The due diligence questionnaire asks: "Is your data subject to the Cloud Act?" Sales answers "Our datacenters are in Europe." Wrong problem, wrong answer. The US Cloud Act can compel an American provider to produce data outside US territory if under its control.
The right contractual question: which entity signs, who controls the group, and what does the contract promise if a US authority comes knocking?
Cloud Act in one operational sentence
US law allowing authorities to request certain US cloud providers — or those under US jurisdiction — to access data they hold, regardless of physical storage location. Direct consequence: a "France region" pin on the map does not mean absence of jurisdictional risk.
Vague answers versus usable clauses
| Marketing answer | What to require |
|---|---|
| "France datacenter" | Contracting entity plus registered office country |
| "GDPR compliant" | DPA plus transfer mechanism plus TIA |
| "Trusted partner" | Subcontractor list plus nationality |
| "Encryption" | Who holds keys — client or provider |
Useful clauses when negotiable: client notification before disclosure unless legal prohibition; right to challenge request within US law limits; commitment to deliver legally required minimum; encryption with client-held keys for most sensitive data.
EU-only, SecNumCloud, Swiss host
A European actor without US parent reduces Cloud Act risk — watch subcontractors. SecNumCloud offers reinforced sovereignty framework for qualified scopes; see SecNumCloud criteria. Switzerland is outside EU but not automatically outside US reach if the group is controlled from the United States.
The peak: jurisdiction is read in the contract
Decide and move forward without blind spots
Identify signing entity and group structure — register, annual report — request provider government request transparency report, cross-read Schrems II and hosting and your transfer assessment, then consider SecNumCloud if public sector or sensitive health. See guides and directory to compare European actors without documented US control.
Frequently asked questions
Cloud Act if datacenter in France?
Yes if US contractual entity or controlled from the United States — storage location is not enough.
What to ask sales?
Legal entity, parent company, government request policy, client notification, encryption keys.
Does SecNumCloud avoid Cloud Act?
Reinforced sovereignty scope — not automatic for all; verify attestation and product.
Swiss or pure European host?
Better without US control — verify subcontractors, CDN, and support.
"Where are the servers?" is the wrong question. The right one: who signs the contract and what do they do when Washington calls?