Data sovereignty
CLOUD Act and sovereignty: what it changes when you pick a host
The US CLOUD Act lets American authorities compel data held by a provider subject to US law, even when stored in Europe. For a public body or a security team, the real question is not "where is my data" but "who, in law, can access it". Here is a factual read, and Bunker's posture: hosted in Europe by a European company, with subprocessors listed in the contract (GDPR art. 28).
Updated on October 2, 2026
The sovereignty of a hosting setup is not decided by the address of the data centre. It is decided by the law the provider and its subprocessors answer to. The US CLOUD Act is the clearest illustration of that gap: data can sit in Europe and still be reachable, in law, by a foreign authority. This page explains the text, clears up the common confusions, and shows how to verify a provider's real sovereignty before you buy, chain of subprocessors in hand.
What is the CLOUD Act?
The CLOUD Act, short for Clarifying Lawful Overseas Use of Data Act, is a US federal law passed in 2018. It states that United States authorities can, by warrant or court order, compel a service provider subject to US law to hand over the data it controls, regardless of the country where that data is physically stored.
The decisive point comes down to one word: control. The obligation is not triggered by where the servers sit, but by the legal attachment of the provider. A US provider hosting data in a Paris data centre still has to answer a request made under the CLOUD Act.
Is a European host caught by the CLOUD Act?
It depends on its attachment to US law. The law targets providers with a link to the United States: a US company, a subsidiary of a US group, or an entity controlled from the United States. An independent European company, with no US parent or subsidiary, falls outside that scope.
The nuance is decisive for public procurement. A "region Europe" cloud operated by the European subsidiary of a US group can stay exposed, because control runs back to the US entity. Conversely, a provider governed by European law whose subprocessors are all governed by European law has no such attachment. The right question to a provider is therefore not "where" the data sits, but "who controls you, and who are your subprocessors".
FISA 702, the other text to know
Alongside the CLOUD Act, section 702 of the Foreign Intelligence Surveillance Act (FISA) frames the collection of intelligence on non-US persons, from electronic communication providers subject to US law. It is one of the grounds on which the Court of Justice of the European Union struck down the Privacy Shield in 2020 (the Schrems II ruling).
The exposure mechanism is the same as the CLOUD Act: it hinges on the legal attachment of the provider, not on the data centre address. Choosing a provider with no attachment to the United States answers both texts in a single move.
Location does not mean sovereignty
Many providers highlight hosting "in Europe". That is necessary for the GDPR, but not sufficient for sovereignty. Data can sit in Paris and still be reachable, in law, by a foreign authority if the provider or one of its subprocessors is governed by a non-European jurisdiction. US office suites are exactly that case, even when hosted in Europe: we detail it in our analysis of the CLOUD Act and Microsoft 365.
Sovereignty plays out on three planes: where the data is stored, who operates the infrastructure, and which law that operator answers to. All three must point to Europe for the location to carry real legal meaning.
Bunker's posture, subprocessor by subprocessor
Bunker is a European company that hosts its managed services in Europe. To verify sovereignty, the right level of analysis is the chain of subprocessors, the one the GDPR requires to be listed in the contract (art. 28). Here is ours, for the managed services:
- Database: CloudNativePG (PostgreSQL), replicated, on the Bunker cluster.
- Authentication: self-hosted OpenID Connect SSO with FerrisKey; the local account is only a break-glass access.
- Outbound email: SMTP relay operated by IONOS, a German company, inside the European Union.
- Backups: MinIO (S3) object storage, internal to Bunker.
None of these subprocessors is under US jurisdiction. The wording we stand by is simple and verifiable: hosted in Europe by a European company, subprocessors listed in the contract (GDPR art. 28). The full chain is public on our subprocessors page.
How to verify a host before you buy
For a security due diligence, five questions are enough to rule out most of the extraterritoriality risk:
- What is the company's legal nationality, and does it have a parent outside the European Union?
- Is the subprocessor list published, and is each one governed by European law?
- Where are the data, the backups and the logs stored?
- Do authentication and email relay run through a service governed by a non-European jurisdiction?
- Can you recover your data and redeploy elsewhere without a rewrite?
Bunker answers all five in writing. To go further, our trust center details the security posture, and our sovereign alternatives replace US SaaS tools service by service.
Frequently asked questions
What is the CLOUD Act?
The CLOUD Act (Clarifying Lawful Overseas Use of Data Act, 2018) is a US federal law that lets United States authorities compel a provider subject to US law to hand over the data it controls, wherever it is stored, including on servers in Europe. It is the provider's legal attachment that triggers the obligation, not where the servers sit.
Does the CLOUD Act apply to a European host?
It depends on its attachment to US law. The law targets US companies, subsidiaries of a US group, and entities controlled from the United States. An independent European company, with no US parent or subsidiary and whose subprocessors are all governed by European law, has no such attachment. A "region Europe" cloud operated by the subsidiary of a US group, however, can stay exposed.
Is hosting data in Europe enough to be shielded from the CLOUD Act?
No. Hosting data in Europe is necessary for the GDPR, but it is not enough. If the provider or one of its subprocessors is governed by US law, data stored in Europe can still be reachable, in law, by a foreign authority. Sovereignty is verified on the legal nationality of the provider and its whole subprocessor chain, not just the data centre address.
What is the difference between the CLOUD Act and the GDPR?
The two texts pull in opposite directions. The GDPR, European, protects personal data and tightly frames transfers outside the Union. The CLOUD Act, American, organises instead the disclosure of data to United States authorities. A provider subject to both can face a US order that conflicts with its GDPR obligations. Choosing a provider with no attachment to US law removes that conflict.
What is FISA section 702?
Section 702 of the Foreign Intelligence Surveillance Act frames US intelligence collection on non-US persons, from electronic communication providers subject to US law. With the CLOUD Act, it is one of the grounds for the Court of Justice of the European Union striking down the Privacy Shield in 2020 (Schrems II). Here too, exposure hinges on the provider's legal attachment, not the storage location.
Does Bunker have US subprocessors?
No. For the managed services, the database is CloudNativePG (PostgreSQL) on the Bunker cluster, authentication runs through self-hosted FerrisKey, the email relay is operated by IONOS (a German company, inside the European Union) and backups are stored on internal MinIO. None of these subprocessors is under US jurisdiction. The chain is published on our subprocessors page.
How do you prove a host's sovereignty for public procurement?
Ask for three verifiable items: the legal nationality of the company and of any parent, the list of subprocessors listed in the contract (GDPR art. 28) with the law each answers to, and the location of the data, backups and logs. Add reversibility, meaning the ability to recover your data and redeploy elsewhere without a rewrite. These items, in writing, are worth more than a marketing claim of sovereignty.
Go further
Sovereignty you can verify, not just promise
Hosted in Europe by a European company, subprocessors listed in the contract (GDPR art. 28). Let's talk through your case and your compliance constraints.