GDPR vs CLOUD Act: why EU hosting is not enough

Two questions that are often merged

When a provider says “your data stays in Europe”, it is answering one of three separate questions. Asking all three is the quickest way to see what a sovereignty claim covers.

Where is the data processed? That is residency, answered by a region or a data centre's address.
Which company controls it, and whose orders must that company obey? That is jurisdiction, answered by ownership and by the law the company is subject to.
What does the company keep, and for how long? That is retention, answered by its own published policy.

The GDPR and the CLOUD Act each govern a different one of these questions. A provider can therefore satisfy the first law in full and still be bound by the second.

How the CLOUD Act reaches data stored in Europe

Passed in 2018, the CLOUD Act requires a provider to disclose data in its “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. § 2713). The test is control, not location: a US parent that controls data held by its European subsidiary can be ordered to produce it.

The US Department of Justice reads the reach broadly: “U.S. jurisdiction is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons. But neither is U.S. jurisdiction unlimited.” (CLOUD Act FAQ, 2019). A non-US company with enough business in the United States can be served too.

The law also lets the US sign “executive agreements” with other states (18 U.S.C. § 2523). Only a “qualifying foreign government” — in short, a country with such an agreement in force — gives a provider a statutory way to challenge an order that conflicts with its law (§ 2703(h)). According to the Department of Justice, as read on 6 October 2026, agreements were signed with the United Kingdom (3 October 2019) and Australia (15 December 2021); talks with the European Union resumed in March 2023, with no agreement listed.

What the GDPR does, and what it does not

The GDPR protects personal data wherever it goes. Its Chapter V (Articles 44 to 50) restricts transfers outside the European Economic Area unless one of its mechanisms applies: an adequacy decision, appropriate safeguards such as standard contractual clauses or binding corporate rules, or a narrow derogation. Its closest contact with the CLOUD Act is Article 48:

« Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter. »
— GDPR, Article 48

Article 48 does not stop a US court from issuing an order. It means the order has no force in the EU unless an international agreement backs it — which leaves the provider caught between two laws. That conflict lands on whoever holds your data.

The GDPR applies to US companies operating in Europe as well, and their users keep every right it grants. The issue is not that US providers escape the GDPR; it is that complying with the GDPR does not put them beyond US law.

Why transatlantic frameworks keep being challenged

The EU and the US have built three frameworks for transfers to US companies. The Court of Justice struck down the first two — Safe Harbor in 2015 (Schrems I, C-362/14) and Privacy Shield in 2020 (Schrems II, C-311/18) — each time over US surveillance and the redress available to Europeans. The third, the EU-US Data Privacy Framework, was adopted on 10 July 2023 (Decision (EU) 2023/1795).

On 3 September 2025, the General Court dismissed the annulment action brought against it by Philippe Latombe, a French member of parliament (Case T-553/23), finding that the United States ensured an adequate level of protection on the date the decision was adopted (press release 106/25). He appealed at the end of October 2025 (Case C-703/25 P); as of September 2026, the Court of Justice had not ruled.

For a company choosing infrastructure for several years, relying on the framework means betting on the outcome of that appeal. Choosing an operator that is not subject to the underlying conflict avoids the bet altogether.

France's test: SecNumCloud and protection from non-EU law

France's cybersecurity agency, ANSSI, qualifies cloud services under SecNumCloud. Version 3.2 of 8 March 2022 adds a chapter on protection from non-EU law (chapter 19.6). The provider's registered office, central administration and principal establishment must be in the EU. Non-EU entities may not hold, directly or indirectly, more than 24% of its capital or voting rights individually, or 39% together, and may have no veto and no right to appoint most of its board. And no non-EU third party, subcontractors included, may be technically able to obtain the data — logs and access settings included.

Qualification covers one service, not a whole company. On the ANSSI catalogue updated on 15 September 2026, the service « Cloud de confiance S3NS » of Thales Cloud Sécurisé is qualified from 17 December 2025 to 17 December 2028, alongside three OVH services; no Scaleway service is listed. Bleu's « Cloud de Confiance Bleu » and Scaleway's SecNumCloud offer appear among the qualifications in progress (read on 6 October 2026).

None of the AI services Evanesca relies on — OVHcloud AI Endpoints and Scaleway Generative APIs — is SecNumCloud-qualified. Evanesca applies the principle behind chapter 19.6, who controls the operator, not the qualification itself; its sovereignty page shows the test model by model.

Five kinds of hosting, and what to ask each

Hosting	CLOUD Act exposure	Proof to ask for
EU region of a US provider	Direct, whatever the region	None removes it; a contract can only limit it
French “trusted cloud” built on licensed US technology	Depends on the qualification and on the licensor's technical access	The exact service on ANSSI's list; licence and update terms
EU-controlled provider, service not qualified	Not direct; residual if the group has US entities or business	Company registry, shareholders, sub-processors, where support is run from
SecNumCloud-qualified service	The lowest documented: chapter 19.6 is assessed before qualification	The ANSSI catalogue entry, its dates and its scope
API gateway or aggregator	That of the most exposed company on the route	The whole chain, model by model

An AI service that routes your prompt to a model belongs to the last row: its exposure is that of every company the prompt passes through. How aggregators differ on that point is covered in a separate guide.

Evanesca's own chain, link by link

Publisher: FLEECE AI, a French company with no US parent and no US subsidiary.
Most models: run in France by Scaleway in Paris, with OVHcloud in Gravelines as a fallback. OVH Groupe is controlled by the Klaba family, with 79.0% of the capital and 79.6% of the voting rights on 5 December 2025 (OVHcloud); Scaleway is “a subsidiary of the iliad Group” (Scaleway). Neither has a US parent.
Why Evanesca says “outside the direct reach”, not “out of reach”: each group has an entity registered in the United States — OVH US, whose CLOUD Act FAQ says it “will comply with lawful requests from public authorities”, and a “SCALEWAY INC.” in Delaware in the US address registry (ARIN) — and US authorities can still ask France through mutual legal assistance.
What is kept: Evanesca stores no prompt and no answer. OVHcloud keeps only the data needed for billing; Scaleway may keep and read requests that cause errors or look abusive, for up to 14 days (Scaleway).
Evanesca's own app and relay: Vercel, a US company, in its Paris region. Your messages pass through in memory and no copy is kept, but as a US company Vercel is within the CLOUD Act's reach.
The other models: Mistral Large 4 and Mistral Small 4, run by Mistral AI, a French company, in its EU region — Mistral AI keeps API inputs and outputs 30 days to monitor abuse (Mistral AI); DeepSeek V4.1 Flash, GLM-5.3 and Gemma 4 26B, run by AKI.IO, a German company in Berlin whose shareholders are not published, which says its inference runs on GPU infrastructure in German data centres and that prompts and outputs are not logged, stored or analysed (AKI.IO); and Apertus, run by Infomaniak, a Swiss company, in Switzerland, outside the EU but under an EU adequacy decision.
No model outside Europe: Evanesca does not serve one, not even as an option.

The operators' pages quoted above were read on 6 October 2026. Each answer in the chat carries a passport that names the model, its operator and its country, so the chain above can be checked one answer at a time.

Four questions to put to any provider

Who is the ultimate parent company, and where is it registered? A European subsidiary can be reached through a US parent that controls the data.
Is the exact service you will use on ANSSI's list of qualified services, or only the company's name? Qualification is granted service by service.
Can a non-EU party — a software licensor, a support team, a subcontractor — technically reach the data, the logs or the access settings?
What does the contract say about a foreign authority's request: who answers it, and under which procedure?

None of this replaces a GDPR programme. A legal basis, data minimisation, retention limits, a record of processing and data-subject rights apply whoever hosts the model: infrastructure addresses one risk, access by a foreign state to what your processor controls. For a worked example on one provider, read is OpenAI GDPR-compliant?.

Frequently asked questions

Is an EU data centre enough to escape the CLOUD Act?

No. The CLOUD Act binds providers under US jurisdiction for the data they possess, hold or control, wherever it is stored. A data centre in France run by a US company, or by its French subsidiary, stays within reach. What changes the answer is the operator: a company with no US parent and no US control.

Does the GDPR forbid US AI providers?

No. It restricts transfers of personal data outside the EEA unless a mechanism applies, such as an adequacy decision or standard contractual clauses. A US provider can comply with the GDPR and still be subject to a US order: the two laws answer different questions.

Is the EU-US Data Privacy Framework still valid?

Yes, as of September 2026. The General Court dismissed an annulment action against it on 3 September 2025, judging the situation on its adoption date in July 2023. That judgment is under appeal before the Court of Justice (Case C-703/25 P). The two frameworks before it were annulled by the Court of Justice.

Which cloud services are SecNumCloud-qualified?

ANSSI publishes the list in its catalogue, service by service. On the version updated on 15 September 2026 it includes « Cloud de confiance S3NS » and three OVH services, but neither OVHcloud AI Endpoints nor Scaleway Generative APIs. Always check the exact service and its validity dates.

What does this mean for Evanesca's models?

Its models run at European companies — most of them in France at Scaleway, with OVHcloud as a fallback, Mistral's own models at Mistral AI, others at AKI.IO in Germany, Apertus at Infomaniak in Switzerland. OVHcloud, Scaleway, Mistral AI and Infomaniak have no US parent: outside the CLOUD Act's direct reach. AKI.IO is a German company whose shareholders are not published. It serves no model outside Europe. Each model's operator is on the models page.

GDPR and the CLOUD Act: why hosting your AI in the EU is not enough