into proprietary signaling: customers can set up XPhone on their existing infrastructure or flexibly modernise the technical underpinnings without limiting the functionality of the UC solution. XPhone also works without a telephone system.

A public key infrastructure (PKI) refers to a structured system that can be used to generate, manage, distribute, and verify digital certificates. These serve to securely identify individuals, machines, and services digitally and are used to secure computer-based communication.

Having their own PKI enables organizations and governments to:

• use their own digital keys and certificates instead of having to rely on public certification authorities (CAs). This reduces dependence on foreign providers and mitigates geopolitical risks.
• Define which digital identities (users, devices such as IP phones and services) are trustworthy. VoIP data is transmitted over public networks. PKI can be used to ensure that a communication partner is who they claim to be, which is particularly important for protecting critical infrastructure (KRITIS).
• Securely distribute encryption keys for VoIP data: only authorised parties can decrypt the conversations. This protects against eavesdropping and strengthens data sovereignty.
• Protecting the transmission of voice data from manipulation.

Metadata (who communicates with whom, when, and for how long) is strategically sensitive. Information about who communicates with whom, when, for how long, from which device, and from which network is often more valuable to intelligence services than the actual content of the conversation. UC platforms collect this telemetry data, for example, to identify and predict peak loads using XPhone call analysis. What happens to this data is crucial:

• Zoom has been proven to have forwarded usage data to Facebook (via the Facebook SDK in the iOS app), even for users without a Facebook account. Zoom's privacy policy allows the use of customer data for "product improvements" and AI training—opting out is possible, but not the default setting.
• Microsoft Teams transfers usage data such as meeting duration, response times, communication patterns, and even focus time to Microsoft's cloud, where it is analysed. This happens even if the customer deactivates this feature. This is a point that the German Federal Office for Information Security explicitly criticises in its recommendations for Microsoft 365.

XPhone also generatescall detail records andpresence logs. However, with the on-premises solution, unlike cloud platforms, the metadata always remains within the protected company network. Protecting this data prevents conclusions from being drawn about organisational structures and communication patterns, making it a central component of GDPR compliance and digital sovereignty.

Communication platforms such as Microsoft Teams or Zoom roll out updates automatically and without the user's consent. In the best case scenario, features appear or disappear unintentionally, or the user interface changes (not always for the better). The impact can be significantly greater when APIs are deprecated (classified as obsolete). In the worst case, existing certifications become invalid without the customer being able to prevent it. This is a compliance nightmare, especially in regulated industries.

XPhone relies on rolling releases, which means that new features and regulatory adjustments are rolled out regularly. Customers can decide at any time whether they want to install a release or continue using the software in its current state.

With XPhone, the decision on AI usage lies entirely with the customer: those who want to use MCP servers or AI connections decide for themselves on providers, data flows, and limits.

At Microsoft, Copilot processes meeting transcripts, chat content, and files from Teams to generate summaries and suggestions. This processing takes place in the cloud. It is not transparent to customers whether and how this data is used for training AI models. Microsoft has amended its terms of use several times, always in favor of expanded data use. Zoom has also changed its terms and conditions to allow customer data to be used for AI training. After massive resistance, an opt-out was introduced. The fact that an opt-out is necessary instead of an opt-in shows the basic attitude.