In short: renting business tools from an American SaaS provider exposes a French firm to the CLOUD Act, pricing dependency, and vendor lock-in. Owning a WordPress plugin installed on a sovereign host makes these three risks obsolete. This is why I have refused to sell Client Vault as a SaaS since day one.
Friday evening, 7:00 PM. You close your firm, you head home. Somewhere in California, a developer pushes a new version of their SaaS. Without warning, they modify a storage rule. Monday morning, you discover that a client file has become inaccessible. You call support. They respond in English, seven hours later.
This scene is not a dystopia. It is the daily reality for thousands of French firms that have entrusted their workflow to a provider whose code, servers, and jurisdiction they do not control. And while cloud agility is praised, we forget to ask the only question that matters: who really owns what runs your firm?
SaaS is not a tool. It is a lease
We have become accustomed to saying “I use Clio,” “I took out a TaxDome subscription,” “we are on HoneyBook.” The verb is misleading. You are not using; you are renting. And like any lease, this contract can be terminated, modified unilaterally, or rendered unusable by an external event over which you have no control.
The initial price you were sold is merely an introductory rate. When HoneyBook raises $250 million in a Series E round, it is not to offer you a better product the following year. It is to monetize that $250 million, which eventually results in a pricing policy that bears no resemblance to your initial agreement. When Clio reaches $400 million in annual revenue, its obligations to investors become greater than those to its users. It is mechanical, not even dishonest. It is simply the model.
Closd, which French law firms used for their M&A transactions, was acquired by LexisNexis in 2024. So was Jarvis Legal. Genapi, which equipped notarial offices, has been under the Septeo umbrella since 2017. Each acquisition is a door closing: roadmap changes, end of support for certain features, and forced migration to the new owner’s stack. Users never signed up for this. They had no choice.
Schrems II and the CLOUD Act are not theories
When you entrust your clients’ documents to a SaaS whose publisher is based in the United States, you are entrusting them to the United States. It does not matter whether the servers are in Frankfurt or Dublin. The Clarifying Lawful Overseas Use of Data Act, passed in 2018, gives American authorities the power to requisition any data held by an American company, wherever it is hosted. It is no coincidence that the Court of Justice of the European Union invalidated the Privacy Shield in 2020.
« The requirements of United States domestic law, particularly certain programs that allow public authorities in that country to access personal data transferred from the Union for national security purposes, entail limitations on the protection of personal data that are not framed in a way that meets requirements substantially equivalent to those required under Union law. »
CJEU, Schrems II judgment, July 16, 2020, C-311/18
In translation: a French firm that stores client documents on a SaaS platform provided by a U.S. company can no longer hide behind the simple European location of the servers. You must question the provider, its jurisdiction of incorporation, and the depth of its obligations toward U.S. authorities. If the DPA you have signed does not address these points in detail, your GDPR compliance is, at best, fragile.
The hidden cost: what you are really paying over five years
The economic argument for SaaS is misleading. Seventy euros per user per month seems reasonable for a four-person firm. Over five years, that is sixteen thousand eight hundred euros. And those are only the direct costs: this does not account for the additional modules you were sold along the way, annual price increases, or the cost of an exit migration when you decide to switch.
Above all, this calculation masks an invisible but very real cost: dependency. As long as you are a tenant, you cannot truly leave. The lock is not in the contract. It is in the friction of migration: exporting your data, converting it into a format usable elsewhere, reconnecting links between client files and documents, and rebuilding automations. This friction has economic value. It is what SaaS publishers buy when they acquire a competitor. It is what compels you to accept, against your will, the next price hike.
Owning your tools is not nostalgia. It is a discipline
The most experienced professionals of my generation started with software they owned. The source code was sometimes provided with the license. The server was in the archive closet. When the software publisher went out of business, the firm continued. When the firm wanted to migrate, it could — the data belonged to them, in their own database, on their own disk.
This era did not disappear because it was inferior. It disappeared because a whole generation of professionals was sold the idea that outsourcing was progress. It was primarily a transfer of risk onto them. Today, common sense is returning — not out of nostalgia, but out of calculation. And the technical stack has caught up with the idea: a WordPress site hosted by a French provider, using a custom plugin that you own, now offers what no SaaS can provide: full and complete ownership of your data, your code, and your future.
Why I designed Client Vault as a plugin, not a SaaS
When I started Client Vault, the SaaS option would have been simpler from a business perspective: recurring revenue, easier valuation, everything is faster to build. I refused for a reason that is not ideological, but practical. Everything I would sell as SaaS would expose my clients to the risks I just described. I could not, in good conscience, tell them “entrust me with your clients’ documents” while knowing that I was becoming, mechanically, a single point of failure.
Client Vault is therefore a WordPress plugin. It installs on the server you choose — OVH, Scaleway, Infomaniak, o2switch, your own VPS, your own hosting managed by your agency. The data stays there. The code is readable and accessible. If I disappear tomorrow, your firm continues to run. If you want to add a feature tomorrow, your developer can do it. This is not a slogan, it is the architecture.
For the WordPress agencies reading this: this is precisely what gives you a strong economic role. A law firm will not, on its own, understand how to configure a child theme, secure a host, or deploy a professional plugin. It is your job, it is your margin. Sovereignty requires technical mediation, and this mediation has value.
