What the CLOUD Act means for European companies

Atlassian's Teamwork Graph now holds more than 200 billion objects and connections from Jira, Confluence and other tools, counted across all customers. Teamwork Graph is what gives Atlassian's AI its context. The company published the figure in August 2026.

Behind that number is the daily work of companies like yours: the requirement for the next release, last week's incident report, the contract draft nobody has signed yet.

Many European companies store this information in data centers in Frankfurt. When they rolled out their tools, that was the question that mattered most to them: where does our data live? But that's only half the answer. The other half is who has the legal right to get access to it.

The US CLOUD Act is the answer to the second half of that question. The 2018 US law lets US authorities, under certain conditions, demand data from companies subject to US law, even when the data sits in Frankfurt. Atlassian has been a US company since 2022, and according to its transparency report it handed user content to US authorities in 13 cases in 2025, up from 3 the year before.

The responsibility ultimately lies with your company. The GDPR requires you to be able to show how personal data is processed, who receives it and where it goes. And when your data protection team, internal auditors, or regulators start asking questions, “our data is hosted in Frankfurt” won’t be enough.

This goes well beyond Atlassian. What follows covers what the CLOUD Act regulates, which providers it reaches, and how to audit your own software stack in four steps.

Key takeaways

1. The CLOUD Act follows the provider, not the server

   If the provider is subject to US law, a data center in Frankfurt doesn't change that.

   
   

2. A European head office isn't enough on its own

   European providers can be in scope through their corporate structure, their US business or their technical subcontractors.

   
   

3. The GDPR doesn't resolve the conflict

   It puts providers between two legal systems, but it doesn't keep your data out of reach.

   
   

4. What matters is the data in each tool

   Four questions help: Which data? Who is behind the provider? Who runs the infrastructure? Who controls the keys?

What is the US CLOUD Act?

The CLOUD Act is a US federal law passed in 2018. It makes clear that US authorities can, under certain legal conditions, require communication and cloud providers subject to US law to hand over data. What counts is whether the provider controls the data, wherever it happens to be stored. Content such as emails or documents generally requires a warrant signed by a judge. For some account and connection data, other orders, such as a subpoena, can be enough.

The CLOUD Act has its roots in a legal dispute between Microsoft and US authorities. In 2013, investigators sought access to emails stored on Microsoft’s servers in Ireland. The case reached the Supreme Court, but before a ruling was issued, Congress passed the CLOUD Act in March 2018, establishing the legal framework that applies today.

Two points are often missed in explanations of the US CLOUD Act:

1. Pushing back is only possible in limited cases

Providers get a dedicated legal route to challenge an order only when the data concerns a country that has signed an agreement with the US. As of October 2026, only the UK and Australia have one, which puts UK companies in a different position from those in the EU. The EU has been negotiating since 2019, but the talks were considered stalled in early 2026. For data from the EU or Switzerland, what's left is a balancing of interests by the US court, with an uncertain outcome.

2. Encryption can make the difference

According to the US Department of Justice, the CLOUD Act creates no new power to force providers to decrypt data. A provider that doesn't hold the keys can't hand over content in plain text, although some metadata stays accessible. Who controls the keys is one of the most important questions in the whole audit.

Who the CLOUD Act reaches

The deciding factor is whether a provider falls under US jurisdiction. Its head office and its data center location come second. Three situations come up most often.

1. US groups and their European subsidiaries: A German GmbH doesn't escape US law just because it is registered in Germany. If it belongs to a US group, the data can still be reached through the parent company. That includes the AWS European Sovereign Cloud, launched in January 2026 as a sovereign cloud run by German entities under European management, but still part of the Amazon group. Our post on sovereignty washing covers what to look for in offers like this.

   
   

2. European providers doing business in the US: According to the US Justice Department, foreign companies can also fall under US jurisdiction if they have sufficient business ties to the US, such as targeted advertising, active customer acquisition or actual use by customers in the US. How far that reaches is disputed. The German Bundestag's research service notes that the question is not conclusively settled, particularly under international law. One example is monday.com: it is headquartered in Israel but has run a US subsidiary since 2016, according to its IPO prospectus.

   
   

3. European providers on US infrastructure: A software vendor can be entirely European and still run its application on AWS, Microsoft Azure or Google Cloud. In that case, US authorities may be able to go straight to the infrastructure operator. So besides ownership, always ask who runs the infrastructure.

CLOUD Act and GDPR: when two legal systems collide

Article 48 of the GDPR sets clear limits. Orders from authorities outside the EU are, as a rule, only recognized if they're based on an international agreement such as a mutual legal assistance treaty. The European Data Protection Board and the European Data Protection Supervisor said as early as 2019 that a CLOUD Act order on its own is generally not a sufficient legal basis under the GDPR.

