Quick answer up front, since it’s the core of this post: an EU region doesn’t make you sovereign as long as the operator is still a US corporation — if it ever comes down to it, what decides who gets your data isn’t the server’s location, it’s the CLOUD Act.
“Our data sits in Frankfurt.” I hear that sentence constantly, usually meant to reassure. And it’s usually even true. It just reassures you about the wrong thing.
The server sits in Hesse. The corporation that owns it sits in Seattle or Redmond. And when a US authority comes knocking, what wins isn’t the state the hard drive happens to be in — it’s the CLOUD Act. Location isn’t the same as control — and that distinction is exactly what digital sovereignty is about.
Three things people love to mix up
Where your data sits is the easiest question to answer. Who runs it, and under which law, are the ones that matter. An “EU region” only answers the first one.
AWS, Azure, and Google Cloud all have data centers in Germany. Great for the marketing checkbox, nice for latency. On the point that actually matters, it changes little: the operator is still a US company, and so the possibility of access remains — location or no location.
Here’s what actually makes the difference:
| EU region of a US provider | EU provider | |
|---|---|---|
| Operator | US corporation | EU company |
| Legal jurisdiction | also US law (CLOUD Act) | EU law |
| Who can be compelled to hand data over | the US parent company | no one outside the EU |
The questions that actually matter
If a provider is selling you “EU hosting,” ask three things:
- Who owns the company that actually runs the service?
- Which legal jurisdiction is that company subject to?
- Can anyone outside the EU be compelled to hand the data over?
With a German provider running its own infrastructure — or with services you run yourself or have run for you — the answers are short. With a hyperscaler’s “EU region,” they get complicated — and that complexity is exactly the problem. And if you’re already deep in the US cloud: when moving back pays off isn’t a matter of faith, it’s arithmetic.
Don’t get me wrong: for sending out a newsletter or the vacation photos from the office outing, none of this matters. But contracts, personnel records, patient files? There, “well, it’s in Frankfurt” isn’t an answer — it’s a hope.
Sovereignty isn’t about where the server stands. Sovereignty is about who pulls the plug when it counts — and whether someone on the other side of the Atlantic can make that call for you.
Want to know how sovereign your setup really is — not according to the brochure, but for real? Ask me.