Nine in ten Dutch notary firms send their mail through a US company. Lindstead checked the public DNS records of all 713 notary firms in the KNB directory, all 233 audit firms with a Wta licence from the AFM and the 50 largest law firms on 4 October 2026.1,2,3 For 651 notary firms and 220 audit firms a US-controlled company sits in the mail chain, usually Microsoft. Under the US CLOUD Act, such a company can be ordered to hand over data.4
Summary
- Nine in ten notary firms send their mail through a US company. 651 of 713 (91.3 percent), and 512 run it on Microsoft 365. Only 62 firms have no US company in the chain; 40 of them use a Dutch private cloud.
- Audit firms depend on Microsoft most. 202 of 226 Wta-licensed firms (89.4 percent) run their mail on Microsoft 365, more than financial institutions or heavy industry. All six firms with an OOB licence have a US company in the chain.
- The professional bodies use Microsoft too. 12 of 13 bodies and supervisors, from NOvA and KNB to the Rechtspraak, run their mail on Microsoft 365. The Openbaar Ministerie is the exception.
Where do notaries run their mail?
A notary has a statutory duty of confidentiality.5 The KNB directory lists 892 office locations with 713 different mail domains, which Lindstead counts as firms. 512 of them (71.8 percent) show strong evidence of Microsoft 365: mail delivered to Microsoft, or signed in a Microsoft tenant. With weaker signals it is 612. 96 firms put a US mail filter, N-able Mail Assure, in front of the mailbox.
Mail runs through US companies
Nine in ten notary firms and almost all audit firms have a US company in their mail chain.
Nine in ten Dutch notary firms and 97 percent of audit firms send their mail through a US company.
Firms with a US-controlled company at the mail server or the mailbox (number of firms), %
1 US-controlled company: Microsoft or Google as mailbox, or a US-owned filter or server as first mail server. Firms: unique mail-receiving domains.
Source: KNB directory, AFM Wta register, Advocatie Top 50 and public DNS, 4 October 2026; Lindstead analysis
View data table
| Category | Value | Group |
|---|---|---|
| Wta audit firms (226) | 97.3% | 1 |
| All firms (970) | 92.5% | 2 |
| Notary firms (713) | 91.3% | 1 |
| Top 50 law firms (51) | 80.4% | 1 |
Group 1: Profession. Group 2: All firms. Unit: %.
62 notary firms (8.7 percent) route no mail through a US company. 40 of those use Webstate, a Dutch private cloud for notaries and lawyers.7 In February 2026 the KNB said the profession is working to become less dependent on US technology.6 Measured on mail, most firms have not yet moved.
Mail platforms by profession
| Group (firms with mail) | Microsoft 365, strong | US company in mail chain |
|---|---|---|
| Notary firms (713) | 71.8% | 91.3% |
| Top 30 notary practices (33) | 69.7% | 90.9% |
| Wta audit firms (226) | 89.4% | 97.3% |
| AV Top 50 accountancy firms (50) | 96.0% | 98.0% |
| Top 50 law firms (51) | 62.7% | 80.4% |
Source: KNB directory, AFM Wta register, Advocatie De Stand 2026 (Top 50 law firms, Top 30 notary practices), AV Top 50 and public DNS, 4 October 2026; Lindstead analysis. A filter in front of the mailbox can hide Microsoft, so the Microsoft shares are floors.
How dependent are audit firms?
More than notaries and lawyers. 202 of the 226 Wta-licensed audit firms with a mail-receiving domain (89.4 percent) run their mail on Microsoft 365, and 220 have a US company in the chain. Among the AV Top 50 accountancy firms it is 48 of 50.8 All six firms with a licence to audit public-interest entities have a US company in the chain; five show Microsoft 365 directly and one sits behind a Proofpoint filter. In Lindstead's earlier sector studies the Microsoft share was 78 percent for financial institutions and for heavy industry.
And the large law firms?