What this doctrine does not say
Not all SaaS are bad. For an occasional tool, without critical business data, without strong operational dependency, SaaS remains rational. I am not writing that you must ban Slack, Notion, or Google Workspace from your daily life. I am writing that for the data that constitutes your business — your case files, your patients’ records, your clients’ contracts — dependency is not negotiable.
Similarly, I do not claim that Client Vault replaces all your tools. It does not perform qualified electronic signatures — for that, there are Yousign and Universign, recognized French partners. It does not replace accounting software — Pennylane remains excellent at what it does. The doctrine is not “everything on WordPress.” It is: what contains your critical business data must belong to you.
Let’s get to know each other
If the sovereignty of your client data is non-negotiable, and if this article resonates with your firm’s experience, let’s have a video call. No promise of a refund, no disguised free trial: the approach I offer is clear — twenty to thirty minutes to understand your situation, see if Client Vault can address it, and decide together.
Frequently asked questions
What is the CLOUD Act and who does it concern?
The CLOUD Act is a 2018 U.S. law that allows U.S. federal authorities to requisition data held by any American company, regardless of server location. Any organization that entrusts data to an American SaaS provider — even if the servers are in Europe — falls within this scope.
Why should a French firm refuse an American SaaS?
For critical business data — case files, patient records, client contracts — exposure to the CLOUD Act and unilateral pricing hikes represents an operational and ethical risk. A French professional firm has professional secrecy and data retention obligations that are not suited to total delegation.
What happens to my data if my SaaS provider is acquired?
The acquirer takes over the assets, including the customer base. General terms and conditions are usually subject to unilateral change, provided notice is given. The product roadmap is revised, certain features may disappear, and pricing may change. This is what happened to users of Closd, Jarvis Legal, and Genapi in France.
What does Schrems II mean in practice for a firm?
The 2020 CJUE Schrems II ruling invalidated the Privacy Shield and tightened the conditions for transferring data to the United States. Standard Contractual Clauses (SCC) are no longer sufficient on their own: an impact assessment is required, and in some cases, additional technical measures. A firm using an American SaaS must be able to justify these analyses in the event of a CNIL audit.
What does a SaaS really cost over five years?
The direct calculation is simple: monthly rate multiplied by sixty months. However, you must include additional modules billed along the way, annual rate increases, the cost of specific integrations, and the hidden cost of exit migration. For a firm of five people, the total often exceeds 25 000 € over five years.
Is a WordPress plugin really more sovereign?
If the publisher is French, the host is French, and the code is installed on your server, yes. Sovereignty is not a slogan: it depends on the choice of hosting, the publisher’s jurisdiction, and full ownership of the code. All three conditions must be met.
{ “@context”: “https://schema.org”, “@type”: “Article”, “headline”: “Votre cabinet est trop précieux pour être loué”, “author”: {“@type”: “Person”, “name”: “Dragan Stamenkovic”, “url”: “https://clientvault.pro/auteur/dragan-stamenkovic”}, “datePublished”: “2026-05-10”, “dateModified”: “2026-05-10”, “publisher”: {“@type”: “Organization”, “name”: “Client Vault”, “logo”: {“@type”: “ImageObject”, “url”: “https://clientvault.pro/logo.png”}}, “mainEntityOfPage”: “https://clientvault.pro/blog/cabinet-trop-precieux-pour-etre-loue” }{ “@context”: “https://schema.org”, “@type”: “FAQPage”, “mainEntity”: [ {“@type”: “Question”, “name”: “Qu’est-ce que le CLOUD Act et qui est concerné ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Le CLOUD Act est une loi américaine de 2018 qui permet aux autorités fédérales américaines de réquisitionner des données détenues par toute entreprise américaine, indépendamment de la localisation des serveurs.”}}, {“@type”: “Question”, “name”: “Pourquoi un cabinet français devrait-il refuser un SaaS américain ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Pour les données métier critiques, l’exposition au CLOUD Act et aux pricing hikes unilatéraux constitue un risque opérationnel et déontologique.”}}, {“@type”: “Question”, “name”: “Que devient ma data si mon SaaS est racheté ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Le repreneur récupère les actifs, dont la base client. Les conditions générales peuvent être modifiées unilatéralement et la roadmap revue.”}}, {“@type”: “Question”, “name”: “Qu’est-ce que Schrems II en pratique pour un cabinet ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “L’arrêt CJUE Schrems II de 2020 a invalidé le Privacy Shield et impose une analyse d’impact pour les transferts de données vers les États-Unis.”}}, {“@type”: “Question”, “name”: “Combien coûte vraiment un SaaS sur cinq ans ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Au-delà du tarif direct, il faut compter les modules additionnels, les hausses annuelles, les intégrations et le coût de migration. Le total dépasse souvent vingt-cinq mille euros pour un cabinet de cinq personnes.”}}, {“@type”: “Question”, “name”: “Un plugin WordPress, est-ce vraiment plus souverain ?”, “acceptedAnswer”: {“@type”: “Answer”, “text”: “Oui, si trois conditions sont réunies : éditeur français, hébergeur français, et code installé sur votre serveur.”}} ] }
