A Realistic Migration Path Away from Google Workspace for a 10-Person Team

A 10-person team is the size where Google Workspace feels most natural and where leaving it feels most daunting. You are small enough that Google’s pricing is cheap (€12 to €14 per user per month for Business Standard). You are small enough that you do not have a dedicated IT person. And you are large enough that Google has become the invisible foundation of how your company operates.

This post walks through a realistic migration path for a company of this size. Not a theoretical framework, but specific steps with specific tools, timelines, and costs. The company we are describing is composited from several real engagements, anonymised and simplified.

The Starting Point

Company profile:

• 10 employees (Netherlands-based consultancy)
• Google Workspace Business Standard (€14.40/user/month)
• Using: Gmail, Google Drive, Google Docs/Sheets, Google Calendar, Google Meet, Google Chat
• 6 third-party apps connected via Google SSO (Slack, Notion, HubSpot, Calendly, 1Password, Linear)
• 3 Google Apps Scripts (auto-generated client folders, weekly report aggregation, invoice numbering)
• ~80,000 files in Google Drive (mix of native Google Docs and uploaded files)
• No self-hosted infrastructure
• No IT department (one co-founder handles IT decisions)

Current monthly cost: 10 x €14.40 = €144/month (€1,728/year)

Why they want to leave: The founders attended a conference where a lawyer explained the CLOUD Act. They realised that client contracts, financial documents, and personnel records all sit on Google infrastructure reachable by US law enforcement. Two of their clients are in regulated sectors and have started asking about data sovereignty in procurement questionnaires.

Step 0: Map What You Actually Use (Week 1)

Before choosing any tools, spend a week documenting what your Google Workspace deployment actually looks like. The co-founder handling IT should:

1. Export the connected applications list from Google Admin Console → Security → API controls. Write down every app that has OAuth access to your Google data.
2. Count Google-native files. Use Google Takeout to see how many files are Google Docs/Sheets/Slides (these must be converted on export) versus uploaded files (these are portable as-is).
3. Inventory Apps Scripts. Go to script.google.com and list every script attached to your organisation’s account. For each one, note what it does and who depends on it.
4. List Google Groups. Check for distribution lists and shared inboxes.
5. Check for Google Chat usage. Is the team using Spaces? How much history matters?

This step takes 3 to 5 hours and is the most important part of the entire migration. Skip it and you will be surprised later.

Step 1: Choose the Target Stack (Week 2)

For a 10-person team, simplicity matters more than feature completeness. Here is a practical target stack:

Monthly cost of the target stack:

Compared to Google Workspace at €144/month, the infrastructure cost is roughly equivalent. The migration labour is the real cost.

Step 2: Set Up the Target Infrastructure (Weeks 3 to 4)

Order of operations matters. Set up the new systems before you start migrating data, so you can test them in parallel.

Week 3:

• Sign up for Proton Mail for Business. Verify your domain. Do not change MX records yet.
• Deploy Nextcloud through a managed hosting provider (Hetzner Nextcloud hosting, or a dedicated provider like tab.digital, Webo, or The Good Cloud). Create user accounts. Install Collabora Online and Nextcloud Talk apps.
• Deploy Keycloak on a small Hetzner VPS. Configure your domain. Set up user accounts.

Week 4:

• Connect Keycloak to the third-party apps that support SAML/OIDC (Slack, HubSpot, 1Password, Linear). Test login for each one. Keep Google SSO active in parallel.
• Notion: check if it supports SAML with your plan tier. If not, switch Notion users to email+password login (with 1Password for credential management).
• Test Nextcloud file sync on one or two laptops. Upload a sample folder and verify the sync client works.

Step 3: Migrate Email (Weeks 5 to 6)

Email is the most visible change and the most important to get right.

Week 5: Prepare

• In Proton Mail, configure all email addresses (personal addresses, aliases, shared addresses).
• Recreate Google Groups as Proton Mail groups or distribution lists.
• Set up mail rules that replicate your most important Gmail filters.
• Test sending and receiving from the new addresses.
• Document your current SPF, DKIM, and DMARC records.

Week 6: Cut over

• Import email history: Proton’s Easy Switch tool imports from Gmail via IMAP. Run it for each user. This preserves messages but not Gmail labels (labels convert to folders with potential duplication).
• Switch MX records to point to Proton. Update SPF, DKIM, and DMARC records.
• Allow 24 to 48 hours for DNS propagation.
• Send a test email from each account. Verify delivery and signatures.
• Notify clients and key contacts of any address changes (though if you keep the same domain, addresses stay the same).

