“Your data stays in Europe” sounds reassuring, but it’s only half the story. I’ll explain in plain terms what the CLOUD Act and the Schrems II ruling change, and how to keep your clients’ data under your own jurisdiction.
Plenty of US software vendors promise it: your data is hosted in Frankfurt, Dublin or Paris. That’s true. But the server’s location is only part of the answer. The other part is the country of the company that makes the software.
Let’s be upfront: for the team’s grocery list, it doesn’t matter. For the documents in your clients’ files, it’s worth ten minutes of reading.
The CLOUD Act, in plain terms
Passed in the United States in 2018, the CLOUD Act allows US authorities to require any company subject to US law to hand over the data it controls, wherever in the world that data is stored.
In practice, if your software is made by a US company, servers in Europe don’t change that rule. And you may not be told.
Schrems II: how Europe responded
In July 2020, the Court of Justice of the European Union struck down the Privacy Shield, the agreement that governed data transfers to the United States.
“The requirements of United States domestic law […] result in limitations on the protection of personal data which are not circumscribed in a way that satisfies requirements that are essentially equivalent to those required, under EU law.”
CJEU, Schrems II ruling, July 16, 2020, Case C-311/18
A new framework, the Data Privacy Framework, was adopted in 2023. It makes things simpler for many companies. Yet it’s still being challenged, just as its two predecessors were. Resting the protection of your sensitive files on it alone means accepting some uncertainty.
What this means for a professional firm
Lawyer, accountant, broker, healthcare practitioner: you almost always handle personal data, often sensitive data. If you entrust it to a US processor, the GDPR asks you to assess the transfer risk yourself and be able to justify it during an audit.
Your vendor’s contract documents their own compliance. Your assessment is yours to make. And that’s the document you’ll be asked for.
How to check that a vendor is truly European
- Check the legal notice. Is the company that makes the software registered in an EU country?
- Check who controls it. A European subsidiary of a US group can still be subject to US law.
- Check where the host is. A European host, independent from US groups, completes the answer.
How Client Vault keeps your data with you
Client Vault is a secure digital vault you install on your own WordPress site. It’s made by Sdravobiz, a European company. Most importantly, it stores nothing on the vendor’s side: your documents live on your server, with the host and in the country you choose.
- No transfer to the vendor: documents stay on your installation.
- Files encrypted with AES-256 the moment they arrive.
- A sealed activity log that timestamps every upload and every view.
- A ZIP export to hand a file back in a few clicks.
The result: your risk assessment becomes shorter and stronger. To choose your host, I compared OVH, Scaleway, Infomaniak and o2switch. And to reassure your clients, here are five ready-to-use answers.
Are you a WordPress agency?
Many of your clients don’t know that US software calls for an extra assessment. Offering them an installation on their own server, in their own branding, is useful advice and a billable service.
What Client Vault doesn’t do
Let’s be upfront. This isn’t about banning every US tool. For internal messaging or team notes, the risk is often low and the assessment simpler. The question really matters for your clients’ sensitive data.
Client Vault is also a plugin you own: your site needs updates and backups, ideally handled by a trusted agency.
Next step
Client Vault
Your clients’ data, under your jurisdiction
On a video call, we look at where your data lives today and I show you the vault installed on your own server.
- The vault from your client’s side
- Encryption and the activity log
- Exporting a file
- Your hosting questions
Frequently asked questions
What is the CLOUD Act?
A 2018 US law that allows US authorities to require a company subject to US law to hand over the data it controls, wherever that data is stored.
Is software hosted in Europe protected from the CLOUD Act?
Not necessarily. If the vendor is subject to US law, having servers in Europe isn’t enough.
What did the Schrems II ruling change?
In 2020, it struck down the Privacy Shield and asked European companies to assess the risk of each transfer to the United States themselves.
Does the Data Privacy Framework settle the question?
It simplifies transfers to certified companies, but it’s still being challenged. For sensitive data, keeping it under your own jurisdiction remains the most reassuring path.
Where is data stored with Client Vault?
On your own server, with the host and in the country of your choice. Nothing is stored with the vendor.
