“They're certified under the Data Privacy Framework”
The EU-US adequacy decision covers this
It still stands. The American watchdog it leans on has one member left out of five.
The EU-US Data Privacy Framework is the arrangement that currently allows personal data to move from Europe to certified American companies. It is in force, and Europe's General Court upheld it in September 2025, with an appeal still pending. Two things about the machinery behind it are worth knowing. The independent American oversight board that the European Commission relied on, when it judged Europeans to be protected, has been unable to take decisions since three of its five members were removed in January 2025. And the complaints route offered to Europeans was created by a presidential order, which the same office can rewrite.
What this does not settle. The outcome of the court case over those removals, after the American Supreme Court ruled in June 2026, could not be confirmed.
Commission Implementing Decision (EU) 2023/1795 · checked 2026-09-04
What to ask instead
What is your plan for those systems if the EU-US data deal is struck down on appeal?
The arrangement is in force, so this is not a question about today. It is the ordinary planning question anyone running a public service should be able to answer, and it is under appeal now rather than hypothetically one day.
If the answer is a European company you can name, that settles it.
The other six
- “It's hosted in Europe”
- “We have SCCs and a DPA”
- “Enterprise tier — they don't train on our data”
- “We're on a sovereign cloud with a European operating entity”
- “It's encrypted, in transit and at rest”
- “Nothing sensitive goes in there”
Or run the whole test on your own company — about four minutes, nothing kept.