Made in US hosting: what the CLOUD Act means for your data
Hosting in the United States, or with a US provider, places your data under US law wherever it physically sits. Here is what that implies, and when it still makes sense.
The legal framework #
The US has no single federal privacy law, but a sectoral patchwork (health, finance) and state laws such as California's CCPA/CPRA. What matters for sovereignty lies elsewhere: government access powers.
The CLOUD Act, the real issue #
The CLOUD Act (2018) lets US authorities compel a provider subject to US law to hand over data, including data stored outside the United States. In other words, a US provider stays exposed even with servers in Europe. Location alone is not enough.
Transfers from Europe #
To move EU personal data to the US, you rely on the Data Privacy Framework (DPF) or standard contractual clauses. These frameworks regulate the transfer but do not neutralize the risk of US government access.
For whom, and for whom not #
Made in US fits services whose users and obligations are American, or that value proximity to the US market. For sensitive European data or a sovereignty requirement, it is the most exposed profile: a European provider and law are preferable.
FAQ #
No. The CLOUD Act follows the provider, not just the server. A provider subject to US law can be compelled to hand over data hosted in Europe.
If it concerns EU individuals, the GDPR follows the data and requires the transfer to be framed (DPF, standard clauses). But it does not override US access powers exercised on site.
Written on 1 September 2026.
From reading to comparing: relevant data centers
Estimate my cost → Compare data centers