Almost every large cloud will sell you a European region. Frankfurt, Dublin, Paris — pick one, tick the box, tell your customers the data stays in Europe. It is true, and it is not the whole sentence.
Location is not jurisdiction
The question a court asks is not where are the disks. It is who controls the data. Under the US CLOUD Act, a US company can be compelled to produce data it holds, possesses or controls — regardless of which country the servers are in. A European subsidiary of an American parent is still, for that purpose, within reach.
So “our data is in the EU” and “our data is under EU jurisdiction only” are two different claims. The first is about geography. The second is about ownership, and it is the one that survives contact with a subpoena.
What to actually check
Four questions, in the order that matters. A host that cannot answer all four in writing has not thought about this as hard as their marketing page suggests.
- Who owns the company, and who owns them? Follow it up to the top. A Dutch brand with a US parent is a US company wearing a Dutch coat.
- Who are the sub-processors? Not just the datacentre — the CDN, the backup storage, the email relay, the analytics, the support desk software. Each one is another company in the chain, and each has its own parent.
- Where do the backups go? This is the one people forget. A site can live in Frankfurt and back up to a US-owned bucket, which puts the entire contents of the site in exactly the place the customer was trying to avoid.
- What does the page itself load? Open the network tab. A site can be hosted in the EU and still send every visitor’s IP address to a US CDN, a US font service and a US analytics endpoint before the page has finished rendering.
Why the chain length matters
Every sub-processor is a company that can be acquired, compelled, or breached. The number is not a vanity metric: it is the count of independent parties who could be made to hand something over. Reducing it is the only structural defence, because it is the only one that does not depend on a promise.
Our own chain is two companies long: us, and Hetzner, who own the datacentre in Falkenstein. Backups go to EU-owned storage in a different datacentre, encrypted before they leave the server. There is no CDN, no external font service and no analytics, which is why this page loads nothing from any domain but this one. You can verify that last part yourself, right now, with the network tab.
What this does not mean
It does not mean your data is beyond every legal process. A Dutch company answers to Dutch and European courts, and that is the point rather than a loophole in it — the law that reaches us is the law you already live under. Anyone claiming their hosting puts data beyond all reach is selling something worse than a US parent.