The CLOUD Act (2018) allows US authorities to compel data held by any company subject to US jurisdiction — including its foreign subsidiaries and its servers located in Europe. The counter-intuitive consequence: a data center “in France” owned by a US group does not shield you from this extraterritorial reach.
Sovereignty is therefore judged on three planes: data location (GDPR, latency), the operator’s jurisdiction (European headquarters and capital control), and the subcontractor chain. For the most sensitive workloads, France’s SecNumCloud qualification (ANSSI) explicitly includes this legal immunity.
Our comparator offers a “sovereign (outside US CLOUD Act)” filter based on the site’s actual operator — controlled declarations, not a marketing claim.