Eurobase
Sovereignty · · 4 min read
EU region vs EU company: what the CLOUD Act means for hosting in 2026
How the CLOUD Act works and what to ask a hosting provider.
An EU region decides where your data sits. The company that runs the service decides which laws can reach it. Under the US CLOUD Act, a provider subject to US jurisdiction can be ordered to produce data in its possession, custody or control, whether the data is stored inside or outside the United States. An EU region doesn't change that. An EU company with no US parent and no US presence is less directly exposed, but its US suppliers can be reached for what they hold.
This article isn't legal advice.
The three layers
| Layer | The question | Where to find the answer |
|---|---|---|
| Location | Where does the data sit and where does the code run? | Region settings and docs |
| Company | Who is the legal provider, and who owns it? | Terms of service |
| Suppliers | Who processes data on the provider's behalf? | The subprocessor list |
A provider can pass one layer and fail another. A US platform with a Frankfurt region passes the first and not the second. A European platform on a US cloud passes the second and not the third.
What the CLOUD Act says
The law is at 18 U.S.C. § 2713. It requires covered providers to meet their duties under the Stored Communications Act to preserve, back up or disclose data in their possession, custody or control, regardless of where it is located. The US Department of Justice describes the act in its CLOUD Act resources.
What it doesn't mean
- It doesn't mean US hosting is illegal under GDPR. Since 10 July 2023, an EU adequacy decision lets personal data flow to US companies that participate in the Data Privacy Framework.
- It doesn't mean an EU company is out of reach of every authority. EU providers answer to EU and national law.
- It doesn't settle your contract. A customer or regulator may ask for more than the law requires.
When the difference matters
- A customer contract or tender requires a European provider.
- You work in the public sector, health or finance, where a regulator has its own rules.
- You want to reduce your dependency on a single foreign jurisdiction.
If none of these apply, a European region of a global provider may be enough for you.
What to ask a hosting provider
- What is the exact legal entity on the contract, and where is it registered?
- Does a company outside the EU own or control it?
- Who are the subprocessors, and which of them are outside the EU?
- Do logs, backups, support and telemetry stay in Europe too, or only the application?
- What happens when you receive a government request? Do you notify the customer?
- Which certifications do you hold, and can I see them?
Where some providers stand
| Provider | Legal home | A European region | Note |
|---|---|---|---|
| Vercel | California law | Yes | US company |
| Railway | Delaware law | Amsterdam | US company |
| Render | California law | Frankfurt | US company |
| Heroku | Part of Salesforce | Yes | US parent |
| Clever Cloud | France | Own datacenters in France | ISO/IEC 27001:2022 |
| Scalingo | Strasbourg, France | Yes | SecNumCloud region available |
| Eurobase | Warsaw, Poland | European infrastructure | Runs on Scaleway, a French provider |
EurobaseEurobase's own answer: the hosting provider is Scaleway, a French provider. GitHub and GitLab Inc. are US subprocessors when you connect them, and Stripe handles billing. Codeberg, a German association, is a European option for your code. Eurobase doesn't hold ISO 27001 or SOC 2 yet. Both are in progress.
Frequently asked questions
Does hosting in Frankfurt protect me from the CLOUD Act?
Not if your provider is subject to US jurisdiction, because the act looks at who controls the data and not at where it is stored.
Is an EU company immune to the CLOUD Act?
An EU company with no US presence is less directly exposed, but no company can promise immunity. A US supplier in its chain can still be reached for what that supplier holds.
Is using a US cloud provider a GDPR violation?
Not by itself. Transfers to US companies in the Data Privacy Framework are covered by an adequacy decision. You still need a lawful basis and a data processing agreement.
What is the difference between data residency and data sovereignty?
Residency is where the data is stored. Sovereignty is about whose laws and whose control the data is under.
Sources
Keep reading
Best cloud MCP servers for deploying apps in 2026Which hosting platforms let Claude Code, Cursor and Codex deploy your app through MCP: Eurobase, Vercel, Railway, Render, Netlify, Heroku and Cloudflare compared.Agents4 min read
Where to host an Astro site with server rendering in Europe in 2026Six European hosts for Astro compared: which ones run server-rendered pages and endpoints, which ones serve only static files, and what each costs.Frameworks8 min read
