European VPS Provider Not Subject to the CLOUD Act: 5 Questions to Ask Before You Buy

A European VPS provider not subject to the CLOUD Act is one that no US company owns or controls, and that has no US office, US staff or US-aimed sales a US court could use to claim jurisdiction. The city of the data centre does not decide it: since 23 March 2018, a provider under US jurisdiction must hand over data in its "possession, custody, or control" even when that data is stored outside the United States.

Five written questions, on ownership, data location, keys, sub-processors and contract law, settle it before you sign. This is general information, not legal advice.

RS Computers LLC is a European company registered in Prishtina, Kosovo, with no US parent, and runs KVM servers in Amsterdam, Dublin and Prishtina. For data that must stay inside the EU, an Amsterdam VPS or a server in Dublin keeps it there.

Key facts, checked on 18 October 2026:

• The CLOUD Act became US law on 23 March 2018. It added 18 U.S.C. 2713: a provider must disclose data in its "possession, custody, or control" whether it "is located within or outside of the United States" (Cornell LII).
• The US Department of Justice writes that US jurisdiction "is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons" and depends on "sufficient contacts" with the US (DOJ white paper, April 2019).
• The DOJ's CLOUD Act page lists signed agreements only with the United Kingdom (2019) and Australia (2021), none with the EU or an EU country.
• On 10 July 2019 the EDPB and the EDPS, the EU's data protection bodies, wrote that without an international agreement or another legal basis under the GDPR, providers subject to EU law "cannot legally base the disclosure and transfer" of personal data on such US requests (EDPB-EDPS joint response).

What is the US CLOUD Act in simple terms?

The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US law of 23 March 2018 that makes providers under US jurisdiction disclose data they control, wherever the data is stored.

It ended the Microsoft Ireland case. US prosecutors wanted emails that Microsoft kept in Dublin, and an appeals court had ruled in 2016 that the old law did not reach data abroad. The Act has two parts:

• Any "remote computing service", US legal language for a company offering storage or processing to the public (a VPS host is one), must answer valid US legal process for data it controls, wherever the server is.
• Other countries can sign executive agreements, bilateral deals that let their authorities request data from US providers directly. EU-US talks resumed in March 2023.

The Act targets providers, not customers, so a freelancer's data is covered the same way as a corporation's. Three details most summaries skip:

• It is about criminal cases, and a US judge can bar the provider from telling the customer that an order exists.
• The DOJ calls it "encryption neutral": it gives no new power to force decryption.
• The escape hatch is narrow. A provider has 14 days to ask a US court to quash an order that would break a foreign law, but only the law of a "qualifying foreign government", one with an agreement in force (18 U.S.C. 2703(h)). No EU country has one.

US intelligence agencies use a separate law, Section 702 of FISA (the Foreign Intelligence Surveillance Act), which also binds US providers. Its 2026 lapse is in the timeline further down.

Does the CLOUD Act apply to data stored in the EU?

Yes, whenever the provider is under US jurisdiction. The law follows the company, not the rack: 18 U.S.C. 2713 covers data "located within or outside of the United States".

Data residency vs data sovereignty

Data residency is where the data is physically stored. Data sovereignty is which country's laws and courts can reach it. An EU data centre gives you EU residency; only the provider's ownership and presence decide sovereignty.

Which hosting companies does the CLOUD Act apply to?

The whole test is jurisdiction: whether US courts can give the company orders it must obey. By type of provider:

What about European subsidiaries of US groups?

They are generally covered. On 10 June 2025 the French Senate asked Microsoft France's director of public and legal affairs, under oath, whether French citizens' data could never reach US authorities without French consent. He said he could not give that assurance, while adding that it had never happened.

AWS opened its European Sovereign Cloud in Brandenburg, Germany, on 14 January 2026, run by "dedicated European legal entities established under German law" (AWS). The post does not say who ultimately owns them. If you are shopping for an EU sovereign VPS, the ownership chain tells you more than the product name.

Can a non-US hosting company fall under it?

Yes, with enough US contacts. The DOJ says the more a company "purposefully directed its conduct into the U.S.", the likelier a US court finds jurisdiction, so a US office, US staff or sales aimed at Americans all count.

