Module 2 · 2.1

English

Nederlands English Deutsch Français Español

Five questions that determine how European a service really is

Module 2: What is a European cloud, really? · Reading time: 11 minutes

Learning objective: After this lesson you can use five questions to establish which law a cloud service falls under, and explain why a datacentre in Europe is not enough on its own.

Key concepts: establishment (registered office), ultimate owner, datacentre location, sub-processor, remote access, key management, EU, EEA, adequacy decision, "sovereign cloud"

"Our data is stored in Europe." And then?

Almost every large cloud service says it nowadays: your data is stored in a datacentre in Frankfurt, Amsterdam or Dublin. That sounds reassuring, but it only answers one of the questions that matter. In module 1 you saw that the American CLOUD Act does not look at where the server is, but at the company that has the data in its possession, custody, or control. A server in Frankfurt belonging to a company that is ultimately American can therefore still fall under an American order.

That is why you look not at one characteristic, but at five. Bakkerij De Korrel from our example (12 employees, domain example.com) currently uses an American office suite and wants to know which alternatives are genuinely European. With these five questions, she can separate the marketing from the facts.

Question 1: where is the company established?

The establishment is the country where the company that signs your contract is legally registered: its registered office. That country determines, first of all, which law applies to the company, which court has jurisdiction and which authority supervises it.

Don't look at the website for this, look at the contracting party: the name at the bottom of the terms and conditions, the data processing agreement and the invoice. If it says "Example Cloud Ireland Ltd.", then your contracting party is Irish, even if the brand is American. That is a good start, but not yet an answer. For that you need question 2.

Question 2: who is the ultimate owner?

The ultimate owner is the company or person at the top of the chain of shareholders. A European subsidiary of an American parent company is legally a European company, but the parent company has control. Under the CLOUD Act, an American court can order the parent company to hand over data held by a subsidiary, if the parent company actually has "control" over it. Whether that applies in a specific case depends on how the company is structured. Lawyers disagree on this. That is exactly why it is a risk rather than a certainty.

The reverse can also happen: a company that is European today can be taken over tomorrow. In the Netherlands, this played out in 2025 and 2026 around Solvinity, the company behind the infrastructure for DigiD. The American company Kyndryl wanted to acquire it; the Dutch government blocked the takeover in May 2026 following advice from the Bureau Toetsing Investeringen (the Dutch investment screening office). So also ask a provider: what happens to my contract in the event of a takeover? Can I cancel free of charge in that case?

Where do you find the owner? In the trade register (in the Netherlands the KVK, in Germany the Handelsregister), in the annual report, or on an "About us" or "Impressum" page. For listed companies, it's in the annual accounts.

Question 3: where is the data stored, including backups?

The datacentre location still matters. If your data is stored in the EU, there is no transfer outside the EEA within the meaning of the GDPR, as long as no one outside can access it. Ask about all locations: the primary datacentre, the failover datacentre and the backups. A provider with servers in the Netherlands and backups in the United States does in fact have a transfer.

Watch out for three terms that are often confused:

Term	What it means
EU	The 27 member states of the European Union.
EEA	The European Economic Area: the EU plus Norway, Iceland and Liechtenstein. The GDPR applies throughout the EEA. A transfer within the EEA is not a transfer to a "third country".
Adequate country	A country outside the EEA for which the European Commission has determined, in an adequacy decision, that it offers an appropriate level of protection. Data may be sent there without extra safeguards. Examples: Switzerland and the United Kingdom.

Switzerland and the UK are therefore not part of the EU, but under the GDPR you may still use a service there without extra contractual clauses. The decision for Switzerland dates from 2000 and was confirmed in a review in January 2024. The decision for the UK was extended on 19 December 2025 until 27 December 2031. An adequacy decision can, however, be revised or struck down by the Court of Justice of the European Union: that happened twice with the arrangements for the US (module 1, lesson 1.4). For the United States, the Data Privacy Framework now applies, but only for American companies that have signed up to it, and with the uncertainty you saw in lesson 1.4.

Question 4: who else can get in? Sub-processors and remote access

A sub-processor is another company that the provider engages and that processes or can see your data as a result: the datacentre, a backup service, a company handling email delivery, a support department in another country, an AI service that summarises emails. The GDPR requires the provider to tell you in advance which sub-processors it uses and to let you object to new ones (Article 28 GDPR, lesson 9.2).

