US Cloud Providers Can't Be Trusted for EU Sovereignty

EU sovereign cloud is the term for keeping EU citizens' data within the EU and under EU legal jurisdiction. The problem? Every major US cloud provider—AWS, Google Cloud, Microsoft Azure—is legally bound by US law, which conflicts with EU data protection regulations.

The Legal Showstopper: Gag Orders vs. Notification

Under US law, a judge or intelligence agency can issue a gag order compelling a company not to disclose that data has been accessed. This is used to avoid tipping off criminal suspects. Under EU law, if a third party accesses a citizen's data, the provider must notify that citizen. No exceptions.

This clash has already killed two previous frameworks: Safe Harbour (struck down in Schrems I) and Privacy Shield (struck down in Schrems II). The current Data Privacy Framework (DPF) doesn't address gag orders, so its validity is untested.

AWS: Global Services Break Data Residency

Even if you deploy in eu-west-1 (Ireland), AWS has global services like S3, IAM, and Route53 that replicate data to us-east-1. IAM authentication always routes through us-east-1. DNS for 13 AWS services depends on us-east-1. You can't avoid it.

AWS's European Sovereign Cloud region (announced, still "Coming Soon" as of October 2025) is being built in Berlin with aggressive deadlines. It will likely launch with a limited subset of services. And legally, it's still gray because AWS Europe is a subsidiary—still ultimately controlled by the US parent.

Google and Microsoft: Same Problems

Google's sovereign cloud partners with T-Systems (a German company) to manage the infrastructure, but it still runs Google's software stack. A US judge could compel Google to insert a backdoor in a security update, with a gag order preventing disclosure. Microsoft Azure is even further behind, according to the author.

The Only Real Solution: EU Cloud Providers

Use European cloud providers like Scaleway (France) or Hetzner (Germany). They are not subject to US law. Their offerings are maturing, though they lack some features of the big three. For Kubernetes management, the author recommends Siderolabs' Omni for managing your own fleet of nodes.

What You Should Do Now

If you're building a new EU-facing service, start with a European provider. If you're migrating, expect a significant architectural overhaul. Don't ask for a migration plan and then decide to "pay fines if we get them"—that's a legal risk that could sink your company.

# Example: Deploy a VM on Scaleway
scw instance server create type=DEV1-S image=ubuntu-jammy zone=fr-par-1

Key Technical Details from the Source

  • AWS global services like S3, IAM, and Route53 replicate data outside the chosen region.
  • The AWS European Sovereign Cloud region is still "Coming Soon" as of 2025-10-21.
  • Google's sovereign cloud uses T-Systems, a German company, but runs Google's software stack.
  • EU law requires notification if citizen data is accessed by a third party; US gag orders can prevent this.
  • Safe Harbour and Privacy Shield were both invalidated by the CJEU (Schrems I & II).

Why It Matters

If you're building apps for EU users, using US cloud providers exposes you to legal risk. The conflict between US gag orders and EU notification laws is unresolved. Choosing an EU-based provider is the only way to ensure compliance until the legal frameworks are tested in court.

Next Steps

Audit your current cloud dependencies. Identify any global services that leak data outside the EU. Evaluate Scaleway, Hetzner, or other EU providers for new projects. For existing infrastructure, plan a phased migration—but be prepared for the complexity.