GDPR & security — nordOFFICE, the privacy-first alternative to Microsoft 365itle> <meta name="description" content="nordOFFICE is built privacy-first: hosted exclusively in Germany, a data processing agreement included, no tracking cookies, end-to-end tools such as a zero-knowledge password manager and S/MIME. The digitally sovereign, price-stable alternative to Microsoft 365." /> <link rel="icon" href="/favicon.svg" type="image/svg+xml" /> <link rel="preload" href="/assets/fonts/bricolage-grotesque-var.woff2" as="font" type="font/woff2" crossorigin /> <link rel="preload" href="/assets/fonts/hanken-grotesk-var.woff2" as="font" type="font/woff2" crossorigin /> <link rel="stylesheet" href="/assets/fonts/fonts.css" /> <link rel="stylesheet" href="/assets/site.css?v=20260908" /> <meta property="og:type" content="website" /> <meta property="og:title" content="GDPR & security — nordOFFICE, the privacy-first alternative to Microsoft 365" /> <meta property="og:description" content="Hosted exclusively in Germany, a data processing agreement included, no tracking cookies, digital sovereignty and fixed euro prices — why nordOFFICE is the privacy-first platform." /> <meta property="og:url" content="https://nordoffice.app/dsgvo/" /> <meta property="og:image" content="https://nordoffice.app/assets/shots/dashboard-light.webp" /> <meta name="twitter:card" content="summary_large_image" /> <meta name="twitter:title" content="GDPR & security — nordOFFICE, the privacy-first alternative to Microsoft 365" /> <meta name="twitter:description" content="Hosted exclusively in Germany, a data processing agreement included, no tracking cookies, digital sovereignty and fixed euro prices." /> <meta name="twitter:image" content="https://nordoffice.app/assets/shots/dashboard-light.webp" /> <script type="application/ld+json"> {"@context":"https://schema.org","@graph":[ {"@type":"WebPage","name":"DSGVO & Sicherheit — nordOFFICE, die privacy-first Alternative zu Microsoft 365","description":"Hosting ausschließlich in Deutschland, AV-Vertrag inklusive, keine Tracking-Cookies, digitale Souveränität und feste Euro-Preise — warum nordOFFICE die privacy-first Plattform ist.","url":"https://nordoffice.app/dsgvo/","isPartOf":{"@type":"WebSite","name":"nordOFFICE","url":"https://nordoffice.app/"},"inLanguage":"de-DE"}, {"@type":"BreadcrumbList","itemListElement":[ {"@type":"ListItem","position":1,"name":"nordOFFICE","item":"https://nordoffice.app/"}, {"@type":"ListItem","position":2,"name":"DSGVO & Sicherheit","item":"https://nordoffice.app/dsgvo/"}]}, {"@type":"FAQPage","mainEntity":[ {"@type":"Question","name":"Ist nordOFFICE DSGVO-konform?","acceptedAnswer":{"@type":"Answer","text":"Ja. nordOFFICE wird ausschließlich auf Servern in Deutschland betrieben und von der digitalNORD GmbH entwickelt — einem Unternehmen, das aus der Datenschutzberatung kommt. Ein Vertrag zur Auftragsverarbeitung nach Art. 28 DSGVO einschließlich der technischen und organisatorischen Maßnahmen ist ohne Aufpreis Bestandteil jedes Vertrags."}}, {"@type":"Question","name":"Ist nordOFFICE eine Alternative zu Microsoft 365?","acceptedAnswer":{"@type":"Answer","text":"Für viele Teams ja: E-Mail, Kalender, Dateiablage mit Office im Browser, Chat, Videokonferenzen, Aufgaben und über 30 weitere Module laufen in einer Oberfläche — bei einem Anbieter aus Deutschland, unter europäischem Recht, mit festen Euro-Preisen je Benutzer. Eine Microsoft-365-Lizenz wird nicht benötigt; Word- und Excel-Dateien bleiben voll kompatibel."}}, {"@type":"Question","name":"Wo liegen die Daten?","acceptedAnswer":{"@type":"Answer","text":"Ausschließlich auf Servern in Deutschland. Es werden keine Daten an Dritte außerhalb der EU übertragen. Auf Wunsch läuft nordOFFICE auch komplett auf eigener Infrastruktur im eigenen Haus."}}, {"@type":"Question","name":"Gibt es einen Vertrag zur Auftragsverarbeitung (AVV)?","acceptedAnswer":{"@type":"Answer","text":"Ja. Der AV-Vertrag nach Art. 28 DSGVO wird mit Vertragsschluss geschlossen, ist ohne zusätzliche Kosten enthalten und steht einschließlich der technischen und organisatorischen Maßnahmen auf Anfrage schon vor der Bestellung bereit."