That can leave a provider caught between two legal systems. If it complies with the US order, it risks breaching European law. If it refuses, it faces consequences in the US. The GDPR limits disclosure, but it can't guarantee that your data stays out of reach.

People often point to the EU-US Data Privacy Framework here, which the EU General Court upheld in September 2025 (an appeal is pending). But the framework governs when personal data may be transferred to the US for commercial purposes, not when a US authority can demand data under a CLOUD Act order. Those are two different questions.

CLOUD Act, FISA 702 and e-Evidence: three different legal bases

The CLOUD Act is only one of several routes by which authorities get at data.

FISA 702 governs surveillance of non-US persons outside the US by US intelligence agencies. It requires neither a judge's approval for each case nor any concrete suspicion of a crime, and providers aren't allowed to talk about the orders they receive. For confidential business communication, FISA 702 may matter even more than the CLOUD Act. The provision lapsed on June 12, 2026, but under the prevailing view, certifications already granted remain valid until March 2027. As of October 2026, Congress had not decided on a reauthorization.

e-Evidence: Since August 2026, the EU's e-Evidence Regulation has applied. It lets judicial authorities request electronic evidence order electronic evidence directly from service providers that offer services in the EU, via their designated establishment or legal representative in another member state. The idea behind the e-Evidence Regulation is close to the CLOUD Act's. The difference is the legal framework: European procedural rules and fundamental rights standards apply.

The overlooked layer: your work tool stack

Discussions of the CLOUD Act often focus on overarching infrastructure: AWS, Microsoft Azure, Google Cloud. But much of a company's knowledge sits one level up, in the applications their teams use every day. Many of them are backed by US companies. For example:

• Jira and Confluence: Atlassian Corporation, Delaware since 2022

• Slack: part of Salesforce

• GitHub: part of Microsoft

• Miro: RealtimeBoard Inc., governed by California law with venue in San Francisco

• Notion: Notion Labs, Inc.

• Asana: Asana, Inc., Delaware

• monday.com: Israeli company with a US subsidiary

That doesn't make these products inhertently insecure. It means their corporate structure belongs in the risk assessment.

A European storage location also doesn't always cover all of your data. Atlassian, for example, lets customers store certain product data in a chosen region, but user accounts, logs and analytics data, or data in transit may still be stored or processed outside that region. For project management tools that matters, because a ticket title often already contains a customer name or an internal project name.

Switzerland's cantonal data protection authorities have drawn a clear conclusion from this. In November 2025, privatim, the association of Swiss cantonal data protection authorities, declared that in most cases public bodies may not outsource particularly sensitive personal data, or data under a legal duty of secrecy, to SaaS solutions from large international providers, naming Microsoft 365 explicitly. It is only possible if the public body encrypts the data itself and the provider has no access to the key.

The data decides the urgency

Not every tool requires equal approaches when evaluating it. A Jira instance where marketing plans the next trade show has a different risk profile from one where engineering manages design data or source code. The data in a tool decides how quickly you should act.

Broadly, there are three categories:

• Personal data about customers or employees falls under the GDPR. It requires safeguards that match the risk, and much stricter ones for health data and other special categories. Tools holding this kind of data come first.

• Confidential business knowledge such as source code, design drawings or cost calculations is often especially valuable, even when it contains no personal data. It's just as urgent.

• Everyday work information such as task lists or schedules is less critical on its own and can follow later.

Confidential business knowledge is the category most often underestimated, because without personal data, the GDPR doesn't apply. Since September 2025, the EU Data Act has required cloud and other data processing providers to take measures against access by non-EU authorities to non-personal data held in the EU, where that access would conflict with EU or national law. Trade secrets, however, are only legally protected if companies take reasonable steps to keep them secret. Knowing where this information is stored and who can access it is part of that.

For planning a trade show, a data center in Frankfurt may do for a while. In the long run, though, the three categories are hard to keep apart in a work tool: the customer name ends up in a ticket title, a code snippet in a comment, the cost calculation in an attachment. The safest option is to move all your project data to a provider that isn't subject to US law. The type of data decides where you start. Our framework for migrating to sovereign alternatives shows how to plan that order.

How to audit your tool stack in four steps

The server location won't tell you whether a tool could fall under the CLOUD Act. These four steps give you a first overview.

1. What data is in the tool? Look beyond documents and attachments to ticket titles, comments and metadata. A sample from real projects tells you more than any product description.

2. Who is behind the provider? Find out which company you're signing the contract with and which group it belongs to. Is there a US parent, a US subsidiary or significant business in the US? The provider's legal notice, your contracts, the commercial register and annual reports will tell you.

3. Who runs the infrastructure? Cloud infrastructure, email delivery, analytics and connected AI models often come from third-party providers. The subprocessor list shows who actually handles your data. This is where most audits fall down: a provider can be based in Europe and host in Europe, and still use a US service for individual features.

