Legal Masterthesis on Nextcloud as a service [ongoing thread]

Hello everyone
A few years ago I was very happy to discover nextcloud, which provided all the functionalities I was looking for my organizations without fueling the big tech feudalism threatening our paths towards fully democratic societies.

Currently I am writing my disposition for my masterthesis about the legal qualification of Software as a Service contracts around the example of Nextcloud as a service.

Although I have some tech understanding I would be happy to find tech- and/or legal support and/or general inspiration for my thesis.

One thing I fear is, that through my work I unknowingly open / show loopholes (like the ASP-loophole), which doesn’t help the FLOSS project. So beside looking for inspiration and help I open this thread as well, so that people from the FLOSS community can criticise my blind-spots etc

The use cases I am focussing on are the following:
The nextcloud provider offers on the software side

  1. full access to nextcloud similar to self-hosted nextclouds (all apps can be installed)
  2. limited access but within that the user can freely un-install certain apps
  3. fixed acces. The provider lets freedom of choice to the user

On the hardware side one needs to differentiate as well

  • Who is the main responsible for saving the User data? User or Provider?
  • Server-Questions
  1. Does the Provider provide a “real” “physical” nextcloud server
  2. Or an Virtual Server
  3. Or does he “rent” his infrastructure from a third party as well via Plattform / Infrastructure as a service.

On the legal side I focus on “failure to perform”

  1. Non-performance due to a posterior impossibility egs. factual: Seizure of the server; legal: nextcloud is banned in a certain country
  2. Delay in performance egs. Up-Time questions
  3. Bad performance, in the form of bugs or corrupt user-data
  4. Maybe as well “theft” of user data. (but this might already be a secondary obligation and I will only focus on primary obligations)

Do you have any other suggestions for examination of nextcloud as a service use-cases or hardware cases or performance failure categories?

Hope that this thread is going to be interesting. If you think reddit or an other forum is more apt for such a discussion thread, please tell me as well.