}}, {"@type":"Question","name":"Können sich unsere Leute mit ihrem Firmenkonto anmelden (SSO)?","acceptedAnswer":{"@type":"Answer","text":"Ja. Die Anmeldung läuft wahlweise über Microsoft 365 (Entra ID) oder über Ihr eigenes Firmenverzeichnis per LDAP — Active Directory, Samba AD, Univention Corporate Server und OpenLDAP werden unterstützt. Ihre Leute melden sich mit dem Konto an, das sie ohnehin haben; ein zweites Passwort entfällt. Wird ein Konto zentral gesperrt, endet auch der Zugang zu nordOFFICE. Beides ist ohne Aufpreis enthalten, und wer kein Verzeichnis betreibt, meldet sich weiterhin mit E-Mail-Adresse und Passwort an — auf Wunsch mit Zwei-Faktor-Anmeldung."}}, {"@type":"Question","name":"Wie geht nordOFFICE mit KI und Datenschutz um?","acceptedAnswer":{"@type":"Answer","text":"Sie entscheiden, welche KI arbeitet: eigene API-Schlüssel für Claude, ChatGPT oder Gemini — oder lokale Modelle über Ollama, bei denen kein Datum das eigene Gerät verlässt. Jeder KI-Zugriff läuft mit den Rechten des jeweiligen Benutzers; Versand und Löschen verlangen eine ausdrückliche Bestätigung."}} ]} ]} </script> <link rel="canonical" href="https://nordoffice.app/en/dsgvo/" /> <link rel="alternate" hreflang="de" href="https://nordoffice.app/dsgvo/" /> <link rel="alternate" hreflang="en" href="https://nordoffice.app/en/dsgvo/" /> <link rel="alternate" hreflang="x-default" href="https://nordoffice.app/dsgvo/" /> </head> <body> <div class="atmosphere"></div> <header class="site"> <div class="wrap nav"> <a class="brand" href="/en/" aria-label="nordOFFICE home"> <svg class="cube" viewBox="180 0 44 45" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><polygon fill="#21427E" points="194.999,15.537 208.87,1.668 222.739,15.537"/><polygon fill="#009CC8" points="208.813,29.35 194.944,43.22 181.073,29.35"/><polygon fill="#009CC8" points="194.944,29.35 181.073,15.48 194.944,1.61"/><polygon fill="#009CC8" points="208.87,15.537 222.739,29.407 208.87,43.277"/></svg> <span class="word"><span class="a">nord</span><span class="b">OFFICE</span></span> </a> <nav class="nav-links" aria-label="Main navigation"> <a href="/en/module/">Modules</a> <a href="/en/apps/">Apps & editions</a> <a href="/en/preise/">Pricing</a> <a href="/en/dsgvo/">GDPR & security</a> <a href="/en/#demo">Demo</a> </nav> <a class="nav-lang" href="/dsgvo/" hreflang="de" aria-label="Diese Seite auf Deutsch">Deutsch</a> <a class="nav-cta" href="https://dnord.nordoffice.app">Log in <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M5 12h14M13 6l6 6-6 6"/></svg> </a> <button type="button" class="nav-burger" aria-label="Menu" aria-expanded="false"> <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" aria-hidden="true"><path d="M4 7h16M4 12h16M4 17h16"/></svg> </button> </div> </header> <main>  <section class="block" style="padding-top:76px;"> <div class="wrap"> <div class="sec-head reveal" style="max-width:none;"> <h1>Data protection is not a feature here.<br /><span class="grad">It is the foundation.</span></h1> <p class="lede" style="margin-top:14px;">nordOFFICE comes from digitalNORD GmbH in Kiel — a team that has advised companies on data protection for years. That is why the platform has been built <strong>privacy-first</strong> from the very first line: hosted exclusively in Germany, a data processing agreement included, no tracking cookies, no data flows to third countries.</p> </div> <div class="pill-row reveal d1" style="margin-top:24px;"> <span class="pill">Hosted exclusively in Germany</span> <span class="pill">A data processing agreement under Art. 28 GDPR included</span> <span class="pill">No tracking cookies</span> <span class="pill">On-premise operation possible</span> <span class="pill">Fixed euro prices</span> </div> </div> </section>  <section class="block" id="privacy-first" style="padding-top:0;"> <div class="wrap"> <div class="sec-head reveal"> <h2>What privacy-first actually means.