Shared with everyone

Before the move, the Home’s files were in SharePoint and OneDrive inside the tenant, and the default for a new link was “Anyone with the link”. The sharing settings page opens on what that produced: somebody shared a document that way, forgot about it, and left a spreadsheet of donor contact details publicly accessible. Site permissions had accumulated the way Entra ID roles had, with site owners who had left and guests from a project four years gone. A folder called “Covenant Setup 2022 FINAL” held a two-page PDF and, beside it, a photograph of a sticky note with the webhook secret on it. The asset register, once it existed, lived in a SharePoint site restricted to IT and the DPO, which made it the one well-kept shelf in a building where the filing cabinet’s padlock hung open with the key in it. The scraps for this layer say: a file store is not where the documents are, it is who can hand them to somebody else.

The review the sharing page asks for was run before anything moved, because moving a file store moves its mistakes with it. The report from the admin centre listed the “Anyone” links in the tenant, and the DPO read it with the Head of Fundraising, who had made more of them than she remembered. The donor spreadsheet was one. So was a volunteer rota with phone numbers, a grant application with the finance team’s bank details in an appendix, and the sticky-note photograph, which was not shared externally and was still a secret in a photo in a folder. Every link was closed, the photograph was deleted and the webhook secret rotated, and the sites with HR, fundraising, donor records and IT documentation got their owners checked against the staff list. None of that needed a new provider. It needed an afternoon and a list.

What a file store is

The files are the thing the across-the-Disc page says makes the Home interesting to an Office it has never met: case histories, the donor ledger’s exports, and the testimony field workers bring back from half the Disc. In the tenant, all of it sat under one login, one landlord and one default link setting, with the export of 380 people’s files gated by the tenant’s own tools. The Office’s reading of that testimony never went through the tenant, and moving the files does not touch it. What the move changes is which courts the files sit under. What was wanted from the next file store was short: a European company on its own machines, an export in plain files that any computer opens, a login that belongs to the identity provider and not to the store, and sharing that is off unless somebody switches it on for one file, for one person, for a while.

Where the files went

The store is a Storage Share at Hetzner Online GmbH, a managed Nextcloud in Hetzner’s datacentre in Falkenstein, on a plan with an unlimited number of users and no minimum contract, with a data processing agreement under Article 28 generated from the customer console. Hetzner’s own systems back up the database and the storage several times a day, and that copy is Hetzner’s. The Home’s own is on the premises. The software is Nextcloud GmbH’s, of Stuttgart, and the instance is reached by a hostname under the Home’s second name, so the public name can go without the files going with it.

The login belongs to the identity provider. Nextcloud’s OpenID Connect user backend, an app from Nextcloud’s own maintainers, was installed on the Storage Share and pointed at the Home’s ZITADEL, so a member of staff who leaves is removed in one place and loses the files with everything else. The store keeps one local administrator account, with its own second factor, as the identity page counts on.

Sharing, switched off

Nextcloud’s sharing settings are one page, and the Home set them once. Sharing by link is allowed, because funders and the Consortium are real, but public links are forced to carry a password and a default expiration date that the user cannot push further out, public uploads are off except for the upload-only folders the transfer page allows, and Federated Cloud Sharing, which would let a user share with any Nextcloud anywhere, is off. The default for a new share is a named person inside the Home. That is the same setting the sharing page asks for in SharePoint, “Specific people”, with the difference that here nobody at the Home can create an “Anyone” link that never expires, because the store refuses to make one.

Editing, still open

One thing SharePoint gave that the store does not yet is a document open for editing in the browser by four people at once. Nextcloud does it through an office server, and the one with the largest team behind it is Collabora Online, from Collabora Productivity Ltd in Cambridge, which puts a British company, outside the Union since 2020 and not American, under the Home’s documents. That decision is still a scrap and not yet a thing. Until it is made, documents are edited on the desktop and saved back, as the finance team worked anyway.

The move itself

Three hundred and eighty people’s OneDrives and a decade of SharePoint sites do not move in an afternoon, and most of it did not move at all. Each department was asked what it needed from the last two years, and that moved, into folders that mirror the departments and not the sites somebody set up in 2019. The rest was exported as plain files to the Home’s storage on the premises, where it can be read without any landlord, and then deleted from the tenant, department by department, with the DPO signing each deletion off against the retention schedule. The sticky-note photograph was not among the files that moved.

On the shelf

                       identity provider (ZITADEL, the .eu)
                                    │
                        Storage Share, Falkenstein ── local admin, own second factor
                                    │
              ┌─────────────────────┼─────────────────────┐
        department folders      shared with a named      links: password, expiry,
        by department, not       person inside the        no public upload,
        by site                  Home by default          no federation

   Hetzner's own backups, several times a day, and the Home's copy on the premises

Not the whole decade, because the departments were asked what they needed.

What could go wrong?

  • Hetzner suspends the account, and the files are unreachable until the Home’s own copy is served from somewhere else. Nothing is lost, because the copy is a day old at most.

  • A funder’s link outlives the funder’s need, and the expiry date is what remembers.

  • The identity provider is down, and the local administrator opens the store while staff wait for their logins.

  • The editing decision gets made in a hurry, and a fifth company arrives under the documents without a scrap.

The file store is gone, what now? The Home’s copy on the premises is served from a fresh Nextcloud at another European host, or read straight from the disk, because it is plain files. Staff log in with the same identities, because those were never the store’s. The links that were out in the world stop working, which they were going to do anyway. The sticky-note photograph does not come back, and nobody wanted it kept.

Magrat writes everything down, in three notebooks, and keeps one of them somewhere the other two are not.