No. A German subsidiary of a US company does not escape US jurisdiction. The AWS European Sovereign Cloud is run by AWS European Sovereign Cloud GmbH, a German legal entity staffed by EU residents — but Amazon.com Inc. is still the parent. Under the CLOUD Act, a US court can compel that parent to produce data its subsidiary controls, wherever the bytes physically sit. Architecture narrows the exposure. It does not sever it.
What AWS and Microsoft actually built
Credit where it's due: the engineering is real and it was expensive. AWS opened the European Sovereign Cloud to general availability on January 15, 2026, with its first region in Brandenburg, Germany, backed by a €7.8 billion commitment. The region is physically and logically separate from AWS's other infrastructure, operated exclusively by EU-resident staff, under a German parent company with an EU-citizen managing director (Stéphane Israël, hired October 2025). Microsoft's EU Data Boundary runs a parallel play: keep customer data, including AI processing, inside European data centers, with tooling that shrinks the cases where data or support access leaves the bloc.
This is not theater. It defeats casual data flows and satisfies a large share of GDPR data-residency requirements. If your question is "does my data live in Europe and get handled by Europeans most of the time," the answer is now genuinely yes. But "stored in Europe" was never the hard question.
Can a US-parent subsidiary refuse a CLOUD Act demand?
It cannot, and the most honest source on that is AWS itself. The CLOUD Act reaches any provider subject to US jurisdiction for data in its "possession, custody, or control." The operative word is control — not physical possession. A 2025 University of Cologne legal opinion, commissioned by Germany's Federal Interior Ministry to test exactly these structures, concluded that a US parent's ultimate control over a subsidiary is enough to pull the subsidiary's data inside the CLOUD Act's reach. A US court can serve Amazon.com Inc. for data held in the European Sovereign Cloud, and the German GmbH's operational independence does not dissolve the parent's statutory duty to comply.
Read AWS's own commitment language closely. AWS pledges to redirect a requesting government to the customer, to notify the customer, and to use "all legally valid efforts to challenge" a request that conflicts with EU law. Those verbs are real and worth having. None of them is refuse. