"Sovereign cloud" from AWS, Microsoft and Google: does it actually solve the CLOUD Act problem?
What these sovereign cloud versions actually promise
The "sovereign cloud" offerings from AWS, Microsoft and Google revolve around a few concrete promises: only EU-based staff manage and support the service, metadata such as roles and configurations stays within the EU, and there's a separate, dedicated billing and management system apart from the rest of the global platform. For businesses in regulated sectors or government, that's a real step forward compared to "just a European region" at the same provider.
Why it remains a tricky question
The parent company behind each of these "sovereign" variants is still American. And that's exactly where the discussion gets stuck: the American CLOUD Act doesn't focus on where servers are located, but on which company has control over them, even if that runs through a European subsidiary. Among technologists closely following these launches, the question keeps coming back whether a European subsidiary of an American parent company is really legally exempt from that, and there's no definitive answer to that today. It's an unresolved legal question, not a closed case. We won't make a definitive claim about it here, and neither do the providers themselves, for that matter.
What this means for a smaller business
Most SMEs don't need to untangle this legal knot themselves. A sovereign cloud structure is mainly built for large, regulated organizations that simply have to keep working with a specific hyperscaler. If you don't have that obligation, there's a simpler route: choose a provider that's European both in hosting and in ownership from the start. Then you don't have to wait and see how a court might one day rule on those subsidiary structures: the question just doesn't come up.
And at Mailflux
Mailflux doesn't have an American parent company to build a structure around; we're European, full stop. Your mailbox sits on your own domain, hosted in Europe and GDPR-compliant, without you having to figure out exactly which legal structure it falls under. A simpler answer to the same question.
For more background on the CLOUD Act itself, read the CLOUD Act and email explained.
Get started
Would you rather not have to ask that question about your own mailbox at all? Request your mailbox with no obligation from a European provider, no detours needed.
FAQ
Frequently asked questions
Is a sovereign cloud from AWS, Microsoft or Google worthless, then?
Not at all. For organizations that are tied to those providers for other reasons, it's a real improvement in terms of EU-based staff and separate management. It just doesn't definitively resolve the underlying ownership question, and that's exactly what the CLOUD Act discussion is about.
Does this mean my data is always unsafe at a non-European-owned company?
That's too simplistic. It means there's a legal possibility of access that doesn't exist with a fully European company. Whether that's a decisive risk for your situation depends on what kind of data you process. Consult a specialist if in doubt.