</h2> <p>Not a tick box in the contract but decisions in the architecture — taken by people who assess data protection consequences every day.</p> </div> <div class="grid reveal"> <div class="card"> <h3>Built by data protection professionals</h3> <p>Behind nordOFFICE stands a company from data protection consultancy. Every module is created with the question our consultants ask their clients in mind: which data is really needed — and who is allowed to see it?</p> </div> <div class="card"> <h3>No third-party servers involved</h3> <p>The application loads no external resources: fonts, scripts and maps are held locally. There are no tracking cookies, no tracking pixels and no third-party analytics services — neither in the app nor on this website.</p> </div> <div class="card"> <h3>Everything in Germany</h3> <p>Operated exclusively on servers in Germany, backups included. No data is transferred to third parties outside the EU. Anyone who wants to go further runs nordOFFICE entirely on their own infrastructure.</p> </div> </div> </div> </section>  <section class="block" id="ms365"> <div class="wrap"> <div class="sec-head reveal"> <h2>The sovereign alternative to Microsoft 365.</h2> <p>Email, calendar, files with office in the browser, chat, video conferencing and more than 30 further modules — in a platform that belongs to you rather than the other way round.</p> </div> <div class="grid reveal"> <div class="card"> <h3>Digital sovereignty</h3> <p>Your data sits with a provider based in Kiel and is subject exclusively to German and European law — not to the access laws of a third country. You know at all times where your data is and who can reach it.</p> </div> <div class="card"> <h3>Independence</h3> <p>No corporate ecosystem that makes every move expensive: an open interface with more than 920 tools, an export of your data at any time, full compatibility with Word and Excel formats — and on-premise operation on request. Your data stays your data.</p> </div> <div class="card"> <h3>Price stability</h3> <p>Fixed euro prices per user, modules switched on individually instead of a compulsory bundle. Office in the browser is included — you do not need a Microsoft 365 licence. No dollar exchange rates, no price rounds you learn about from the newspaper.</p> </div> </div> <div class="reveal d1" style="max-width:860px; margin-top:22px;"> <ul class="checks"> <li>One interface instead of a licence jungle: CRM, email, calendar, files, projects, invoices and more</li> <li>Office in the browser included — open, edit and share Word and Excel files</li> <li>Backup included, no server of your own and no domain controller needed</li> <li>No infrastructure of your own required — but possible if you want it</li> </ul> </div> </div> </section>  <section class="block" id="sicherheit"> <div class="wrap"> <div class="sec-head reveal"> <h2>Security built in, not bolted on.</h2> <p>From the sign-in procedure to the individual file — the most important protections are part of the package.</p> </div> <div class="grid reveal"> <div class="card"> <h3>Permissions down to the detail</h3> <p>Groups and individual permissions per module — reading, writing, creating and deleting controlled separately. Anyone who is not allowed to do something does not even see it. The check happens on the server, not just in the interface.</p> </div> <div class="card"> <h3>Sign in with the company account</h3> <p>Single sign-on via Microsoft 365 (Entra ID) or your own directory over LDAP — Active Directory, Samba AD, Univention UCS and OpenLDAP. No second password, and a central lockout withdraws access to nordOFFICE as well.</p> </div> <div class="card"> <h3>Two-factor sign-in</h3> <p>Every user can add protection to their account with a one-time code app (TOTP) — at no extra cost and without a third-party service.</p> </div> <div class="card"> <h3>Encrypted email</h3> <p>S/MIME for signed and encrypted mail, on request with your own certificate authority for the whole team — set up in minutes rather than projects.