CLOUD Act: nationality matters more than region

The text of the CLOUD Act does not at any time mention the physical location of a server. 18 U.S.C. § 2713 requires any electronic service provider to produce data that it has “in its possession, custody or control,” whether stored in the United States or abroad. It is this formulation, and not an accommodation card, which defines the real scope of the law.

This case originated in a dispute between Microsoft and the American government, already detailed in our article on choosing a BaaS. Congress decided by law rather than waiting for a decision from the Supreme Court. The practical result remains the same today: the nationality of the entity which controls the data matters more than the country where this data is physically hosted.

A direct consequence follows from this formulation. A provider can be a company incorporated under American law and remain subject to the CLOUD Act even if it rents servers from a European host to serve its EU customers. The hosting contract does not change the nationality of the company signing your service contract, nor its legal obligation to the US federal authorities.

The CLOUD Act is not the only lever of this type either. Section 702 of the Foreign Intelligence Surveillance Act (FISA) authorizes targeted surveillance of electronic communications by U.S. intelligence services. Its regime remains distinct, oriented towards national security rather than ordinary judicial procedure. The two texts share a common point that is useful to remember. It is the legal qualification of the supplier, an American company or subject to American jurisdiction, which triggers the obligation, not the geography of its infrastructure.

An American parent company that has a European subsidiary does not automatically fall outside the scope of the CLOUD Act just because the subsidiary is registered in the EU. The legal test concerns who in the chain actually has possession, custody or control of the data, not the name registered in the local commercial register.

Let's take a concrete case. An American holding company owns 100% of a German subsidiary which hosts and technically operates the service for its European customers. If the US parent company teams have administrator access to the production database, even for technical support purposes, this access may be sufficient. It can characterize control within the meaning of the law, and the nationality of the local subsidiary does not neutralize it.

In practice, most technology groups centralize their infrastructure: administrator access, backups, internal authentication systems. Checking the registration of an entity alone therefore only answers part of the question. We must go back the complete chain: who owns the capital of this subsidiary, who controls its board of directors, who retains real technical access to the data once the contract is signed.

This is the same logic as the verification of the ultimate beneficial owner, applied in anti-money laundering compliance. Transposed to the choice of a backend provider, it changes the question asked. It is not the name of the trademark or billing entity that matters, but the entity that has final control over the data.

Two independent axes determine the real exposure of a backend to the CLOUD Act: where the data is hosted, and which company, with what nationality, controls this service. Crossing these two axes gives a matrix with four boxes, more useful than an “EU region” box checked alone in a comparison. We detail why an EU region alone remains insufficient in our dedicated article, EU region and compliance, what a checked box does not guarantee.

A BaaS comparison that only fills one column of this matrix, most often that of the server region, leaves half of the legal risk out of scope. This is the blind spot covered in detail in our complete guide GDPR compliant and EU sovereign backend. We explore it specifically for American hyperscalers in our analysis dedicated to hyperscalers in the EU region.

A supplier can move from one box to another in this matrix overnight, without any infrastructure changing. A takeover by an American company is enough to change the effective nationality of a company, even if its servers remain physically in the same location. A capital takeover during a financing round, or a restructuring of a holding company, produces the same effect.

This risk is not limited to a total redemption. A financing round that gives American investors a majority on the board of directors produces the same effect. A technology licensing agreement that transfers operational control to an American entity results in the same situation, without going through a traditional acquisition. The legal structure visible at the time of signing the contract is not a guarantee fixed in time.

The lag between a change of control and its detection on the client side compounds this risk. A change of shareholder is not always publicly announced when it occurs, especially for an unlisted company. By the time a contractual notification clause was triggered, several months of data processing could have passed under the new structure without the client being informed.

The decision grid in our article on choosing a BaaS already suggests requiring a right of termination without penalty in the event of a change in shareholder structure. This clause deserves to be clarified. It must cover any change of capital control, not just a change of company name. It must also provide for a contractual notification period, not a simple mention in small print in an update of general conditions.

Our article on choosing a BaaS already details how to read a provider's privacy policy and applicable law clause. This method remains the first step; it alone is not enough to trace a chain of ownership which may include several holding companies.

1. Consult the commercial register of the country of registration: Infogreffe in France, Handelsregister in Germany, Companies House in the United Kingdom, SEC EDGAR for a listed American company or financed by venture capital. Objective: identify the declared ultimate parent company.
2. Look for a mention of the group structure, or a commitment to notification in the event of a change of control, in a SOC 2 Type II report or an ISO 27001 statement of applicability. This document does not always exist, but is worth requesting when the supplier publishes one.
3. Check the composition of the most recent financing round via public announcements: a majority of American investors in the capital is a signal to question, even for a company registered in the EU.
4. Explicitly request, in the negotiation of the DPA, a written commitment to notify in the event of a change of capital control.
5. If the supplier already communicates about its capital independence, ask for written and dated confirmation. An oral declaration in a commercial demo does not have the same value as a contractual commitment.

None of these checks replace legal advice for a high-stakes project. However, they are enough to identify, in one hour, a supplier whose ownership structure merits a direct question before signing.