"Stored in Europe" does not mean "in European hands". Under the US CLOUD Act, an American company must hand over data it controls when US authorities demand it — even if that data sits in a data centre in Amsterdam, Frankfurt or Dublin. What protects your data is not where the server stands, but who controls it.
What the CLOUD Act is
The CLOUD Act — the Clarifying Lawful Overseas Use of Data Act — became US law in March 2018. It settled a long legal fight about whether American authorities could demand emails that Microsoft stored in Ireland.
The answer the law gave is simple: yes. A US provider must disclose data that is in its "possession, custody, or control", regardless of where in the world the data is stored.
That applies to American companies and, in practice, to their European subsidiaries. If the parent company controls the data, the location of the building does not change the answer.
It is not the only law
The CLOUD Act gets the most attention, but it is part of a wider set of rules. Section 702 of FISA lets US intelligence agencies collect communications of non-Americans held by American providers. This was at the heart of the Schrems II ruling in 2020, in which the European Court of Justice struck down the earlier EU–US data agreement because European data was not adequately protected.
Today a newer agreement, the EU–US Data Privacy Framework (2023), allows data to flow again. But it rests largely on a US presidential executive order. What one president signs, another can change.
"But they promised"
Large American providers now offer "EU data boundaries" and "sovereign cloud" products. They store data in Europe, hire European staff and promise to challenge improper requests.
Those efforts are real, but they cannot change the law their parent company is subject to. In June 2025, a senior legal director of Microsoft France was asked under oath by a French Senate inquiry whether he could guarantee that French public data would never be handed to US authorities without French approval. His answer: no, he could not guarantee that.
That is an honest answer. It is also the whole point.
What this means for a small organisation
You may think: nobody in Washington is interested in my design studio, my sports club or my family photos. Most likely you are right. But sovereignty is not about expecting the worst. It is about deciding for yourself.
- You promise privacy to others. Your clients, donors, patients and members trust you with their information. Under the GDPR you remain responsible for where it goes.
- You cannot see the requests. Demands for data often come with a gag order. Your provider may not be allowed to tell you.
- Rules change faster than contracts. Sanctions, trade disputes and new laws can affect your provider overnight — and through them, you.
The question is not "will this happen to me?" but "who decides if it does?"
What actually keeps your data in European hands
Three conditions, together:
- The provider is a European company with no parent company subject to US law.
- The infrastructure is European — servers, hosting company and support staff.
- The software is open, so you can verify what it does and take your data elsewhere.
Location alone is the weakest of the three. Control is what counts.
How SovraQ handles this
SovraQ is built so that only European law applies. It is a European company, hosted by a Dutch hosting company on servers in the Netherlands, built on open-source software, with no American cloud underneath. There is no US parent to receive a demand, because there is no US parent.
It is a choice for autonomy: your organisation's email, documents and files under rules you can understand and rely on. Read more about what digital sovereignty means for a small team.
Keep your data in European hands
SovraQ — sovereign email, documents and files — launches in March 2027. Join the waitlist for early access.
Frequently asked questions
Does the CLOUD Act apply to data stored in the EU?
Yes, when the data is controlled by a company subject to US law. The law is explicitly about data "regardless of whether" it is stored inside or outside the United States.
Does the GDPR protect me against the CLOUD Act?
The GDPR limits when data may be transferred to non-EU authorities, which can put a provider between two conflicting laws. It does not stop US law from applying to an American company. The safest route is a provider that is not subject to US law at all.
Are "sovereign cloud" offers from American companies enough?
They reduce some risks, such as where data is stored and who operates it day to day. As long as the ultimate owner is subject to US law, they cannot fully guarantee that US demands won't reach your data.
This article explains the general situation and is not legal advice.
