Infrastructure & data
Your cloud sits in Frankfurt. US law still applies
Why EU hosting alone does not protect your data from the US CLOUD Act, and what actually helps.
In short, a data centre in Germany does not by itself keep your data safe from US authorities. What matters is who controls the provider and which law they answer to.
The misunderstanding
“Hosted in the EU” sounds like safety, but often it only describes where the disk is. If the provider belongs to a US group, it can be compelled under US law to hand over data even when the servers stand in Frankfurt. The US CLOUD Act requires US companies to do so regardless of the country the data is stored in.
What data ownership really means
Your data is sovereign when the provider is based in and owned within the EU, or when the software runs on infrastructure you control yourself. That the large US providers are now building their own European cloud offerings in Germany shows above all how serious the pressure has become. It does not automatically solve the underlying problem.
Where your data sits does not protect it. What counts is who could be forced to hand it over.
What this means for you
- For sensitive data, choose an EU provider or your own infrastructure instead of the US hyperscaler by reflex.
- Sign contracts that clearly govern data location and access.
- When in doubt, separate the data. Non-critical can go to the cloud, sensitive stays under your own control.
I run client software on European infrastructure, with data centres in Germany. Your data does not leave the EU.
From practice
A funding portal I rebuilt at ISG GmbH, which replaced an older portal from the same programme, has been in production since 2025, with personal data, at more than 700 organisations and over 22,000 processed uploads. It runs within the EU. Data protection and operations were part of the architecture from the start and not bolted on later.
Staying honest
European sovereignty has a cost, and for some compute-heavy AI tasks US models are in my assessment still ahead today. The right answer depends on the case. Not every file needs the highest level of protection. The few that matter belong there.
Sources
- US CLOUD Act, analysis (Morrison Foerster)
- AWS European Sovereign Cloud, launched in Brandenburg (Jan 2026)
- From my own project work at ISG GmbH (since 2025)
This is what I sort out every day.
Which applications, which provider, where the data lives. This is exactly what I work out for small and mid-sized businesses. If that is on your plate, let us talk.