</p> </div> <div class="card"> <h3>Zero-knowledge passwords</h3> <p>The password manager encrypts in the browser; the server knows neither the master password nor the contents. Not even we could read your passwords.</p> </div> <div class="card"> <h3>Virus protection for files</h3> <p>Every uploaded file is scanned automatically; anything found goes into quarantine before anyone opens it.</p> </div> <div class="card"> <h3>Spam and phishing protection</h3> <p>The built-in spam filter sorts out unwanted mail and visibly warns about suspected phishing. Where needed, an AI provides a second opinion — the mail is anonymised beforehand, so personal data stays in house.</p> </div> <div class="card"> <h3>Secrets as a one-time link</h3> <p>Credentials do not belong in an email: secret sending creates self-destructing one-time links whose key never reaches the server.</p> </div> </div> </div> </section>  <section class="block" id="ki"> <div class="wrap"> <div class="sec-head reveal"> <h2>AI, yes — but on your terms.</h2> <p>nordOFFICE has AI built in without turning your data into a commodity. You choose the model, you set the limits.</p> </div> <div class="grid reveal"> <div class="card"> <h3>Your key, your choice</h3> <p>Claude, ChatGPT or Gemini run on your own API keys — there is no hidden collective account held by the provider. Anyone who does not want AI simply does not enable it.</p> </div> <div class="card"> <h3>Local models possible</h3> <p>Through Ollama the AI can run entirely on your own hardware — with tool access to your nordOFFICE data but without a single record leaving the building.</p> </div> <div class="card"> <h3>AI with user permissions</h3> <p>Every AI access runs with the permissions of exactly the user who set it up. Sending, invitations and permanent deletion first require a preview and then an explicit confirmation.</p> </div> </div> </div> </section>  <section class="block" id="avv"> <div class="wrap"> <div class="sec-head reveal"> <h2>GDPR without the paperwork battle.</h2> <p>The documents your data protection officer will ask for are ready and waiting — not only on request.</p> </div> <div class="reveal" style="max-width:860px;"> <ul class="checks"> <li><strong>A data processing agreement under Art. 28 GDPR included</strong> — concluded when the contract is signed, at no additional cost; you remain the controller within the meaning of the GDPR</li> <li><strong>Technical and organisational measures (TOMs)</strong> — documented and part of the data processing agreement</li> <li><strong>Sub-processors set out clearly</strong> — transparent in the data processing agreement, no silent hand-overs</li> <li><strong>Everything available in advance</strong> — the data processing agreement including the TOMs is available on request before you order</li> </ul> </div> </div> </section>  <section class="block" id="faq"> <div class="wrap"> <div class="sec-head reveal"> <h2>Frequently asked questions</h2> </div> <div class="faq reveal"> <details> <summary>Is nordOFFICE GDPR-compliant?</summary> <div>Yes. nordOFFICE is operated exclusively on servers in Germany and developed by digitalNORD GmbH — a company that comes from data protection consultancy. A data processing agreement under Art. 28 GDPR including the technical and organisational measures is part of every contract at no extra cost.</div> </details> <details> <summary>Is nordOFFICE an alternative to Microsoft 365?</summary> <div>For many teams, yes: email, calendar, file storage with office in the browser, chat, video conferencing, tasks and more than 30 further modules run in one interface — with a provider from Germany, under European law, at fixed euro prices per user. A Microsoft 365 licence is not needed; Word and Excel files remain fully compatible.</div> </details> <details> <summary>Where is the data stored?</summary> <div>Exclusively on servers in Germany, backups included. No data is transferred to third parties outside the EU. On request, nordOFFICE also runs entirely on your own infrastructure.</div> </details> <details> <summary>Is there a data processing agreement?