{"id":3813,"date":"2026-10-05T20:21:18","date_gmt":"2026-10-05T18:21:18","guid":{"rendered":"https:\/\/www.klytic.com\/?page_id=3813"},"modified":"2026-10-06T10:38:06","modified_gmt":"2026-10-06T08:38:06","slug":"european-vs-american-cloud","status":"publish","type":"page","link":"https:\/\/www.klytic.com\/en\/european-vs-american-cloud\/","title":{"rendered":"European cloud or American cloud: what is the real difference?"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Home<\/a>\u203a<\/span>Guides<\/a>\u203a<\/span>Sovereignty<\/a><\/p>

Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

European cloud or American cloud<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

A European cloud and an American cloud differ first by the company that controls the service, then by the law that applies to that company, and only then by the country of the servers. Two identical server rooms in Frankfurt can fall under two different laws.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Updated October 2026<\/b><\/span>10 min<\/b> read<\/span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Why the comparison is often framed wrongly<\/h2>

People often compare datacenter maps: Paris, Dublin, Frankfurt. It is easy, and it answers a secondary question. To know who can be compelled to produce your data, you have to look at the company that holds it and the law it answers to. The useful comparison sets two legal positions against each other, not two countries, and it does not name a winner: the right choice depends on how the company works. The concept of sovereignty is explained in what is a sovereign cloud<\/a>, and the purchasing grid in definition, criteria and limits<\/a>. This page compares.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What \u201cAmerican\u201d means here<\/h2>

Microsoft and Google are companies incorporated under American law. Their European contracts, their subsidiaries and their datacenters in the Union do not make this fact disappear. When an American authority approaches them under American law, the question becomes: does the company have possession or control of the data, including when the disks are in Europe?<\/p>

The CLOUD Act, a 2018 American law, answers for providers subject to United States jurisdiction: a valid order can target data held by the provider, regardless of the storage location. It is not permanent access. It is a procedure. The practical point for the buyer lies elsewhere: the European location of the disk does not remove the American provider from this procedure.<\/p>

These companies offer genuine data localisation arrangements. Microsoft describes a European data boundary (EU Data Boundary) for eligible services: customer data and pseudonymised personal data stored and processed in the EU or EFTA, professional services data stored at rest, with documented exceptions (remote support access, certain escalations, optional features, Multi-Geo customers outside the scope). Google offers data regions for covered content, depending on the edition, and support access control (Access Management) reserved for specific editions and options. These arrangements reduce data flows. They do not change the software vendor\u2019s nationality.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The conflict of laws facing an American software vendor in Europe<\/h2>

An American software vendor serving European clients finds itself caught between two laws. American law may require it to produce data it controls. Article 48 of the GDPR provides that a judgment of a court or a decision of an authority of a third country requiring the transfer or disclosure of personal data may only be recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty, in force between that country and the Union or the Member State. The text does not say how a vendor reconciles these two requirements in a given case: it is for the provider to explain its practice, and for the client to ask about it.<\/p>

American law provides a remedy. Under 18 U.S.C. \u00a7 2703(h), the provider can request that an order be quashed or modified, within 14 days of being served, if it considers that the client is not a \u201cUnited States person\u201d and does not reside in the United States, and that disclosure would expose it to a material risk of violating the law of a \u201cqualifying foreign government\u201d. This means a State bound to the United States by an executive agreement that has entered into force. The US Department of Justice publishes agreements with the United Kingdom (signed on 3 October 2019) and Australia (signed on 15 December 2021). No agreement is in force with the European Union; EU\u2013US negotiations on electronic evidence resumed in 2023; the Department\u2019s page mentions no agreement with France. Yet this specific challenge mechanism presupposes such an agreement.<\/p>

The question has been raised publicly in France. On 10 June 2025, before the Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee, under oath, that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an order from the American government, without the explicit agreement of the French authorities. He replied: \u201cNo, I cannot guarantee it, but, once again, this has never yet happened.\u201d The answer contains both elements of the debate: a guarantee the company cannot give, and a case that, according to the company, has not occurred.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

What \u201cEuropean\u201d means here<\/h2>

A European cloud, in the useful sense of the term, is operated by a company under European law that does not depend on a group subject to an American obligation to hand over data. OVHcloud is a French company. Nextcloud GmbH is a German company: it publishes software, which the client or a hosting provider operates. BlueMind is a French email company. Infomaniak is a Swiss company: Switzerland is in Europe, outside the European Union, and benefits from an adequacy decision by the Commission. Classifying it as \u201cAmerican\u201d would be wrong. Classifying it as \u201cEuropean Union\u201d would be wrong too.<\/p>