Estimated time: 15 to 20 hours of work across two weeks. Most of this is configuration, not waiting.

Step 4: Migrate Files (Weeks 6 to 8)

File migration runs in parallel with email migration’s later stages.

Export from Google:

• Use Google Takeout or Rclone to export all files. Google-native documents (Docs, Sheets, Slides) will be converted to .docx, .xlsx, .pptx. Accept that comments, version history, and suggestion threads will not survive.
• For critical documents with important comment threads, manually review and save the comments to a separate notes file before export.

Upload to Nextcloud:

• Use the Nextcloud sync client or WebDAV upload for bulk transfer.
• Recreate the folder structure and set permissions. For a 10-person team, this is manageable manually (unlike a 50-person company where permission mapping becomes a project on its own).
• Install Nextcloud desktop sync client on all laptops.

Post-migration cleanup:

• Fix broken cross-document links (Google Doc links pointing to docs.google.com). Replace with Nextcloud internal links where needed.
• Verify that collaborative editing works in Nextcloud Office for the document types your team uses most.

Estimated time: 10 to 15 hours. The bulk export and upload is automated. The permission setup and cleanup is manual.

Step 5: Migrate Automations (Weeks 7 to 9)

This is where the three Apps Scripts need to be addressed. For a 10-person team, the scope is manageable:

1. Auto-generated client folders. Rebuild as an n8n workflow or a simple shell script that creates a folder structure in Nextcloud via WebDAV API when triggered by a webhook from the CRM.

2. Weekly report aggregation. If this pulls data from Google Sheets, it needs to be rebuilt for the target spreadsheet format. If the data source is an external API, the script can be adapted to write to a shared Nextcloud file instead.

3. Invoice numbering. Move to a standalone script or integrate with Xero/invoicing tool directly.

Estimated time: 8 to 15 hours depending on complexity.

Step 6: Switch Identity (Weeks 9 to 10)

By this point, Keycloak is running and connected to your third-party apps alongside Google SSO. Now you cut over:

• For each third-party app (Slack, HubSpot, 1Password, Linear, Notion), remove the Google SSO connection and make Keycloak the primary identity provider.
• Move MFA to a provider-independent method: TOTP (any authenticator app) or FIDO2 hardware keys.
• Test every application login through Keycloak.
• After a one-week parallel period with both active, disable Google SSO connections.
• Decommission Google Workspace accounts.

Estimated time: 10 to 15 hours.

Step 7: Verify and Close (Week 11)

• Confirm all data has been migrated (email, files, calendar, contacts).
• Verify all automations are working on the new platform.
• Run through a checklist of every application to confirm login works through Keycloak.
• Export a final backup from Google Workspace (Google Takeout) and store it on EU infrastructure for 90 days as a safety net.
• Cancel the Google Workspace subscription.
• Document the new architecture for the team.

Total Cost

The financial case for migration at this scale is not about saving money on subscriptions. It is about removing jurisdictional exposure, satisfying client procurement requirements, and complying with NIS2 supply chain obligations. If your clients are asking about data sovereignty, the migration pays for itself the first time it wins you a contract.

What You Lose

Honesty about trade-offs matters:

• Google Docs’ real-time collaboration. Nextcloud Office (Collabora) supports co-editing, but it is not as smooth as Google Docs. For a 10-person team, the difference is noticeable but manageable.
• Google Search. Google Workspace’s search across email, files, and calendar is excellent. Nextcloud search is functional but less powerful.
• Google Meet’s low-friction guest access. Google Meet links “just work” for external guests. Jitsi is close, but some guests may encounter browser compatibility issues.
• Gmail’s spam filtering. Google’s spam filtering is industry-leading. Proton’s is good but occasionally lets through more spam in the first weeks as it learns your patterns.

None of these are dealbreakers for a 10-person team. They are adjustments.

What You Gain

• Jurisdictional independence. Your email, files, identity, and communication are on EU/Swiss infrastructure controlled by EU/Swiss legal entities. No CLOUD Act exposure.
• Client confidence. You can answer sovereignty questions in procurement questionnaires with specifics, not vague reassurances about “EU data centres.”
• NIS2 compliance posture. You have documented your supply chain, reduced concentration risk, and have a clear picture of what you depend on.
• Operational control. You choose when to update, how to configure, and what to share. No forced feature changes or unilateral terms of service modifications.

Sovereign Shift plans and supports migrations like this for teams of 5 to 50 people. The dependency audit maps your specific stack and delivers a migration roadmap tailored to your size and situation. See pricing →