2025: The sovereign cloud reality check
In 2025 Microsoft told French senators it cannot guarantee that EU customer data stays out of reach of US authorities. An EU data centre run by a US company does not take your data out of US jurisdiction; who owns the provider does.
By Xander Groesbeek, founder · Published January 2026 · Updated October 2026 · 6 min read
In brief
The issue. The US CLOUD Act lets US authorities compel US-based companies to hand over data, wherever it is stored. In 2025 Microsoft confirmed it cannot guarantee EU data stays out of reach, and the ICC prosecutor lost access to his Microsoft email after US sanctions.
What it means for you. "EU data centre", "European subsidiary" and "GDPR compliant" say where data sits, not who can be ordered to hand it over. If your email, documents or customer data run on a US-owned service, a foreign legal order or sanction can reach them.
What to do.
- List which of your services are owned by a US company, including the ones your vendors use.
- Start with what is most sensitive: email, documents and customer data.
- Plan migrations in steps, using open formats so you are not locked in again.
- of Europe's cloud market held by the three big US hyperscalers
- Nearly ⅔
- of 30,000 Schleswig-Holstein civil servants moved to open-source tools
- 24,000
Microsoft cannot guarantee EU data stays out of US reach
On 18 June 2025 Anton Carniaux, Microsoft France's director of public and legal affairs, was asked under oath by a French Senate inquiry whether he could guarantee that data on French citizens would not be passed to the US government without French approval. His answer: "I cannot guarantee that, but, again, it has never happened before." He added that Microsoft has committed contractually to resist unfounded requests.
The answer follows from the law. The CLOUD Act of 2018 allows US authorities to compel US-based technology companies to provide data, regardless of where it is stored. A European data centre or subsidiary does not change who the parent company must obey. The European Parliament's 2025 study on software dependencies puts it plainly: "Storing data locally does not guarantee immunity from extraterritorial requests."
Who acted in 2025
Public bodies and a large manufacturer moved from concern to action. The three cases below are the ones most cited.
The International Criminal Court moves to openDesk
In November 2025 the ICC announced it is replacing its Microsoft office software with openDesk, an open-source office and collaboration suite delivered by the German Centre for Digital Sovereignty (ZenDiS).
The move followed an incident earlier that year. After a US executive order sanctioned ICC prosecutor Karim Khan, he was temporarily locked out of his Outlook email account; Associated Press reported it in May 2025. As the European Parliament study notes, US sanctions law made it illegal for a US company to provide services to a sanctioned person, so Microsoft had no legal choice but to block his access. The point for any business: a US provider's service can be withdrawn by a decision you have no part in.
Airbus tenders a sovereign European cloud
In December 2025 Airbus said it will move core on-premises systems, including ERP, manufacturing execution, CRM and product lifecycle management, to a sovereign European cloud. The contract is reportedly worth more than €50 million over up to ten years. Catherine Jestin, Airbus's executive vice president of digital: "I need a sovereign cloud because part of the information is extremely sensitive from a national and European perspective."
Schleswig-Holstein moves its civil service
The German state of Schleswig-Holstein began replacing Microsoft products in March 2024. By December 2025 it had moved 24,000 of its 30,000 civil servants to LibreOffice, Nextcloud, Open-Xchange and Thunderbird.
Sovereignty-washing: what the marketing claims leave out
The big three US hyperscalers hold nearly two-thirds of Europe's cloud market, and they now sell "sovereign" versions of their services. These offerings can still fall under the CLOUD Act and FISA Section 702. Read the claims for what they say.
| Marketing claim | What it does not cover |
|---|---|
| "EU data centres" | Physical location does not override the CLOUD Act |
| "European subsidiary" | The US parent company remains subject to US law |
| "Data residency guarantee" | Residency is where data sits, not who can be ordered to hand it over |
| "GDPR compliant" | GDPR compliance does not prevent US legal access |
| "Encrypted at rest" | If the provider holds the keys, it can be compelled to decrypt |
What sovereign infrastructure requires
Sovereignty depends on who owns and controls the provider, and on every provider behind it.
| Sovereign | Not sovereign, whatever the marketing says |
|---|---|
| EU-incorporated company, no US parent or owner | EU subsidiary of a US parent |
| Processing and storage in the EU | US company with EU data centres |
| European providers along the chain (hosting, storage, payments) | "European cloud" running on AWS, Azure or Google Cloud |
| Keys under your or an EU provider's control | Encryption where a US provider holds the keys |
| EU legal jurisdiction for disputes | Contractual promises that US law can override |
European alternatives by category
For most needs a European or self-hosted option exists. A starting list:
| Category | Options |
|---|---|
| Cloud infrastructure | OVHcloud (France), Hetzner (Germany), Scaleway (France), Ionos (Germany) |
| Collaboration and office | openDesk (German public sector), Nextcloud (self-hosted), Open-Xchange (email and groupware), CryptPad (encrypted documents) |
| Communication | Proton Mail (Switzerland), Tuta (Germany), Element/Matrix (decentralised messaging) |
The European tech stack in 2026 goes layer by layer, from hosting to payments to monitoring.
What this means for your business
Sovereignty is now a continuity question as well as a compliance one. Ask four questions of every critical service:
| Risk | Question |
|---|---|
| Continuity | Could a foreign government decision switch this service off for you? |
| Data access | Can the provider be compelled to hand over your data without telling you? |
| Dependency | How quickly could you move if the service became unavailable? |
| Supply chain | Do your "European" vendors run on US infrastructure themselves? |
The path forward: audit, prioritise, migrate in steps
This does not mean replacing everything at once.
- Audit your stack: map which services are under US jurisdiction. StackCheck scans a domain for you.
- Prioritise by sensitivity: start with email, documents and customer data.
- Evaluate alternatives for those first.
- Plan migration paths with portable formats and open standards.
- Document decisions: GDPR asks you to show appropriate safeguards.
How EmailConnect fits
If email automation is on your list, this is where EmailConnect stands. Each item links to the page behind it.
- A Dutch company. Registered with the Kamer van Koophandel in Amsterdam. Company details →
- Processed in the EU. The application, database and mail server run at Hetzner in Germany; optional attachment storage and backups at Scaleway in France and the Netherlands. No US company is in the processing chain, apart from optional sign-in with Google or GitHub. Sub-processors →
- No access to your mailbox. You send or forward mail to addresses we run; we never hold a password or token for your mailbox. Privacy promise →
- Email content exists only as long as you choose: one hour on Free and Maker, 24 hours by default on Business and Platform. Data retention →
All answers for your security review: trust center →
Sources and further reading
- Microsoft admits it 'cannot guarantee' data sovereignty — The Register
- Europe gets serious about cutting US digital umbilical cord — The Register
- Airbus to migrate critical apps to a sovereign Euro cloud — The Register
- European Software and Cyber Dependencies — European Parliament study
- The European Cloud Situation at the end of 2025 — Bert Hubert
- Europe Tried to Take Control of Its Digital Stack in 2025 — TechPolicy.Press
- Digital Sovereignty in 2025: Why It Matters for European Enterprises — Wire
Related
The European tech stack in 2026
European alternatives at every layer, from hosting to payments to monitoring.
StackCheck: data sovereignty scanner
Scan a website to see where its data flows, beyond the marketing claims.
The hidden GDPR trap
Why server location alone does not make a service compliant.
Trust center
Where your email is, who can access it and how long it is kept.
Questions about digital sovereignty or your infrastructure? Get in touch, no sales pitch.