4. Who holds the keys, and can you get out? Find out whether only your company can decrypt the data, or the provider can too. Also check whether you can export all of your data in open formats. Data sovereignty includes being able to leave a provider.

These four questions don't replace a legal review, but they show you where a closer look is worth it.

Banks, insurers and other financial companies also have DORA to consider. Since January 2025, it has required, among other things, a register of contracts with ICT providers and exit strategies for critical or important functions. If you're documenting this anyway, add each provider's legal jurisdiction as an extra column.

The fair objection: how big is the risk really?

It's easy to get the impression that US authorities can access any company's data whenever they like. It isn't that simple. In the second half of 2025, Microsoft disclosed content from three enterprise customers whose data was stored outside the US, one of them in the EU or EFTA. AWS says that since it began tracking this figure in 2020, it hasn't disclosed any enterprise or government content stored outside the US (AWS). And in 2022, a German higher regional court ruled that being part of a US group isn't, on its own, a reason to exclude a provider from a public tender.

So the risk is lower than the headlines suggest, especially for less sensitive data. But it's a risk you can't manage yourself: whether a request comes in, and whether your provider hands the data over, is out of your hands.

There are also good reasons not to rely on today's numbers. Providers report them themselves, and transparency reports show access by intelligence services only in part. The numbers can also rise quickly. Atlassian is one example: its figures from the start of this post show that disclosure orders already reach the tools teams use for everyday project work. The legal situation is shifting, too. FISA 702 lapsed in June 2026, and what happens next is up to the US Congress. And regulated companies have to assess and document even small risks, which is hard to do for a risk you can neither see nor influence.

On top of that, many companies are facing a decision anyway, for example because a contract is up for renewal or a vendor is changing its product. For Atlassian customers, for example, Data Center subscriptions for Jira and Confluence expire on March 28, 2029. If you have to move anyway, that's the moment to choose a provider outside US jurisdiction.

Where sovara stands

sovara is a European platform for project and knowledge work, the kind of work many teams do in Jira and Confluence today. Your contracting party is rready AG, based in Zurich, with no US parent company, no US branch and no business targeted at the US. By the criteria above, the CLOUD Act has no hook into rready.If you run sovara on premises, no US company is involved in hosting. On European infrastructure, the hosting itself runs without a US provider; the subprocessor list in our security pack shows every service involved.

Our Sovereignty Trust Center has the details on headquarters, hosting and certifications. You'll find the feature comparison in sovara vs. Jira and Confluence, and our definition of data sovereignty in our foundational post.

What to do next

When you introduce new software, the server location is usually settled quickly. Who can access the data is the harder question. You don't need to review your whole stack at once:

1. Get an overview: List the tools where your teams store project knowledge, including Marketplace apps and connected services.

2. Look at the data: Use real tickets, documents and comments to see whether they hold everyday information, personal data or confidential business knowledge.

3. Take a closer look at critical tools: For tools that hold sensitive data, find out who's behind the provider, who runs the infrastructure and who holds the keys.

4. Repeat regularly: Providers get acquired, move their legal domicile as Atlassian did in 2022, or add AI features such as Atlassian Rovo. Take a fresh look at every contract renewal, if not sooner.

The goal is to make a deliberate choice about which data you trust to which provider, and US software can still be part of that choice.

If Jira and Confluence stand out in your audit, our comparison of European alternatives is a good next read. And if the end of Data Center means you're facing a decision anyway, our migration decision framework for 2029 can help you plan it.

FAQ

Does a data center in the EU protect against the CLOUD Act?

Not automatically. What matters is which law the provider and its subprocessors are subject to. The server location alone doesn't give you full protection.

Does the GDPR apply to US companies?

Yes, for example when they offer services to people in the EU. But the GDPR doesn't override US law, which is why providers can end up with conflicting obligations.

What's the difference between the CLOUD Act, the Patriot Act and FISA 702?

The Patriot Act of 2001 expanded US surveillance powers after the September 11 attacks, and some of its provisions have since expired. FISA 702 lets US intelligence agencies monitor non-US persons outside the US (see above for its current status). The CLOUD Act governs the disclosure of data in criminal investigations, and content generally requires a judge's warrant.

Is Jira affected by the CLOUD Act?

Jira Cloud is. Atlassian has been a US company since 2022, which makes it subject to the US CLOUD Act. With Jira Data Center you run the infrastructure yourself, but the licenses expire on March 28, 2029.

Does encryption protect against the CLOUD Act?

Yes, as long as the provider has no access to the keys. Then it can't hand over content in plain text. Some metadata remains accessible, though.

Does the CLOUD Act apply to Swiss providers?

Being based in Switzerland doesn't automatically rule it out. As with EU providers, it depends on US subsidiaries, US business or US subprocessors. On the data protection side, Switzerland has an EU adequacy decision, so personal data can be transferred there from the EU without additional safeguards.