32 of the 50 largest law firms (62.7 percent) show strong evidence of Microsoft 365, and 41 have a US company in the mail chain. Lawyers carry a duty of confidentiality under the Advocatenwet.9 Dutch firms score 28 of 36; international firms 4 of 15. That gap is mostly a measurement effect: 14 of the 15 international firms put a Mimecast or Proofpoint filter in front of the mailbox, which hides what sits behind it. The European bar association CCBE advises lawyers to check that a cloud provider is not subject to long-arm foreign legislation.10
What do the professional bodies use?
The bodies that set the rules use the same platform. 12 of 13 professional bodies, supervisors and judicial bodies run their mail on Microsoft 365. The KNB, which warned its members in February 2026, is building a Notariële Private Cloud for client files and hosts its deed platform with the Dutch provider Intermax.11 Its own domain knb.nl delivers mail to Microsoft 365. The Rechtspraak routes mail through the Dutch host Solvinity but signs it in a Microsoft tenant.
Mail of professional, supervisory and judicial bodies
| Body | Microsoft 365 mail |
|---|---|
| Nederlandse Orde van Advocaten (NOvA) | |
| Koninklijke Notariële Beroepsorganisatie (KNB) | |
| Koninklijke NBA | |
| Nederlandse Orde van Belastingadviseurs | |
| Register Belastingadviseurs | |
| NOAB | |
| SRA | |
| AFM | |
| Bureau Financieel Toezicht | |
| Raad voor Rechtsbijstand | |
| KBvG (gerechtsdeurwaarders) | |
| De Rechtspraak | |
| Openbaar Ministerie |
Microsoft 365, strong evidenceNo Microsoft signal
Source: public DNS of each body's main domain, 4 October 2026; Lindstead analysis.
Which firms verified AI accounts?
Few. 32 of 978 firm domains (3.3 percent) carry a domain verification record for OpenAI or Anthropic.12 Among the 50 largest law firms it is 11, among audit firms 18 and among notary firms 11. One notary office has a record for Mistral. No firm has a record for a legal AI vendor such as Harvey or Legora, but those vendors may not use DNS verification at all. A record shows a domain claim, not how much a service is used.
What do these records show, and what not?
The records show where mail and user accounts run. They do not show where client files, deeds or audit files are stored, or which document systems firms use. A US filter processes mail in transit; it is not a mailbox. The CLOUD Act makes disclosure possible for data in a US provider's possession, custody or control; this study found no case of it against a Dutch firm. About half of the notary and audit firms publish no enforcing policy against spoofed mail. Lindstead does not name them, and does not name individual notary offices at all, because many carry a person's name.
How was this measured, and what are the limits?
Populations. The KNB directory behind "Zoek een notaris" (892 locations, 713 mail domains), the AFM register of audit firms with a Wta licence (233 firms, 6 with an OOB licence), Advocatie's Top 50 law firms and Top 30 notary practices of 2026, the AV Top 50 accountancy firms and 13 bodies. There is no complete public register of law firms; the lawyer register is person-level.
DNS. 1,085 domains were queried through a public resolver, with the same method as Lindstead's finance, energy and industry studies. No firm's systems were contacted.
Limitations
- One DNS snapshot; configuration, not contracts, storage location or encryption.
- Filters hide mailboxes, so the Microsoft shares are floors, especially for international law firms.
- The KNB directory also lists law firms with a notarial practice; "firm" means a mail domain.
- Tax advisers are not measured as a separate group. The suppliers behind Dutch private clouds were not checked.
- Without the 25 unconfirmed audit-firm matches, the audit Microsoft share is 188 of 206 (91.3 percent).
Download the data
Download the data (CSV): the Top 50 law firms, Top 30 notary practices, AV Top 50 accountancy firms, the firms with an OOB licence and the professional bodies whose domain was confirmed, 144 rows, with first mail server, Microsoft 365 signals, US mail chain, device-management and AI records and sources. Individual notary offices and smaller audit firms are counted in the totals but not listed. DMARC results are left out on purpose.
Cite: Lindstead (2026), Notaries and auditors send their mail through US firms, registers and public DNS of 4 October 2026. CC BY 4.0 applies to Lindstead's analysis. Research questions and corrections.
What should firms with a duty of confidentiality do?
Lindstead recommends four checks:
- Record which provider handles mail, accounts and client files, and under which jurisdiction.
- Encrypt confidential client material with keys the provider cannot reach.
