“It's hosted in Europe”
Our data stays in EU data centres
It does not matter that the data centre is European. The CLOUD Act reaches whoever runs it.
Running a service in a European data centre is a real safeguard, and for some purposes it is required. It does not settle who can demand the data. The American CLOUD Act obliges a company to hand over information it holds whether that information sits inside or outside the United States. A data centre in Frankfurt operated by an American company is therefore still operated by a company an American court can give an order to. What decides the question is not where the machines stand but whose they are: the company being paid, the company that owns it, and the company that runs the hardware.
What this does not settle. How far that reach stretches has not been settled by a court.
18 U.S.C. §2713 · checked 2026-09-04 · 50 U.S.C. §1881(b)(4), as amended by RISAA §504 · checked 2026-09-04
What to ask instead
Which company runs those data centres, and who owns that company?
Where the building sits is easy to answer and answers nothing. Who runs it is the fact that decides this, and any supplier can tell you in one sentence.
If the answer is a European company you can name, that settles it.
The other six
- “We have SCCs and a DPA”
- “Enterprise tier — they don't train on our data”
- “They're certified under the Data Privacy Framework”
- “We're on a sovereign cloud with a European operating entity”
- “It's encrypted, in transit and at rest”
- “Nothing sensitive goes in there”
Or run the whole test on your own company — about four minutes, nothing kept.