Sovereignty
A European cloud and an American cloud differ first by the company that controls the service, then by the law that applies to that company, and only then by the country of the servers. Two identical server rooms in Frankfurt can fall under two different laws.
People often compare datacenter maps: Paris, Dublin, Frankfurt. It is easy, and it answers a secondary question. To know who can be compelled to produce your data, you have to look at the company that holds it and the law it answers to. The useful comparison sets two legal positions against each other, not two countries, and it does not name a winner: the right choice depends on how the company works. The concept of sovereignty is explained in what is a sovereign cloud, and the purchasing grid in definition, criteria and limits. This page compares.
Microsoft and Google are companies incorporated under American law. Their European contracts, their subsidiaries and their datacenters in the Union do not make this fact disappear. When an American authority approaches them under American law, the question becomes: does the company have possession or control of the data, including when the disks are in Europe?
The CLOUD Act, a 2018 American law, answers for providers subject to United States jurisdiction: a valid order can target data held by the provider, regardless of the storage location. It is not permanent access. It is a procedure. The practical point for the buyer lies elsewhere: the European location of the disk does not remove the American provider from this procedure.
These companies offer genuine data localisation arrangements. Microsoft describes a European data boundary (EU Data Boundary) for eligible services: customer data and pseudonymised personal data stored and processed in the EU or EFTA, professional services data stored at rest, with documented exceptions (remote support access, certain escalations, optional features, Multi-Geo customers outside the scope). Google offers data regions for covered content, depending on the edition, and support access control (Access Management) reserved for specific editions and options. These arrangements reduce data flows. They do not change the software vendor’s nationality.
An American software vendor serving European clients finds itself caught between two laws. American law may require it to produce data it controls. Article 48 of the GDPR provides that a judgment of a court or a decision of an authority of a third country requiring the transfer or disclosure of personal data may only be recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty, in force between that country and the Union or the Member State. The text does not say how a vendor reconciles these two requirements in a given case: it is for the provider to explain its practice, and for the client to ask about it.
American law provides a remedy. Under 18 U.S.C. § 2703(h), the provider can request that an order be quashed or modified, within 14 days of being served, if it considers that the client is not a “United States person” and does not reside in the United States, and that disclosure would expose it to a material risk of violating the law of a “qualifying foreign government”. This means a State bound to the United States by an executive agreement that has entered into force. The US Department of Justice publishes agreements with the United Kingdom (signed on 3 October 2019) and Australia (signed on 15 December 2021). No agreement is in force with the European Union; EU–US negotiations on electronic evidence resumed in 2023; the Department’s page mentions no agreement with France. Yet this specific challenge mechanism presupposes such an agreement.
The question has been raised publicly in France. On 10 June 2025, before the Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee, under oath, that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an order from the American government, without the explicit agreement of the French authorities. He replied: “No, I cannot guarantee it, but, once again, this has never yet happened.” The answer contains both elements of the debate: a guarantee the company cannot give, and a case that, according to the company, has not occurred.
A European cloud, in the useful sense of the term, is operated by a company under European law that does not depend on a group subject to an American obligation to hand over data. OVHcloud is a French company. Nextcloud GmbH is a German company: it publishes software, which the client or a hosting provider operates. BlueMind is a French email company. Infomaniak is a Swiss company: Switzerland is in Europe, outside the European Union, and benefits from an adequacy decision by the Commission. Classifying it as “American” would be wrong. Classifying it as “European Union” would be wrong too.
European law is not a single shield. A French operator answers to French law, a German operator to German law. Requests from authorities do exist. They go through the courts and rules of the operator’s country.
European character can also be lost through processors: a European operator that entrusts backups, filtering or support to an American provider reintroduces exactly what the buyer wanted to avoid. The page protecting a business from the CLOUD Act details this point.
| Question | American software vendor’s cloud, data in Europe | Cloud operated by a European company |
|---|---|---|
| Where are the disks? | Often a matter of choice, in an EU region, with written exceptions | Depending on the contract: France, Germany, another EU country, or on the client’s premises |
| Who can be ordered in the United States to produce the data it controls? | The American software vendor, if it has possession or control | In principle the European operator cannot, unless it depends on a group or processor that can |
| Which court for a local request? | Law of the contract, often supplemented by the vendor’s American law | Law of the operator’s country |
| Advanced office functions | Very broad (Office, Excel, Teams, or Docs and Google search) | Variable depending on the product. Rarely equivalent for advanced Excel, Power BI or the Teams ecosystem |
| Data exit | Real export tools, chat and automation histories often partial | To be checked offering by offering. Email export (IMAP) is generally the simplest |
No column wins on every row: the American software vendor prevails on the breadth of functions, the European operator on the legal position. Deciding means knowing which row weighs most for your company.
