The Cloud Act does not care where your servers are

There is a reassuring sentence on many websites: “your data is hosted in Europe”. It answers a real question, data residency, but not the one the Cloud Act asks. This 2018 US law does not ask where the servers are. It asks who operates them.

What the law says

The Clarifying Lawful Overseas Use of Data Act allows US authorities to compel a provider subject to US jurisdiction to hand over data in its possession or control, wherever that data is stored. The criterion is jurisdiction over the company, not the datacentre’s geography. A Paris region operated by a US company is in scope.

A European subsidiary protects nothing by itself

Creating a European entity is not enough if the US parent keeps effective control of the data: that control is what the law targets. Serious “trusted cloud” arrangements understood this, isolating operations, access and governance, not just the company name.

What to look at instead

Three questions beat a map of datacentres. Which law does the company operating the service answer to? Who has effective access to the data, subcontractors included? And what happens contractually if an access demand arrives? If the answer to the first question is “US law”, the next two cannot fix it.

Where Fransys stands

Fransys deploys your infrastructure with providers incorporated in Europe, Outscale, Scaleway, OVHcloud or Hetzner, in European datacentres. The company operating your machines and the one piloting them answer to the same law you do. That is not a marketing argument; it is a short answer to the question the Cloud Act forces you to ask.

To go further, our sovereign cloud page details sovereignty levels provider by provider, and the free estimate prices what moving your current infrastructure would cost.