No provider is outside all law, either. Since 18 August 2026 the EU's e-Evidence Regulation lets courts and prosecutors in one member state order data from any provider offering services in the EU within 10 days, "regardless of the location of the data" (eucrim). The real question is which courts and safeguards apply to you.

Does the US CLOUD Act conflict with the GDPR?

It can. GDPR Article 48 recognises a foreign order to disclose personal data only if it rests on an international agreement, such as a mutual legal assistance treaty (MLAT), the slower government-to-government route. The EDPB and the EDPS added in 2019 that EU companies "should generally refuse direct requests" and point the foreign authority to that treaty.

So a US provider holding EU personal data can be told by US law to disclose it and by EU law not to.

The EU-US Data Privacy Framework does not remove that clash. The Commission's adequacy list covers the United States only for "commercial organisations participating in the EU-US Data Privacy Framework", under a decision of 10 July 2023. That lets EU personal data flow to those certified US companies without extra safeguards, but it changes neither the CLOUD Act nor Article 48.

The GDPR risk lands on you. You are usually the controller, the party that decides why data is processed. Your host is the processor, which handles data on your behalf, and Article 28 lets it act outside your instructions only when "Union or Member State law" requires it. US law is neither.

How to find a European VPS provider not subject to the CLOUD Act

Send these five questions by email before you sign, and keep the written answers with your GDPR records. Vague answers are answers too.

1. Who owns the company, all the way up?

Ask for the legal entity that signs your contract, its parent and its ultimate owner, and whether the group has a US subsidiary, office, staff with access to customer systems, or sales aimed at the US. Check the answer in the company register of the provider's country. "Our data centre is in the EU" does not answer this question.

2. Where does the data sit, including copies and logs?

Ask where copies, logs, monitoring data and support tickets are kept, and from which countries staff log in. The EU's proposed Cloud and AI Development Act (CADA, 3 June 2026) sets a useful bar: customer data "including metadata and telemetry" stays in the Union.

For a country outside the EU, check the Commission's list of adequacy decisions, its findings that a non-EU country protects personal data well enough for it to flow there freely. Without one, EU personal data stored there is a transfer and needs a safeguard such as standard contractual clauses (SCCs), the Commission's model contract terms for transfers.

3. Who holds the encryption keys?

A provider without your keys can only hand over scrambled data. Ask who holds the disk keys and whether you can encrypt with keys the provider never sees.

Know the limit: on any ordinary virtual server, ours included, whoever runs the host can technically reach a running machine. Your own encryption protects copies, retired disks and files at rest, not a live system or its metadata.

4. Which sub-processors touch the data?

A sub-processor is any company your provider uses to handle your data: a data centre operator, a ticket system, an email delivery service. Under Article 28 a processor needs your authorisation to add one. A European host that ships logs to a US monitoring service lets the CLOUD Act back in through the side door. Ask for the list and how changes are announced.

5. Which law governs the contract, and what happens when an order arrives?

Read the governing law clause and check that a data processing agreement (DPA) is offered. Ask whether the provider tells you about government requests when allowed, points foreign authorities to the treaty route, and publishes a transparency report. US state law or US courts in the contract bring US jurisdiction with them.

How RS Computers answers the five questions

Judge us by the same table.

Where we are not the right choice: an EU public body planning around CADA, because Level 1 as proposed asks for a provider "established in the Union", and we are registered in Kosovo. The same goes for any buyer whose policy requires a provider registered or owned inside the EU.

If you run a private company, CADA's purchasing levels do not bind you. Our guide to leaving Microsoft 365 and Google Workspace shows what to run once you have chosen a server. For workflow automation, our n8n on-premise guide compares an office server with a private VPS.

Which plan and which city for GDPR hosting in Europe

All plans run on KVM with NVMe storage, unmetered traffic and their own IPv4 and IPv6. VPS plans have shared vCPUs, VDS plans dedicated vCPUs (our guide to VPS vs VDS vs dedicated servers explains the difference), and you can upgrade later from the client area with a short reboot.

Availability by city is on the plans page. For most readers with EU customers, the shortest path is a VPS in the Netherlands: Amsterdam, EU law on the ground, and a provider with no US parent.

What changed for EU sovereign hosting in 2026

CADA targets public bodies and can still change. Its Level 1 test, where the provider is established and where data, metadata and telemetry stay, still works as a private checklist for GDPR hosting in Europe. An Amsterdam VPS from a provider with no US parent covers the location part on day one.