European law is not a single shield. A French operator answers to French law, a German operator to German law. Requests from authorities do exist. They go through the courts and rules of the operator\u2019s country.<\/p>

European character can also be lost through processors: a European operator that entrusts backups, filtering or support to an American provider reintroduces exactly what the buyer wanted to avoid. The page protecting a business from the CLOUD Act<\/a> details this point.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The table that helps decide<\/h2>
Question<\/th>American software vendor\u2019s cloud, data in Europe<\/th>Cloud operated by a European company<\/th><\/tr><\/thead>
Where are the disks?<\/td>Often a matter of choice, in an EU region, with written exceptions<\/td>Depending on the contract: France, Germany, another EU country, or on the client\u2019s premises<\/td><\/tr>
Who can be ordered in the United States to produce the data it controls?<\/td>The American software vendor, if it has possession or control<\/td>In principle the European operator cannot, unless it depends on a group or processor that can<\/td><\/tr>
Which court for a local request?<\/td>Law of the contract, often supplemented by the vendor\u2019s American law<\/td>Law of the operator\u2019s country<\/td><\/tr>
Advanced office functions<\/td>Very broad (Office, Excel, Teams, or Docs and Google search)<\/td>Variable depending on the product. Rarely equivalent for advanced Excel, Power BI or the Teams ecosystem<\/td><\/tr>
Data exit<\/td>Real export tools, chat and automation histories often partial<\/td>To be checked offering by offering. Email export (IMAP) is generally the simplest<\/td><\/tr><\/tbody><\/table><\/div>

No column wins on every row: the American software vendor prevails on the breadth of functions, the European operator on the legal position. Deciding means knowing which row weighs most for your company.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The legal basis for transfers to the United States<\/h2>

Even with data stored in Europe, a service from an American software vendor involves transfers (support access, escalations, optional features), which must rest on a legal basis under the GDPR.<\/p>

The previous framework, the Privacy Shield (Decision 2016\/1250), was invalidated by the Court of Justice of the European Union on 16 July 2020 (Case C-311\/18, known as Schrems II), notably because of the extent of American surveillance programmes and the lack of effective redress. Standard contractual clauses remain valid, but require a case-by-case assessment.<\/p>

As at 5 October 2026, transfers to certified American organisations can rely on adequacy decision (EU) 2023\/1795, known as the Data Privacy Framework. It is in force. It is being challenged, as noted by the law firms DAC Beachcroft and WilmerHale. According to the latter, the General Court of the European Union dismissed an action for annulment on 3 September 2025, and an appeal was lodged before the Court of Justice on 31 October 2025. A prudent company documents this basis in its record of processing activities and plans what to do if it falls.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When the American cloud remains the right tool<\/h2>

It remains relevant when the business relies on advanced Excel, Power BI, Office add-ins, Teams as the industry standard, or dozens of integrations already in production. Changing tools for a legal reason, then losing the use that keeps the company running, is a poor calculation. The page Microsoft 365 versus a sovereign solution<\/a> details this threshold.<\/p>

It also remains relevant when the legal analysis of the transfer, the DPA and the data residency options meet the real needs of the record of processing activities. Many European companies use Microsoft 365 or Google Workspace within this framework. Saying so is part of an honest comparison. The checks to carry out are described in GDPR and Microsoft 365<\/a> and GDPR and Google Workspace<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

When a European operator becomes relevant<\/h2>

It becomes relevant when management wants the company holding the emails and files to be a European company, wants support to be reachable within this framework, and when uses fit within email, files and their online editing, video conferencing, a CRM and telephony. It also becomes relevant for a deployment on the client\u2019s premises, when the company does not want any cloud at all.<\/p>

The two options are not mutually exclusive. A company can keep an American suite for the roles that depend on it and entrust the rest to a European operator. This set-up requires more administration; it is justified when the separation of uses is clear-cut.<\/p>

The guide European alternatives to Microsoft 365<\/a> reviews Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players, and Klytic, with the use case for each.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Example: an industrial SME with two sites<\/h2>

Hypothetical case. An industrial SME has two sites. The design office works in advanced Excel and communicates with its principal clients on Teams. The workshop, purchasing and administration mainly use email and shared folders, which contain technical drawings.<\/p>

A principal client asks that its drawings be held by a European company. For the design office, leaving advanced Excel and Teams would disrupt work with clients: the American suite remains justified, with a documented transfer analysis. For the drawings and the email of the other departments, a European operator meets the request without any loss of use. The decision follows the rows of the table, not a principle.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Common mistakes<\/h2>