The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS. If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc. You're essentially left using these services as fancy file storage with your own crypto layer on top.

Which is fine for IaaS use cases - spin up VMs, encrypt your disks, manage your own keys. But for productivity software like M365? The Swiss government is basically saying "yeah you can use it but only in a way that makes it almost pointless."

The Cloud Act part is what really matters here though. US providers can be compelled to hand over data regardless of where it's physically stored, and they've been pretty clear they'll comply with US law over local data protection rules when push comes to shove. For a foreign government storing legally confidential citizen data, that's a real problem. I suspect this will get quietly ignored like the previous declarations, because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

> If you need true end-to-end encryption where the provider can't see plaintext, you lose search, real-time collaboration, most of the AI features everyone's been bolting on lately, etc.

Proton has all of these features, despite being end-to-end encrypted. Search works well with their Mail and Calendar solutions, real-time collaboration is a core offering of their Document editor. It surely is harder to implement, but not impossible for many use cases.

> The encryption requirement makes sense on paper, but it basically breaks the whole value proposition of SaaS.

Good. It's high time to flip the status quo on its head - instead of data being something we ship to specific cloud services, for them to lock it away and charge for access, it should be code that should be a commodity, shipped to servers of our choosing and granted access to operate on our data without owning it.

Just like regular, old-school desktop software, back in the day before SaaS was a thing. The provider didn't get to "see plaintext", because the software was operating on your hardware and not communicating with the provider. And if it tried to communicate back to the "mothership", we'd rightfully call it spyware, tell people not to use it, and wonder if there's legal action that could be taken.

> because the alternative is either building everything in-house or relying on local providers that frankly don't have the same feature set or reliability.

Neither of these seem like a terrible outcome. Relying on local providers would be better for privacy and would help the local economy. It would also push them to implement the remaining feature set and work on reliability - though I must sincerely question the idea that local providers cannot reach the same level of reliability - particularly when you throw in global network problems that affect the largest cloud providers but don't always affect the smaller guys.

whatsapp has e2e encrypted messages and searching works fine.

Realtime collaboration — assuming you use CRDTs — can be achieved with e2e encryption as well, with backend acting like a mere router of requests.