How to check your own server for hidden US services

US services also hide in your own setup: a mail provider, an analytics script, an uptime monitor. First list the remote addresses your server talks to. The syntax comes from the ss(8) manual page; we did not run it for this article.

# as root on your server: established TCP connections (syntax from the ss(8) manual, not run by us)
ss -tn state established

The Peer Address:Port column shows the remote end of each connection. For each address you do not recognise, ask RIPEstat, the RIPE NCC's free data service, who runs the network behind it:

# as any user, on a computer with curl and python3
curl -s "https://stat.ripe.net/data/prefix-overview/data.json?resource=8.8.8.8" | python3 -c 'import json,sys; d=json.load(sys.stdin)["data"]; print(d["resource"], [a["holder"] for a in d["asns"]])'

On 18 October 2026 it printed 8.8.8.0/24 ['GOOGLE - Google LLC'] on our Windows workstation, where the interpreter is called python instead of python3. Swap 8.8.8.8 for your own addresses. A US company in the output is a lead for your sub-processor list, not a verdict, because the network that carries traffic is not always the company that stores the data.

Finally, encrypt files before they leave the server, with a passphrase only you know. If gpg is missing, install it as root with apt install gnupg file.

# as the app user: encrypt a file before copying it anywhere
gpg --symmetric --cipher-algo AES256 clients.csv
file clients.csv.gpg

gpg asks for the passphrase twice and writes clients.csv.gpg. With GnuPG 2.4.9 on our workstation, file reported PGP symmetric key encrypted data - AES with 256-bit key salted & iterated - SHA512. Whoever holds that copy, a US storage bucket included, sees only ciphertext. For scheduled copies, see our guide to encrypted off-site backups with restic; to replace a US analytics script, run Umami or Plausible on your own server.

Frequently asked questions

Does the CLOUD Act apply to European VPS providers?

Only when the US has jurisdiction over them: clearly when a US company owns or controls them, and possibly when they have US contacts such as a US office, US staff or sales aimed at the US. A European provider with no US parent, office or staff is generally outside its direct reach. RS Computers LLC, registered in Kosovo, has no US parent and runs servers in Amsterdam, Dublin and Prishtina.

Is my data safe from the CLOUD Act on a server in the Netherlands?

Only if the provider is out of US reach too. A server in Amsterdam gives your data EU residency, but since 2018, 18 U.S.C. 2713 has required providers under US jurisdiction to disclose data they control wherever it is stored. With a European provider that has no US parent, office or staff, data on a Dutch server is generally outside the CLOUD Act's direct reach.

Does the CLOUD Act apply to European subsidiaries of US companies?

Generally yes. The DOJ's 2019 CLOUD Act white paper says the jurisdiction analysis "remains the same regardless of corporate structure". In June 2025, Microsoft France told the French Senate under oath that it could not promise French data would never reach US authorities without French consent.

Does encryption protect data from a CLOUD Act request?

It helps when you hold the keys. The DOJ says the CLOUD Act is encryption neutral and creates no new power to force decryption, so a provider without your keys can only hand over unreadable data. Metadata such as file names, sizes and login times may still be readable.

Is the US CLOUD Act compatible with the GDPR?

Not directly. GDPR Article 48 recognises foreign orders for personal data only when they rest on an international agreement, such as a mutual legal assistance treaty. In July 2019 the EDPB and the EDPS said EU companies should generally refuse direct requests. On 18 October 2026 the DOJ listed signed CLOUD Act agreements only with the UK and Australia.

Can I keep EU personal data on a server in Kosovo?

Yes, with a transfer safeguard such as standard contractual clauses, because Kosovo is outside the EU and has no EU adequacy decision. For no transfer at all, choose Amsterdam or Dublin. For organisations in Kosovo, a Prishtina server keeps their data in the country under Law No. 06/L-082.

Ask first, then pick the city

Send the five questions to every provider on your shortlist, us included, and keep the answers. If ours fit, start with an Amsterdam VPS from a European company with no US parent, or pick Dublin for Ireland and Prishtina for Kosovo. For our sub-processor list, the DPA or help choosing a plan, message us on Telegram or email us.

← All articles