Even with data stored in Europe, a service from an American software vendor involves transfers (support access, escalations, optional features), which must rest on a legal basis under the GDPR.
The previous framework, the Privacy Shield (Decision 2016/1250), was invalidated by the Court of Justice of the European Union on 16 July 2020 (Case C-311/18, known as Schrems II), notably because of the extent of American surveillance programmes and the lack of effective redress. Standard contractual clauses remain valid, but require a case-by-case assessment.
As at 5 October 2026, transfers to certified American organisations can rely on adequacy decision (EU) 2023/1795, known as the Data Privacy Framework. It is in force. It is being challenged, as noted by the law firms DAC Beachcroft and WilmerHale. According to the latter, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. A prudent company documents this basis in its record of processing activities and plans what to do if it falls.
It remains relevant when the business relies on advanced Excel, Power BI, Office add-ins, Teams as the industry standard, or dozens of integrations already in production. Changing tools for a legal reason, then losing the use that keeps the company running, is a poor calculation. The page Microsoft 365 versus a sovereign solution details this threshold.
It also remains relevant when the legal analysis of the transfer, the DPA and the data residency options meet the real needs of the record of processing activities. Many European companies use Microsoft 365 or Google Workspace within this framework. Saying so is part of an honest comparison. The checks to carry out are described in GDPR and Microsoft 365 and GDPR and Google Workspace.
It becomes relevant when management wants the company holding the emails and files to be a European company, wants support to be reachable within this framework, and when uses fit within email, files and their online editing, video conferencing, a CRM and telephony. It also becomes relevant for a deployment on the client’s premises, when the company does not want any cloud at all.
The two options are not mutually exclusive. A company can keep an American suite for the roles that depend on it and entrust the rest to a European operator. This set-up requires more administration; it is justified when the separation of uses is clear-cut.
The guide European alternatives to Microsoft 365 reviews Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players, and Klytic, with the use case for each.
Hypothetical case. An industrial SME has two sites. The design office works in advanced Excel and communicates with its principal clients on Teams. The workshop, purchasing and administration mainly use email and shared folders, which contain technical drawings.
A principal client asks that its drawings be held by a European company. For the design office, leaving advanced Excel and Teams would disrupt work with clients: the American suite remains justified, with a documented transfer analysis. For the drawings and the email of the other departments, a European operator meets the request without any loss of use. The decision follows the rows of the table, not a principle.
No. The CLOUD Act targets data that a provider subject to American law holds or controls, regardless of the storage location. The European region reduces transfers. It does not change the company that holds the data.
Yes, if it depends on a group subject to that law or if it entrusts data to a processor that is. That is why you need to check the parent company and the list of processors, not just the operator’s name.
It provides a basis under the GDPR for transfers to certified American organisations. It is in force and being challenged. It changes neither the software vendor’s nationality nor the scope of the order provided for by American law.
Klytic falls into the second column of the table. It is operated by Dedicace Software, a French company. Hosting is possible in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the client’s servers.
Email is based on Zimbra, published by Synacor in the United States and operated by Klytic. Documents are based on a dedicated Nextcloud instance per client. Klytic is not SecNumCloud-qualified and does not replace advanced Excel, Power BI or Teams. The services are purchased separately: a company can keep Microsoft 365 and add only Klytic MTA filtering, placed in front of its email. Hosting details are on the page hosting and sovereignty.
This page describes a general framework. It does not replace an analysis of your contract.
Legal status as of 5 October 2026. This text does not replace a contract review. The EU–US adequacy decision (EU) 2023/1795 is in force. It is being challenged. The ANSSI catalogue is authoritative for SecNumCloud.
Accessed in October 2026.
Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.
Welcome offer
No-commitment trial. An advisor calls you back to understand your needs and prepare your Klytic workspace.
