I get the impression that this is a temporary measure to ease the transition, not a statement about the privacy guarantees of M365.

A swiss could be planning a trip from abroad.

>A lot of Swiss government services do not need to be available 247 outside of the country.

Obviously without talking specifics it's hard to discuss, but I'd hate to be a Swiss who was traveling abroad and had to access the gov website deemed "not 24/7" in an emergency of some kind (planning travel for the next day for the railway for example), or to finish something due to a goverment imposed deadline.

The case of Nicolas Guillou was an eye opener for many.

https://www.lemonde.fr/en/international/article/2025/11/19/n...

> If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc.

Proton has all of these features, despite being end-to-end encrypted. Search works well with their Mail and Calendar solutions, real-time collaboration is a core offering of their Document editor. It surely is harder to implement, but not impossible for many use cases.

> The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS.

Good. It's high time to flip the status quo on its head - instead of data being something we ship to specific cloud services, for them to lock it away and charge for access, it should be code that should be a commodity, shipped to servers of our choosing and granted access to operate on our data without owning it.

Just like regular, old-school desktop software, back in the day before SaaS was a thing. The provider didn't get to "see plaintext", because the software was operating on your hardware and not communicating with the provider. And if it tried to communicate back to the "mothership", we'd rightfully call it spyware, tell people not to use it, and wonder if there's legal action that could be taken.

> because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

Neither of these seem like a terrible outcome. Relying on local providers would be better for privacy and would help the local economy. It would also push them to implement the remaining feature set and work on reliability - though I must sincerely question the idea that local providers cannot reach the same level of reliability - particularly when you throw in global network problems that affect the largest cloud providers but don't always affect the smaller guys.

whatsapp has e2e encrypted messages and searching works fine.

Realtime collaboration — assuming you use CRDTs — can be achieved with e2e encryption as well, with backend acting like a mere router of requests.

This gets me wondering, who does the cleaning at data centers and such? Do you need to do background checks to swing the mop in there? Is there a market for high clearance cleaning personnel? (like with the extended PSP in CH)

My hunch is telling me there could be a couple positions with decent money (by normal person standards) for little work in that direction. Wouldn't be the first time I've been wrong though.

You mean the cleaning staff of AWS, Google, or Microsoft? The goal is to avoid that, I believe.

I would be more concerned that many data centers in Switzerland are owned and operated by large foreign companies and some of their physical security is questionable. Not at all what you see in their ads and I would say you are only as secure as the least secure DC you have...