Why the US CLOUD Act reaches data held in Europe
The US CLOUD Act of 2018 lets US authorities compel US-controlled providers to produce data they control, wherever it is stored. That is why ownership, not server location alone, decides exposure.
The rule in one line. The CLOUD Act requires a provider subject to US jurisdiction to hand over data in its possession, custody or control, regardless of where the data is stored. A Frankfurt server run by a US-controlled company is not out of reach.
The European side. GDPR Article 48 says a foreign court order for personal data is only recognisable in the EU if it rests on an international agreement such as a mutual legal assistance treaty. Providers can be caught between the two duties at once.
What this means in practice. Picking a host with servers in the EU but a US parent reduces latency and helps with GDPR paperwork. It does not remove the US legal channel. Picking an EU-controlled host, or self-hosting, closes that channel for the data itself.
Encryption narrows the gap. End-to-end encryption where the provider holds no keys limits what any order can produce to metadata. Several entries in this directory, including Proton and CryptPad, are built exactly on that model.