Where your data lives, and who can reach it
Choosing a region decides where your data is stored. Who runs the service decides whose law can reach it. Three questions to ask about any system, what the US CLOUD Act says, and how to choose.
Data7 min readSoventia Ltd
Every system a company uses stores data somewhere, and most companies never chose where. The default was whatever the vendor offered at sign-up. Often that is fine. But "where is our data?" hides three separate questions, and they can have three different answers: where it is stored, whose law can reach it, and who can read it.
Three questions to ask about any system
- Where is it stored? The region or country of the data centre. It matters for speed, for data protection rules and for what your customers and contracts expect.
- Whose law can reach it? That depends on the company running the service and where it is incorporated, not on where the building is.
- Who can read it? Whoever holds the encryption keys. Usually the provider, unless you have arranged otherwise.
Most of the confusion comes from treating the first answer as if it settled the other two.
What the CLOUD Act says
The Clarifying Lawful Overseas Use of Data Act was passed in March 2018. It added one section to US law that matters more than the rest, 18 U.S.C. § 2713. It says a provider of electronic communication or remote computing services must comply with US orders to preserve or disclose data:
"…within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."
The test is control, not location. If a US company controls the data, a valid US order can reach it, even when it sits in a data centre in London, Frankfurt or Helsinki.
The act was written to settle a specific dispute. Microsoft had refused to hand over emails stored in Ireland, arguing that a US warrant did not reach servers abroad. The CLOUD Act answered that question for the future, and the Supreme Court dismissed the case as moot.
Why the region does not settle it
Cloud providers let you pick where data is stored, and that choice matters. But the region is a fact about a building. The CLOUD Act turns on a fact about a company.
| Setup | Where the data sits | Whose orders can reach it |
|---|---|---|
| US provider, US region | United States | US law |
| US provider, UK or EU region | UK or EU | Local law, and US law through the provider |
| Provider with no US parent, UK or EU region | UK or EU | Mainly the law where the provider is based |
The middle row is the one to look at closely. It is where most companies end up by default, and for many workloads it is a perfectly good place to be. It is worth knowing that you are there.
What that means
Location: the data is stored in the UK or the EU.
Law: a US-owned provider can be required to hand over data in its possession, custody or control under the CLOUD Act, wherever the data is stored.
Control: the provider holds the keys, so it can decrypt what it stores, and so can anyone who can compel it.
A rule of thumb, not legal advice.
What a provider said under oath
In June 2025, a senior legal representative of Microsoft France gave evidence to a French Senate inquiry. Asked whether he could guarantee that data about French citizens held in Microsoft's cloud would never be passed to US authorities without the agreement of French authorities, he said he could not. He added that it had not happened.
That answer was honest, and it is the point. A provider can promise to challenge orders, to tell you when it is allowed to, and to minimise what it discloses. It cannot promise to ignore the law of the country it is incorporated in.
Read the transcriptHide the transcript
Where your data lives, and who can reach it.
Location: you choose the region. The server, the backups and the logs sit there.
Law: who runs the server decides whose law applies. A US-owned provider is subject to US orders under the CLOUD Act, 18 U.S.C. section 2713, wherever the data is stored.
Control: the same location can give different answers. A region run by a US-owned provider is within reach of US orders; a provider with no US parent answers to local law. Then the question that decides the rest: who holds the encryption keys and the admin accounts.
Exit: for every vendor you keep, a written way out, covering the export format, the time to move and the contract terms.
Where the UK fits
Soventia is a UK company, so this is a question we answer about ourselves as well.
The UK and the US have had a data access agreement under the CLOUD Act since 3 October 2022. It lets each country's authorities ask providers in the other country directly for data about serious crime. It runs for five years at a time.
On the EU side, the European Commission renewed its adequacy decisions for the UK on 19 December 2025, until 27 December 2031. Personal data can flow from the EU to the UK without extra transfer mechanisms. That does not change anything about US providers: a US company's UK region is in the same position as its EU region.
How to choose
There is no answer that fits every company. What matters is choosing on purpose.
- Sort your data. Marketing pages, public documents and most internal chat can live almost anywhere. Personal data, client documents, health or financial records and trade secrets deserve a closer look. Know which is which before anything moves.
- Check who owns the provider, not just the region. Read the contract entity and the parent company. A local subsidiary of a US group can still be within US reach.
- Hold your own keys for the sensitive parts. If data is encrypted before it reaches the provider, with keys the provider never holds, what can be handed over is unreadable. This is the most effective single control, and it works on any cloud.
- Match the provider to the data. A major cloud is the sensible choice for most workloads. If you are an EU company, handle sensitive personal data, or your customers or contracts expect it, a provider with no US parent keeps that data outside US reach. European providers offer hosting, storage and, increasingly, AI services on that basis.
- Write the exit plan. For each provider you keep, write down how you would leave: export formats, time to move, contract terms. In the EU, the Data Act already gives cloud customers switching rights, and from 12 January 2027 providers can no longer charge for switching.
If you want to know where your own data sits on this map, a short audit will tell you. It often turns out that a small part of the data needs a different home and the rest can stay where it is.
Sources
- 18 U.S.C. § 2713, Required preservation and disclosure of communications and records Legal Information Institute, Cornell Law School
- CLOUD Act resources US Department of Justice
- Microsoft tells French lawmakers it can't protect user data from US demands SDxCentral
- UK-US E-Evidence Agreement in force eucrim
- Adequacy decisions European Commission
- Regulation (EU) 2023/2854 (Data Act) EUR-Lex