The question we get most is simple: “if our data sits in an EU data center, aren’t we protected?” The short answer is no — not if the provider is subject to US law. The CLOUD Act is why, and it is systematically misunderstood in procurement across Europe.
What the CLOUD Act actually says
The Clarifying Lawful Overseas Use of Data Act of 2018 establishes one principle: a US provider must hand over data it controls, no matter where in the world that data is stored. A US parent company can be compelled to disclose data sitting on a server in Frankfurt, Stockholm or Dublin. Geography is irrelevant — jurisdiction over the company is what counts.
This doesn’t mean agencies vacuum up European servers daily. But the possibility exists, it is lawful in the US, and it cannot be contracted away by an EU subsidiary. That precision is what’s missing when “data stored in the EU” is presented as sovereignty.
A data center’s address tells you where the bits rest. It tells you nothing about who can demand them.
— from Kepler’s trust model
Four questions that decide real control
- Jurisdiction — which law binds the company running the cloud, all the way up the ownership chain?
- Ownership — who owns the hardware the data runs on?
- Control plane — is the software that governs the cloud open and auditable?
- Key custody — who can technically read the data, and under whose law do they sit?
If any answer points to a non-EU jurisdiction, a lever remains. The difference between weak and strong sovereignty is whether all four answers point the same way.
What actually protects you
Kepler is Swedish-owned and incorporated in the EU. We own our own servers in our own racks in Falkenberg, the control plane is OpenStack, and encryption keys are held in EU-based OpenBao. There is no US parent in the chain, and therefore no lawful path for the CLOUD Act to reach your data through us. That is not a badge on a landing page — it is a property you can verify in the product.
Want to see it in practice? Get started and generate a residency and access report for your account in minutes.