Google Workspace alternative: when custody beats the suite

Most organisations on Google Workspace should stay on Google Workspace. Gmail’s spam filtering is better than anything I can build, Docs and Meet have no replacement your colleagues will accept quietly, and the admin console does things — SSO, device policy, retention holds — that a mail host simply does not do. This page is for the smaller group whose first requirement is different: the stored mail has to sit in infrastructure and a jurisdiction you choose. If that requirement is not written down anywhere, keep Workspace and go read something else.

Is Google Workspace actually a problem?

Not in the way privacy marketing implies, and yes in one specific way.

Workspace mail is not scanned to target advertising; Google ended ad-targeted scanning of consumer Gmail content in 2017, and Workspace never had it. The issue is structural rather than behavioural. Google holds the bytes, Google is a US company, and the US CLOUD Act — in force since 2018 — obliges a US-incorporated provider to produce data under its control no matter which country the disks are in. Google sells data-region controls on some plans, which pin where data rests. That answers residency and leaves jurisdiction where it was.

For most buyers that is an acceptable trade, made knowingly. For a defence subcontractor, a works council, a law firm with a client mandate, or a public body operating under a written sovereignty rule, it is the whole decision.

What do you give up when you move email off Workspace?

Three things, and one of them is bigger than people expect.

The suite goes first: real-time Docs and Sheets collaboration, Drive sharing with people outside the company, Meet links that everyone already knows how to click. Shared Calendar is the one that actually hurts — room booking, free/busy across the org, and the assumption baked into every colleague’s habits.

The admin plane goes second. Workspace as a SAML identity provider for your other SaaS, enforced two-step verification, DLP rules, Vault retention and eDiscovery, mobile device management, audit logs. A bring-your-own-storage mail host has none of that, and pretending otherwise would be silly.

The filter is third. Gmail’s spam classifier is trained on a share of the world’s email that nobody else has. Nisdos Mail filters with content heuristics, reputation checks and a per-mailbox classifier trained only by your own mark-spam clicks — private, explainable, and starting from far less signal than Google’s.

What do you gain?

Custody, jurisdiction as a setting, a bill that ignores headcount, and addresses you stop rationing.

Every message is encrypted with a per-mailbox key before it is written into storage you own — your S3 or R2 bucket, your WebDAV server, a Git repository. The device-custody tier, in beta, generates keys in your browser and erases our copy, after which we cannot read your stored mail either.

Jurisdiction becomes two explicit choices rather than one inherited default: the region where the bytes physically sit, and the country where the storage operator is incorporated. Region alone is not jurisdiction, which is precisely why an EU region operated by a US company does not satisfy a sovereignty mandate.

Pricing stops tracking hiring. Nisdos Mail is $2 per 25 GB per month with unlimited domains, users and aliases, plus $1 per 25 GB for EU-resident storage. A fifteen-person team’s mail bill becomes a function of stored volume, and unlimited addresses on your own domains changes how you use email — one per vendor, one per project, one per deploy pipeline.

Leaving is also different. There is no export, because the archive is already in your account. You re-point the routing.

Can you keep Workspace and move only the mail?

Yes, and this hybrid is what I recommend to most teams that contact us. Workspace supports running without Gmail: switch the Gmail service off in the admin console, keep Docs, Drive, Calendar and Meet, and point your domain’s MX records at the mail host. Calendar invitations continue to work, because invitations are ordinary email messages. You keep the collaboration tools and Google stops storing the correspondence.

The narrower version works too. Custody is a per-domain or per-mailbox setting, so you can move only the mailboxes that carry the requirement — legal, HR, the board — and leave everyone else where they are. A sovereignty rule that applies to one department does not have to become a company-wide migration project.

How does the migration actually go?

Roughly two days of real work spread across a month, and the archive is the slow part.

Set the domain up at the new host first and let it verify SPF, DKIM and DMARC while Gmail is still receiving everything. Then move the archive: Takeout for a complete MBOX per account, or imapsync straight from Gmail into the new mailbox, which usually reaches a usable state sooner. Run both in parallel by forwarding from Gmail to the new mailbox, so nothing depends on getting DNS right the first time. Cut the MX records over once outbound sending looks clean in your DMARC reports, and keep the Workspace account for one more billing cycle.

The failures are predictable. Automated senders nobody remembers — invoices, monitoring alerts, CI notifications — are configured against old addresses. Anything using “Sign in with Google” keeps working only while the Workspace account exists. And someone will have a filter rule in Gmail that quietly held their workflow together for six years.

Who should NOT do this?

Say no if any of these describe you.

Your team lives in Docs and Sheets with heavy real-time collaboration and external sharing; mail is the least of what Workspace does for you. You use Workspace as your identity provider, in which case cancelling it means replacing your IdP as well. You rely on Vault for legal hold or eDiscovery under a regulatory obligation. Nobody on staff wants to own storage credentials and test a restore. Or the requirement you are actually trying to satisfy is EU data residency and nothing more — in that case Google’s data-region controls, or an EU-hosted suite, will get you there with a fraction of the disruption.

Custody is a real property with a real price, paid in tooling you no longer have and responsibility you now carry. Buy it when a requirement says so.