The best writing on this is not ours

Five pieces worth your time on where your data actually sits under the law, each with a note on what it gets right and what has changed since. We mostly link to the originals rather than reprinting them: the authors deserve the traffic, and a copy on our site is usually a worse copy. One exception, added 9 August 2026 — the CLOUD Act piece is now republished here in full, with a canonical link back to EFF so their copy still ranks.

Victory! 702 has Expired!

Electronic Frontier Foundation, 12 June 2026 · CC BY 4.0

Our take. Section 702 of FISA lapsed when the House rejected an extension, and this is the clearest short account of how that happened. Read it with one correction, which we had to make to our own site: the lapse did not stop collection. Certifications the FISA Court approved in March 2026 are grandfathered and run until March 2027, and reauthorisation is being negotiated now. The CLOUD Act — the law that actually governs whether your host can be compelled to hand over your files — is a different statute and is untouched by any of this.

The U.S. CLOUD Act and the EU: A Privacy Protection Race to the Bottom

Katitza Rodriguez, Electronic Frontier Foundation, 9 April 2018 · CC BY 4.0

Our take. The single most relevant piece anyone has written for the question this company exists to answer, and the one we would hand to a sceptic first. Its argument is that the CLOUD Act and the EU’s own cross-border evidence proposals were converging on the same bad idea from opposite directions — both trading away territoriality, the principle that the law of the country where data sits is the law that governs it. It is eight years old and the legislative detail has moved on; the structural point has not, and it is the reason “our servers are in Europe” was never a complete answer.

The CLOUD Act: A Dangerous Expansion of Police Snooping on Cross-Border Data

Electronic Frontier Foundation, February 2018 · CC BY 4.0

Our take. The plainest explanation of the mechanism, written before the Act passed and while its wording was still being argued over. The phrase to hold on to is that a provider can be compelled to produce data it possesses, custodies or controls — three words that do the work, because none of them is about geography. That is the whole reason we ask you to check who owns your host rather than where the disks are.

Defending Encryption in the U.S. and Abroad: 2025 in Review

Thorin Klosowski, Electronic Frontier Foundation, 28 December 2025 · CC BY 4.0

Our take. The UK reportedly ordered Apple to break its own end-to-end encryption for iCloud, and Apple responded by switching Advanced Data Protection off for British users entirely. That is worth sitting with, because it is the shape of the risk rather than a story about one company: a government told a provider to remove a security feature, and every user in that country lost it. No datacentre location would have changed the outcome. The piece also covers the European Commission’s encryption roadmap, which is a useful antidote to assuming the EU is uniformly the good news.

Getting Digital Fairness Right: EFF’s Recommendations for the EU’s Digital Fairness Act

Electronic Frontier Foundation, April 2026 · CC BY 4.0

Our take. Included deliberately as the piece that argues against the lazy version of our own position. European regulation is not automatically good for the people it covers, and a company selling on “we are in the EU” has an obvious incentive not to mention that. If you are choosing a host on sovereignty grounds, you should be reading the critical coverage of EU lawmaking too, not only the flattering kind.

Why we mostly link instead of reprinting

Everything above is published by the Electronic Frontier Foundation under a Creative Commons Attribution 4.0 licence, which means we may legally republish all five in full. For four of them we have chosen not to: a copy here would rank below the original, add nothing a reader could not get from the source, and pad our site with someone else’s work.

We made an exception on 9 August 2026 for the CLOUD Act article, and it is worth being straight about why, because this page previously said we reprint nothing at all. That law is the single mechanism our product exists to keep out of your hosting, and the clearest description of it comes from someone with no hosting to sell — which is a much stronger thing to be able to hand a customer than a summary in our own words. It is republished in full and unaltered, credited to its author, with a rel="canonical" pointing at EFF so search engines keep showing their copy rather than ours, and with our own note on what has changed since 2018 clearly marked as ours.

We are not affiliated with the EFF and they have not endorsed us. Short quotations above are used under CC BY 4.0 with attribution. Titles, authors and dates checked 8 August 2026.