How digital sovereignty shapes Amnesty International Spain’s tech model

Transformation of an organization is no longer measured solely in terms of productivity, automation, or the adoption of new tools. In nonprofits like Amnesty International Spain, technology has also become a matter of independence, privacy, and the ability to act autonomously.

For over 14 years, the Spanish branch of the organization has operated with a clear premise to minimize its dependence on large technology platforms, and maintain control over its data, systems, and communications. This strategy, amid the ongoing European debate on digital sovereignty and AI, is taking on a new dimension. “From the ground up, we have a policy of being technologically independent, hosting as much as possible ourselves to ensure we have no problems suing any company, or that any report we publish doesn’t affect the systems we work with,” says head of IT infrastructure Carlos López Belenguer.

Having worked like this long before concepts such as digital sovereignty became a regular part of the European tech debate, people are now discussing it more. “I think it’s a powerful and quite appropriate term,” he says.

Technology to avoid dependence on big tech

Amnesty International Spain’s tech strategy has focused on finding free software alternatives and self-hosted systems that allow them to maintain control over their infrastructure. “One of the great advantages of free software is we aren’t dependent on any company to work,” says Belenguer, adding it’s especially important in an organization dedicated to defending human rights, so it can denounce or investigate any company knowing it won’t face retaliation regarding the use of software.

In his view, the current geopolitical context and some recent moves by large technology companies further reinforce this philosophy. “It’s no coincidence Microsoft is withdrawing a significant portion of its licensing model for NGOs right after Donald Trump said none of its suppliers could have certain policies that went against his administration’s philosophy,” he says.

Belenguer adds that these types of changes can create significant economic and technological problems for organizations that depend entirely on external platforms. “When you already have your entire infrastructure in place, you don’t have many options to switch to the competition, because you’re really intertwined,” he says.

Providing the means

A prime example of this strategy has been implementing Nextcloud as an internal collaborative work platform. But Belenguer’s relationship with this tool began years before its deployment within the organization. “I was already familiar with the software and had been following it for years,” he says.

At that time, Amnesty International Spain was still working with local file servers, and solutions like Microsoft 365 and Microsoft SharePoint were just beginning to spread. “Like many others, we worked with a file system on a local server in the office,” he says. “Everyone went to work in person, and the whole Office 365 movement was just starting to emerge.”

However, the organization decided to explore another option. “I proposed Nextcloud because I was already familiar with it, had considerable experience with open-source software, and we already had quite a few things hosted,” he says. “In the end, it was just a matter of launching one more product.”

The implementation began with a small pilot test with five users, which later grew to 10, and then 30. But the major turning point came with the pandemic in 2020 and the rise of remote work. “By then, we already had it up and running in production with everyone using it,” Belenguer says. “It practically saved our lives in IT.”

The tool evolved from a simple file-sharing system into a collaborative work platform. “When people saw they could edit documents concurrently and work together seamlessly, they began to find many more uses for it,” he says.

Privacy, flexibility, and control

Beyond functionality, Belenguer says the main differentiating value of these types of solutions is control over infrastructure and data. “The only real way today to guarantee privacy when working with big tech is to leave big tech,” he says.

In this way, he expresses a particularly critical view of how large tech platforms handle personal data. “Microsoft seeks to create a general profile of everyone who works with or uses a computer,” he says, adding that the increasing integration of digital services, accounts, and tools is generating a massive collection of information about users. “All this is done under the guise of improving security or ensuring a better user experience.”

Free software, on the other hand, offers a more flexible and secure alternative. “Being your own Google without compromising user privacy and documents, and being technologically independent is a huge leap,” he says.

In addition to privacy, the adaptability offered by working with one’s own infrastructure is also key. “We’ve had much more flexibility both in managing the platform and in recovering lost data, as well as enabling different ways of working,” he says.

Despite its commitment to technological independence, Amnesty International Spain acknowledges that some dependencies remain difficult to overcome, so certain tools from major tech companies have become de facto standards. “A big commitment I feel we have to make is to use Teams,” says Belenguer. “Many people don’t realize an alternative exists.” Still, he adds the organization has achieved a high degree of technological autonomy. “I’d say we’re at about 70% independent,” he says. “If the US cuts the cord, we believe we could continue working practically without problems.”

AI: opportunity and concern

Regarding AI, Amnesty International Spain has developed internal policies to limit use of external tools with sensitive data. “We’ve developed policies to ensure personal data is neither shared nor fed into any AI controlled by a large company,” he says.

At the same time, the nonprofit is working on projects to deploy its own self-hosted models that can offer users tools with which to process personal data without compromising sensitive information. Among the projects under development are those related to videoconferencing, transcription, and voice and text analysis and synthesis. “We’re aiming for a hybrid model in which certain tasks can be performed with external tools, and others require our own infrastructure,” he says.

Belenguer understands AI will continue to profoundly transform the work of organizations. “There’s practically no aspect of our work that won’t be affected,” he adds. Despite this, he believes this very transformation makes maintaining technological control even more important. “It’s a very good time to try to become technologically independent and control most of our systems,” he says.

A cultural shift that has already begun

Belenguer acknowledges those who opted to maintain their own infrastructure and reduce dependence on large technology platforms were seen as oddities. “For a long time, we felt quite alone doing this,” he says. But he believes the current context is driving a change in mindset. “In the last two years, though, we’ve seen a major ideological shift. There’s constant and enthusiastic talk about digital sovereignty, hosting your own systems, and owning your data.”

This shift confirms the path the organization embarked on years ago made sense. “Now we realize we were largely right and we’ve done the necessary thing,” he says.