- Check which AI tools staff use with client data, and whether the vendor is bound by an EU-only processing agreement.
- Publish an enforcing DMARC policy, so criminals cannot send mail in the firm's name.
How can a firm reduce the dependency?
Lindstead is an independent advisory firm as well as a research firm, and takes no fees or commissions from cloud or software vendors. It helps notaries, law firms and audit firms decide whether to move mail, accounts, documents and AI to European providers, and guides the move: an assessment of each system, a choice of European options such as the private clouds already used by 40 notary firms, and a staged migration. AI on client data is often the first step, run on European or the firm's own infrastructure. For some services the current platform with customer-held keys is the proportionate answer; the assessment says which.
Firms that want a first answer can start with the AI Sovereignty Scan: readiness, regulation and hosting in 10 working days, at a fixed price of €6,500 excluding VAT. The legal and professional services page covers the rules that apply.
Frequently asked questions
-
512 of the 713 notary firms in the KNB directory (71.8 percent) show strong evidence of Microsoft 365 mail in public DNS on 4 October 2026, and 651 (91.3 percent) have a US-controlled company somewhere in their mail chain. 62 firms have none; 40 of them use a Dutch private cloud.
-
The CLOUD Act lets US authorities order a provider under US jurisdiction to disclose data in its possession, custody or control, wherever it is stored. Mail held by such a provider falls within that reach. This study found no case of a request against a Dutch firm; it measures the possibility, not an event.
-
202 of the 226 Wta-licensed audit firms with a mail-receiving domain (89.4 percent) show strong evidence of Microsoft 365, and 220 have a US company in their mail chain. Of the six firms licensed to audit public-interest entities, all six have a US company in the chain.
-
Yes. The CSV on this page lists the Top 50 law firms, Top 30 notary practices, AV Top 50 accountancy firms, the firms with an OOB licence and the professional bodies, with their DNS classification. Individual notary offices and smaller audit firms are counted but not listed. Lindstead's analysis is published under CC BY 4.0.
Sources
- KNB, Zoek een notaris (notaris.nl), office directory, read 4 October 2026. www.notaris.nl
- AFM, Register accountantsorganisaties (Wta), read 4 October 2026. www.afm.nl/nl-nl/sector/registers/vergunningenregisters/accountantsorganisaties
- Advocatie, De Stand 2026: Top 50 Nederlandse advocatuur and Top 30 notariskantoren. www.advocatie.nl/content/uploads//001-014_AD01_De-stand-2026_4V.pdf
- 18 U.S.C. 2713, Required preservation and disclosure of communications and records (CLOUD Act). www.law.cornell.edu/uscode/text/18/2713
- Wet op het notarisambt, article 22 (confidentiality). wetten.overheid.nl/BWBR0010388/
- KNB, Notariaat minder afhankelijk van Amerikaanse tech, 26 February 2026. www.knb.nl/actueel/nieuws/notariaat-minder-afhankelijk-van-amerikaanse-tech/
- Webstate, private cloud for notaries and lawyers. www.webstate.nl/onze-klanten/advocatuur-notaris/
- Accountancy Vanmorgen, AV Top 50. www.accountancyvanmorgen.nl/av-top-50/
- Advocatenwet, articles 10a and 11a. wetten.overheid.nl/BWBR0002093/
- CCBE, Guidelines on the use of cloud computing by lawyers, 27 February 2025. www.ccbe.eu/fileadmin/speciality_distribution/public/documents/IT_LAW/ITL_Guides_recommendations/EN_ITL_20250227__CCBE-guidelines-on-the-use-of-cloud-computing-by-lawyers.pdf
- KNB, Opslag digitale dossiers (Notariële Private Cloud). www.knb.nl/ons-beroep/digitaal-werken/opslag-digitale-dossiers/
- Anthropic, Set up single sign-on (domain verification record). support.claude.com/en/articles/13132885-set-up-single-sign-on-sso
Method: all figures from Lindstead's analysis of the KNB directory, the AFM register, published rankings and public DNS records of 4 October 2026; context sources opened on the same date. This page is general information, not legal advice. Corrections: contact@lindstead.com. Research policy.