Pay particular attention to remote access. Data stored in Amsterdam but which a support employee in a country outside the EEA can view to fix a fault also counts as a transfer, according to the European supervisory authorities. A datacentre in Europe with a helpdesk that watches over it around the clock from anywhere in the world is therefore less European than it appears.

Where do you find the list? Usually as an appendix to the data processing agreement, or on a separate "sub-processors" page. If that list is missing, or is vague ("we work with carefully selected partners"), that's a red flag.

Question 5: who holds the key?

Encryption only protects you against others if they don't have the key. With most cloud services, your data is encrypted in transit (https) and at rest (on disk), but the provider holds the key. If the provider is required to hand over data, it can decrypt it. With end-to-end encryption, or encryption with a key that only you manage, the provider cannot do this. That offers better protection, but comes at a price: search, collaborative editing in the browser and recovery of a forgotten password often work poorly or not at all. So ask: which parts are end-to-end encrypted, and what will I no longer be able to do as a result?

"Sovereign cloud" from American companies

The large American providers are responding to the demand for sovereignty. A few examples, so you recognise the terms:

Microsoft EU Data Boundary: in February 2025, Microsoft announced that customer data from Microsoft 365, Dynamics 365, Power Platform and most Azure services is stored and processed within the EU and EFTA countries, including support data. Microsoft itself states that in limited cases data is still processed outside the EU, for example for security purposes. Microsoft remains an American company. In June 2025, the legal director of Microsoft France stated under oath before the French Senate that he could not guarantee that data would never be handed over to American authorities without authorisation.
AWS European Sovereign Cloud: generally available since 15 January 2026, with a first region in Brandenburg (Germany). It is managed by a German entity with staff in the EU and is technically separated from the rest of AWS. The ultimate parent company is Amazon. Analysts point out that this may reduce the CLOUD Act risk, but it is not demonstrably eliminated.
Partnership models: in France and Germany there are European companies that run American cloud technology under licence, so that the European company retains control. Whether this works depends on the arrangements for updates, management and access.

Such services can be a reasonable intermediate step for some organisations. But put them through the same five questions. The answer to question 2 (owner) remains different for these services than for a company that is fully European.

In practice: what this looks like with a provider

Take a WebOké Nextcloud as an example. Establishment and owner: a Dutch private limited company (bv). Datacentre: according to the manual, two Dutch datacentres operated by NorthC. Software: Nextcloud, made by the German company Nextcloud GmbH, open source. The key for storage encryption is held by the provider; you can switch on end-to-end encryption yourself per folder. With other European providers, such as other Nextcloud providers, mailbox.org, Infomaniak or IONOS, you look for the same five answers in the same places: the contract, the trade register, the data processing agreement and the sub-processor list.

Summary

A datacentre in Europe only answers one of the five questions.
The five questions: establishment, ultimate owner, location of data and backups, sub-processors and remote access, and who holds the key.
A European subsidiary of an American company may still fall under the CLOUD Act.
Switzerland and the UK are not part of the EU, but have an adequacy decision; the EEA is the EU plus Norway, Iceland and Liechtenstein.
"Sovereign cloud" services from American companies reduce risks, but do not change the answer to the ownership question.

Quiz

Exercise

Exercise A2.1: Who receives and sends mail for your domain? Enter your own domain. The program looks up the MX records and expands your SPF record in full. You then fill in which organisations receive your mail and which are allowed to send mail on your behalf. In a few minutes you can see which parties are already involved in your mail.

Exercise E2.1: The five questions for your own services. Choose two services you currently use (for example your mail and your file storage) and one possible European replacement. Find the answers to the five questions for all three, together with the source.

Exercise E2.1: The five questions for your own services

Choose two services you currently use and one possible European alternative.

Service 1: contracting party and location, ultimate owner, where data and back-ups are stored, sub-processors, who holds the key (with a source for each answer).

Service 2: the same five questions, with sources.

Possible European alternative: the same five questions, with sources.

Which of the five questions was hardest to answer, and what does that tell you about the service? (at least 2 sentences)

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing