Skip to content
Kanroo
Sign inStart free

EU hosting vs. EU company: what the CLOUD Act means for your data

An EU region of a US provider is still a US provider. What the CLOUD Act covers, what EU law says, and eight questions to ask any provider.

By Dejan Vi.Published 8 min read
On this page

Not legal advice. This post explains the law in plain words. For your own case, ask a lawyer.

Many software vendors now offer an “EU region”. Your data stays in Frankfurt, Paris or Dublin. That is useful. But it answers only one question: where are the disks? It does not answer the question that matters most if a foreign government asks for your data: whose law does the provider have to obey?

Three things that are often mixed up

  • Storage location. The data center where your data is stored.
  • Processing location. Where the data is read, changed and backed up. This includes remote access by support or operations staff from other countries.
  • Jurisdiction. Which country’s courts can give orders to the company that controls the data. This follows the company, not the server.

A server in Germany can belong to a company that must obey US courts. That is the point of the CLOUD Act.

What the CLOUD Act says

The US passed the CLOUD Act in March 2018. It added one short section to US law, 18 U.S.C. § 2713. A provider of online communication or storage services must hand over data in its “possession, custody, or control”. This applies whether the data is stored inside or outside the United States.

So for a US provider, the EU region does not change the answer. If a US court issues a valid order, the provider must comply, wherever the data is stored.

Who counts as a provider under US jurisdiction? The US Department of Justice (DOJ) answered this in 2019. Jurisdiction “is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons.” A foreign company can also be covered if it has “sufficient contacts” with the US, for example if it actively serves US customers. The DOJ calls this a “highly fact-dependent” test. The DOJ also says that the CLOUD Act did not extend US jurisdiction to new companies. It only made clear what covered companies must hand over.

The short version:

  • A US company is clearly covered.
  • An EU company with a US parent may be covered through its parent.
  • An EU company with real US business may be covered.
  • An EU company with no US ties is very hard to reach.

Can a provider push back?

Partly. A provider can ask a US court to cancel an order if it conflicts with a foreign law. But the formal route in the CLOUD Act is open only for countries that have signed an agreement with the US under the Act. Today these are the United Kingdom and Australia. The EU and the US have negotiated such an agreement since 2019. As of October 2026, we found no signed agreement. US courts can still weigh foreign interests (“comity”), but that is up to the judge.

Spy law is a separate track

The CLOUD Act is about criminal investigations, with a judge and a warrant. US intelligence agencies use other laws.

  • FISA Section 702 lets US agencies target non-US persons abroad. It does this through orders to electronic communication service providers. In 2020 the EU Court of Justice found that it lacks proper limits and redress for people in the EU. Status as of October 2026: the law behind Section 702 lapsed in Congress in June 2026. Court approvals from March 2026 keep the program running until March 2027, most sources say. By mid-October 2026, no renewal had become law.
  • Executive Order 12333 covers intelligence collection outside the US, for example on network cables. It does not need a provider’s help. Choosing an EU provider does not change this. Encryption in transit does help.

The EU side

EU law takes the opposite view. Article 48 of the GDPR says that a foreign court order to hand over personal data can be recognised only if it is based on an international agreement, such as a mutual legal assistance treaty. A US provider in the EU can therefore face two laws that say opposite things. The provider carries that conflict, not you, but your data sits in the middle.

In Schrems II (case C-311/18, July 2020), the EU Court of Justice struck down the Privacy Shield, the earlier EU–US transfer deal. The reason was US surveillance law.

Its successor, the EU–US Data Privacy Framework, has been in force since July 2023. It is valid today. In September 2025 the EU General Court rejected a challenge by the French MP Philippe Latombe. He has appealed to the Court of Justice (case C-703/25 P), and the appeal is still pending. There are open questions. The US oversight board that the framework relies on has had no quorum since January 2025. The legal basis for Section 702 lapsed in June 2026. These facts do not make the framework invalid. They are reasons to watch it.

The framework also does not answer the CLOUD Act question. It governs transfers to the US. The CLOUD Act governs what a US-controlled provider must hand over, wherever the data is.

What regulators say about EU subsidiaries

The European Data Protection Board (EDPB) describes this exact case. An EU company is a subsidiary of a non-EU parent and is “subject to third country legislation with extraterritorial effect”. If it hands over data on a foreign request, that is a transfer under EU law. The customer must check this before it hires the provider.

The German data protection authorities (DSK) said the same thing in January 2023. The risk alone is not yet a transfer. But it can make a provider less reliable. In that case “especially high requirements” apply to the customer’s check.

In June 2025 the French Senate asked a Microsoft France director, under oath, if he could guarantee that French citizens’ data would never go to US authorities without French consent. His answer: «Non, je ne peux pas le garantir» (“No, I cannot guarantee it”). He added that this had never happened so far. His answer shows the legal position of every provider under US jurisdiction. It does not show a failure by one company.

Eight questions to ask any provider

  1. Which company signs the contract, and in which country is it registered?
  2. Who owns that company? Is there a parent company outside the EU?
  3. Does the company or its group have offices, staff or data centers in the US?
  4. Can staff outside the EU access customer data, for example for support?
  5. Which sub-processors handle your data, and where are they registered?
  6. Has the provider received foreign government requests? Does it publish a transparency report?
  7. Will it challenge unlawful requests and tell you about them where the law allows?
  8. Which data goes to non-EU companies anyway, for example for billing or email delivery?

A good provider answers these in writing. The data processing agreement and its sub-processor list are the first place to look.

How Kanroo answers these questions

We make Kanroo, so we are not neutral. Here is what we can check, and where.

  1. Contract: TECHPOINT, a German business. The imprint says who runs it.
  2. Content data: Boards, wikis and files are stored and processed by two EU companies only. netcup GmbH (Karlsruhe, Germany) runs our servers in Nuremberg. Scaleway SAS (Paris, France) stores files in Amsterdam and sends our email from Paris. The sub-processor list comes from our data processing agreement.
  3. Owners: netcup is part of the Austrian Anexia group. Scaleway is part of the French iliad group. Neither has a US parent company.
  4. Billing: Paid plans are sold by Polar Software, Inc., a US company, as merchant of record. Polar receives billing data: the owner’s email address and an internal user ID, a billing email if the owner enters one, the organization name, an internal organization ID, the plan and the number of seats. After an ownership transfer, Polar also gets the new owner’s name. You enter your payment details at Polar directly. Polar never receives boards, wikis or files. Free plans send nothing to Polar. The other parties table lists everyone else.
  5. Email: We send email from Paris. Once delivered, an email is stored by your mail provider, wherever that provider is.
  6. Your own servers: Kanroo’s core is open source (AGPL-3.0). If you need full control, self-host the core without plan limits. You can also export a board as JSON or CSV at any time.

Our security measures and the short version of this answer are on the Trust page. If you compare tools, our EU Trello alternatives post applies the same questions to six Kanban tools.

EU hosting is a good start. An EU company is a better one. Neither replaces your own check, and we will keep this post up to date.

Last checked: 16 October 2026.

Sources

All pages were opened on 16 October 2026.

Did you like this post?

Try it on your own board.

Kanroo Cloud has every feature on every plan. Try it with a real project, then decide.

Start freeSee pricing