What the CLOUD Act means for data held by US providers
Updated on 23 September 2026: the description of the CLOUD Act and Schrems II now follows the wording of the linked sources, and the judgment of the General Court of the EU of 3 September 2025 on the EU-US Data Privacy Framework has been added.
Under the US CLOUD Act, US authorities can demand data by order from providers that are subject to US law, even if the data is stored in Europe. What this means for your company and what role European providers play.
This affects cloud and communication services from providers based in the US, even if their data centres are located in Europe. The legal basis is the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
Server location alone is not decisive: what matters is whether the provider is subject to US law, even if your data is stored in Frankfurt.
What is the CLOUD Act?
The CLOUD Act came into force on 23 March 2018 as a US federal law. It added 18 U.S.C. § 2713 to the Stored Communications Act: providers of electronic communication and cloud services (electronic communication service and remote computing service) that are subject to US law must preserve or disclose data in their possession, custody or control when ordered to by US authorities, regardless of whether this data is stored in the US or elsewhere in the world (18 U.S.C. § 2713).
This means that data centres in the EU can also be affected if the operator or its group is subject to US law. Whether and how a specific service is affected depends on the contracting party, the group structure and the configuration.
The law came about during a legal dispute over email data stored in a data centre in Ireland. Microsoft had challenged a search warrant for this data. After the CLOUD Act came into force, the Supreme Court declared the case moot on 17 April 2018 (United States v. Microsoft Corp., No. 17-2).
What DPAs and SCCs achieve and where their effect ends
Many companies rely on Data Processing Agreements (DPAs) or Standard Contractual Clauses (SCCs) with their US providers. These contracts govern the relationship between you and the provider. They do not bind a US authority.
In concrete terms, this means:
- A private-law contract does not release a company that is subject to US law from a US order
- Non-disclosure orders ("gag orders") can prevent the provider from notifying you
- A server location in the EU alone does not change this; what matters is which law the provider is subject to
A contractual commitment is therefore no substitute for the question of which law the provider is subject to.
What Schrems II and the Data Privacy Framework mean
On 16 July 2020 the Court of Justice of the European Union (CJEU) declared the adequacy decision on the EU-US Privacy Shield invalid in Case C-311/18. Standard contractual clauses remain permissible, but they are subject to a case-by-case assessment of the law in the third country.
The Court based this on the powers under FISA Section 702 and Executive Order 12333: they were not limited to what is strictly necessary, and data subjects in the EU had no effective judicial remedy.
Its successor, the EU-US Data Privacy Framework of July 2023, is based on Executive Order 14086 of the US President. The General Court of the EU dismissed an action for annulment against the adequacy decision on 3 September 2025 (Case T-553/23, Latombe v Commission), so the decision remains in force. The Commission monitors the framework on an ongoing basis and can suspend, amend or repeal it if the legal situation in the US changes. The questions that the Supreme Court ruling of 29 June 2026 on independent US agencies raises for this framework are described in the article Supreme Court ruling on independent US agencies.
Data flows at Nexoria
Nexoria describes the processing step by step:
- Files, knowledge index and semantic search: on servers in Germany
- AI response generation: by Mistral AI with processing in France
- Other services and activated integrations: listed separately under Security (including Sentry for technical error monitoring and Telnyx for the optional VoiceBot telephone connection)
- Optionally connected AI providers: ChatGPT (OpenAI), Claude (Anthropic), Gemini (Google) and Langdock can optionally be connected to Nexoria. Nexoria also works without these integrations. When connected, shared content is transferred to the respective provider. That provider's terms, processing locations and settings apply.
Under the individual data processing agreement, data transmitted by Nexoria to Mistral AI is not used for model training. We do not infer from this technical information a blanket exclusion of access by authorities or of all links to third countries.
Conclusion: act now
When assessing a platform, the decisive factors are the services actually used, their processing locations and the providers involved. For Nexoria, you can read this breakdown in the component overview for the core platform and additional integrations.
Nexoria connects an AI assistant, document search, business processes and communication. Which data is processed depends on the respective function and the activated integrations.
Find out how Nexoria Base and Pro combine file storage and search in Germany with AI response generation in France, or arrange a free consultation with our team.