2026-09-11

Governments are moving to LibreOffice for digital sovereignty — what that means for your .odt, .ods, and .odp file's hidden metadata

On December 4, 2025, Schleswig-Holstein's state government announced that LibreOffice had become the binding office standard across its ministries and authorities — around 80% of the state's roughly 30,000 workstations already switched over, with Microsoft Office being removed rather than merely supplemented, and about €15 million a year in licensing costs saved in the process. Seven months earlier, Denmark's Ministry of Digitalisation announced it was doing the same thing, with Minister Caroline Olsen framing it in plain terms: "we must never make ourselves so dependent on so few that we can no longer act freely." Neither government is switching software for its own sake — both call it digital sovereignty. But switching software also means switching file formats: LibreOffice's native documents are OpenDocument files — .odt, .ods, .odp — not the .docx, .xlsx, .pptx this blog has covered before. And OpenDocument keeps its hidden properties somewhere completely different.

A different suite, a different metadata file

An .odt, .ods, or .odp file is a zip archive, the same as a .docx — you can rename either to .zip and open it. But where OOXML spreads its properties across three separate XML parts (docProps/core.xml, app.xml, custom.xml — the split this blog described in an earlier post), OpenDocument keeps almost all of it in a single file: meta.xml, sitting at the root of the archive next to content.xml and styles.xml. If more public bodies keep moving to LibreOffice the way Schleswig-Holstein and Denmark's ministry have, more of the forms, templates, and attachments an ordinary person downloads from a government site — or fills out and sends back — will carry that file instead of the Microsoft kind.

What's actually sitting in meta.xml

The Document Foundation — the nonprofit that develops LibreOffice — published its own rundown of this in an October 31, 2025 post titled "ODF format security: encryption, signatures and metadata management." It lists exactly what meta.xml can hold: "author name, change history, and save times," plus "custom properties, such as project codes or internal comments." It also states the risk plainly — "malicious actors can extract metadata for social engineering, document tracking, or profiling purposes" — and its own advice for dealing with it is to "use metadata cleaning tools... or document sanitisation tools, such as manually inspecting the 'meta.xml' file within the ODF archive," alongside avoiding unnecessary comments or tracked changes before sharing in the first place. That's the same category of information a Word file's core.xml and app.xml carry — a name, a company, a history of who touched the file and when — just filed under one XML element tree instead of three.

LibreOffice has a reset button — it's just not the default

LibreOffice does ship its own way to clear this. Its own help documentation describes a "Remove personal information on saving" option under Tools → Options → Security, which — once turned on — strips "any names in the created and modified fields," deletes the modification and printing dates, and resets the editing time to zero and the version number to 1, every time the file is saved from then on. Short of enabling that setting, the same page describes a one-off fix: the Reset Properties button under File → Properties → General, which does the same cleanup for the document open at that moment. Both are real, useful, and — this is the detail worth sitting with — off by default. Someone who just switched from Word to LibreOffice because their ministry mandated it isn't necessarily going to have found either setting, particularly if they only open the document once, fill in a field, and send it back.

What NearScrub does with an .odt, .ods, or .odp file

NearScrub's Office scrubber, scrubOffice(), now recognizes ODF files by their .odt/.ods/.odp extension and blanks their meta.xml the same way it blanks a Word or Excel file's docProps parts — replacing it with an empty <office:meta/> element rather than deleting the file outright, so the archive stays valid for LibreOffice to reopen. Worth being direct about why that matters: for a while, NearScrub's own code did not treat that case correctly. Before this fix, the app accepted an ODF file, reported that it had found nothing to remove, and handed back a re-zipped copy with the author, company, and title still sitting inside it — the one outcome a metadata scrubber cannot afford, someone believing a file is clean when it isn't. That gap is closed now, and it's mentioned here rather than left implicit because a privacy tool that hides its own past misses is worse than one that's honest about them.

What it still can't touch

Two limits apply here exactly as they do to a Word or PowerPoint file. First, NearScrub only clears the property file — meta.xml for ODF, the three docProps parts for OOXML. Tracked changes and inline comments in an ODF document live inside content.xml as <text:change> and annotation elements, not in the metadata NearScrub touches; if a reviewer's name or an internal note is sitting in a tracked edit, only accepting or rejecting those changes inside LibreOffice itself removes it. Second, NearScrub's ODF support covers the three extensions people actually exchange as documents — .odt, .ods, .odp — not every OpenDocument type LibreOffice can produce, and not a file that's already been sent. Running a file through NearScrub changes the copy on your device before it leaves; it can't reach back into an inbox, a shared drive, or a government docket where an unscrubbed version already landed.

The takeaway if a form just arrived as .odt instead of .docx

None of this is a reason to distrust OpenDocument specifically — it carries the same category of hidden properties a Word file always has, no more and no less. The practical change is just which habit to build for a format you may be seeing for the first time: check File → Properties before sending an .odt, .ods, or .odp anywhere a Word file used to go, turn on LibreOffice's own "remove personal information on saving" if you'll be doing this regularly, and run the file through NearScrub as a last step before it leaves your device either way — entirely in the browser, nothing uploaded to do it.