</summary> <div>Yes. The data processing agreement under Art. 28 GDPR is concluded when the contract is signed, is included at no additional cost and is available on request — including the technical and organisational measures — before you order.</div> </details> <details> <summary>Can our people sign in with their company account (SSO)?</summary> <div>Yes. Sign-in runs either through Microsoft 365 (Entra ID) or through your own company directory over LDAP — Active Directory, Samba AD, Univention Corporate Server and OpenLDAP are supported. Your people sign in with the account they already have; a second password is unnecessary. If an account is locked centrally, access to nordOFFICE ends as well. Both are included at no extra cost, and anyone without a directory continues to sign in with an email address and password — with two-factor sign-in on request.</div> </details> <details> <summary>How does nordOFFICE handle AI and data protection?</summary> <div>You decide which AI does the work: your own API keys for Claude, ChatGPT or Gemini — or local models through Ollama, where no record leaves your own device. Every AI access runs with that user's permissions; sending and deleting require an explicit confirmation. Anyone who does not want AI simply does not enable it.</div> </details> <details> <summary>Can I get out again later?</summary> <div>Yes. Your data belongs to you: through the <a href="/en/schnittstelle/">open interface</a> you can read out all your records at any time, and files and documents are held in standard formats. There is no technical lock-in that punishes a move.</div> </details> </div> </div> </section>  <section class="block tight"> <div class="wrap"> <div class="band-inner reveal"> <h2>Convince your data protection officer.</h2> <p>Request demo access and examine nordOFFICE with real sample data — you can read the data processing agreement and the TOMs beforehand.</p> <div class="cta-row" style="position:relative;"> <a class="btn-primary" href="/en/#demo">Request a demo</a> <a class="btn-ghost" href="/en/module/" style="color:#fff; border-color:rgba(255,255,255,.4); background:transparent;">All modules</a> </div> </div> </div> </section> </main> <footer class="site"> <div class="wrap"> <div class="foot-grid"> <div> <a class="brand" href="/en/" aria-label="nordOFFICE"> <svg class="cube" viewBox="180 0 44 45" xmlns="http://www.w3.org/2000/svg" aria-hidden="true"><polygon fill="#21427E" points="194.999,15.537 208.87,1.668 222.739,15.537"/><polygon fill="#009CC8" points="208.813,29.35 194.944,43.22 181.073,29.35"/><polygon fill="#009CC8" points="194.944,29.35 181.073,15.48 194.944,1.61"/><polygon fill="#009CC8" points="208.87,15.537 222.739,29.407 208.87,43.277"/></svg> <span class="word"><span class="a">nord</span><span class="b">OFFICE</span></span> </a> <p class="foot-claim">AI and app platform — made & hosted in Germany.</p> </div> <div class="foot-col"> <h4>Product</h4> <a href="/en/module/">Modules</a> <a href="/en/apps/">Apps & editions</a> <a href="/en/preise/">Pricing</a> <a href="/en/schnittstelle/">API</a> <a href="/en/pitch/">Pitch</a> <a href="/en/dsgvo/">GDPR & security</a> <a href="/en/#demo">Demo</a> </div> <div class="foot-col"> <h4>Apps</h4> <a href="https://apps.apple.com/de/app/id6793486029" rel="noopener">iPhone & iPad</a> <a href="https://play.google.com/store/apps/details?id=de.dnord.nordoffice" rel="noopener">Android</a> <a href="https://dnord.nordoffice.app/desktop-apps.html" rel="noopener">Mac, Windows & Linux</a> <a href="https://dnord.nordoffice.app">Log in</a> </div> <div class="foot-col"> <h4>Legal</h4> <a href="/en/agb/">Terms</a> <a href="/en/datenschutz/">Privacy</a> <a href="https://dsgvo-nord.de/impressum/" rel="noopener">Legal notice</a> </div> </div> <div class="foot-meta"> <span>© 2026 digitalNORD GmbH · Made in Germany</span> <span>This website loads no external resources and sets no tracking cookies.</span> </div> </div> </footer> <script src="/assets/site.js?v=20260908" defer></script> </body> </html>