How to become less dependent on big tech

Open a typical small business’s IT and you’ll find the same names: Microsoft or Google for e-mail and documents, Dropbox for files, Cloudflare in front of the website, Amazon or Google behind half the apps. It works, and it’s convenient. But it means a few companies, almost all American, hold the keys to your data and your daily work.

This article explains why that’s worth thinking about, and how to become less dependent without turning your business upside down.

Why it matters

Other countries’ laws apply to your data. American providers fall under American law. The CLOUD Act lets American authorities demand data from those companies, also when it’s stored in a European data centre. “Data stored in the EU” is not the same as “data under EU law”.

You can’t negotiate. When a provider raises prices, changes its terms, closes a service or blocks an account, a small business has little choice but to accept it. Accounts get locked by automated systems, sometimes without a clear way to appeal.

One failure hits everyone at once. When a big provider has an outage, thousands of businesses stop working at the same moment. Concentration makes the whole system more fragile, and more attractive to attack.

Geopolitics is no longer abstract. Conflicts are fought online too, and access to digital services has become a means of pressure between countries. Nobody knows what the next years bring, which is exactly why it’s sensible not to depend entirely on one jurisdiction.

None of this means big providers are bad or unsafe. Their security is often excellent. The point is to make conscious choices, and to keep a way out.

Step 1: make an inventory

List the services your business uses and, for each one, write down:

• what it’s used for, and which data is in it
• where the company is based, and where the data is stored
• how hard it would be to leave: can you export your data in a standard format?

Most businesses find more services than they expected. That list alone is useful.

Step 2: decide what matters most

Not everything needs to move. Start with what is most sensitive or hardest to replace:

1. E-mail, because it’s the key to every other account.
2. Files and documents, especially customer data.
3. Passwords.
4. Your domain and website, because they are your identity online.

A chat tool for internal small talk matters less than your customer administration.

Step 3: switch what’s easy, keep what works

European alternatives exist for most common services. A few examples, all based in Europe:

Check each one against your own needs: price, features, support in your language, and whether it integrates with what you keep. Sometimes the big provider is still the best fit, and that’s a fine outcome as long as it’s a conscious one.

Step 4: keep a way out

Whatever you choose, make leaving possible:

• Use your own domain for e-mail. With you@yourcompany.com instead of a provider address, you can switch providers without changing your address.
• Export regularly in standard formats, and know how to do it before you need it.
• Keep a backup outside the provider. If an account is locked, your data shouldn’t be locked with it. See how to test whether your backups actually restore.
• Protect the accounts that remain with two-factor authentication. See two-factor authentication for a small business.

Practise what you preach

This site follows the same principles: no trackers or cookies, visitors counted anonymously with Umami on my own server (how that works), fonts served from its own server, and the one outside request, the DNS lookup in the e-mail check, goes to Quad9, a Swiss non-profit.

Want help making the inventory, or choosing alternatives that fit your business? That’s part of the IT-scan.