Most self-hosting stories put privacy values in the driver's seat and cost in the passenger seat. This one has a federal regulation holding the steering wheel.

Michigan Technological University runs an Aerospace Enterprise: a program where students design, build, and integrate cube satellite systems. Around 100 students work across the projects, with hundreds more in the broader program. Their collaboration environment had grown the way most do — Google Drive for files, Microsoft tools on individual machines, and a tax paid every time a document crossed between the two: export, import, formatting broken again.

The inflection point was not a price increase and not a values conversation. Aerospace payload and mission data falls under ITAR — the International Traffic in Arms Regulations. Under export control, "where is this file physically stored" and "who can access it" are compliance questions with legal consequences, not opinions about who to trust. The team's requirements for keeping data on premises came from security and export-control obligations, with FCC regulatory compliance in the mix. A cloud tenant you do not control has no ITAR story you can sign.

SharePoint On-Prem: Tried, Abandoned, On the Record

Here is the part worth the price of the whole post.

The obvious enterprise procurement answer for "we need collaboration on our own hardware" is SharePoint on-premises. The team considered it. They did not read a comparison chart and reject it — they went as far as starting the deployment, and stopped partway through when it became clear it would not give them the flexibility and extensibility their workflows needed. That is a named negative result against the default answer, from the same organization that then shipped the alternative.

Their engineer put the deciding factor plainly:

Compared to Sharepoint, Nextcloud had far superior documentation and extensibility. This allowed our team of part time engineers much better ability to implement the software on a deadline.

— Greg Gindin, Michigan Tech Aerospace Enterprise

Read that quote again for the procurement criterion hiding in it. Nobody praised the feature matrix, the price, or the roadmap. They praised the documentation — because the operators were part-time engineers on a deadline. For volunteer fire halls, city hall IT committees, and small businesses, the operator profile is the same: people doing this alongside their real jobs. Documentation quality is not a nice-to-have in that world. It is the difference between the deployment finishing and the deployment becoming a project corpse.

The Pattern Underneath: Compliance With Teeth Picks the Architecture

Privacy values, sovereignty language, and FOSS preference are all arguable in a procurement meeting. Someone can always counter that a reputable vendor's cloud is "probably fine." Export control is not arguable — the data class is defined in law, the storage constraint is defined in law, and the architecture follows.

The same shape exists everywhere communities actually operate:

  • Municipal records and resident PII — state retention and disclosure laws dictate where records live and who touches them.
  • Public-safety data (dispatch, CJIS-adjacent systems) — criminal justice information regimes impose physical and personnel controls that a self-run cluster satisfies more legibly than a shared multi-tenant platform.
  • Health client files at nonprofits and clinics — medical privacy law makes the data-locality and access-control questions identical in structure to ITAR, just with different citation numbers.

(These are structural analogies, not claims that any of those regimes equal ITAR. The point is the decision procedure: find the rule with enforcement behind it, let it choose the architecture, and the values debate ends before it starts.)

Nextcloud itself is AGPLv3 — the license question comes along for free. The deployment runs Files, Talk, Calendar, and activity tracking, integrates with the university's Active Directory and an office suite, and is operated by the team that uses it.

Honest Limits

  • The source is the vendor's blog. Nextcloud published this as a success story with an interest in your conversion. There is no independent verification, and success stories do not publish the customers who stalled. Discount accordingly — we are reporting their account of their customer, not auditing it.
  • Scale is ~100 people. This is the small end of the migration curve. The 50,000-seat end is already covered on this site — Schleswig-Holstein and Mecklenburg-Vorpommern moving entire state administrations. Neither proof point tells you the middle 500-to-5,000 seat deployment is easy; they only bracket it.
  • A university enterprise is not a fire hall. The team had faculty structure, an engineering organizational culture, and institutional infrastructure to run on. A volunteer organization has none of that, and "students managed it" does not translate one-to-one. What does transfer: the operator-hours constraint was real there too, and documentation quality was how they cleared it.
  • The quote is a customer quote collected by the vendor. It reads as marketing-shaped. The SharePoint abandonment is the vendor's own claim, albeit a strange one to invent — vendors rarely tell you a customer rejected the incumbent you'd expect them to migrate from.

Why It Lands Here

Two facts make this worth archiving, and neither is "Nextcloud good."

One: the driver. When the constraint is legal rather than philosophical, the self-hosting decision stops being a committee negotiation and becomes a compliance requirement with a fixed architecture. Communities that want off vendor clouds should go looking for their version of ITAR first — the regulation with teeth — because it converts "we'd like to own this" into "nothing else is legal."

Two: the negative result. SharePoint on-prem got a real try, inside a real requirement, by a real team — and lost to documentation and extensibility before licensing ever came up. Procurement processes almost never produce public records of the option they started and abandoned. This one exists. File it next to the German states: one proof at state scale, one at student-club scale, and a documented reason the default answer lost at the small one.

Sources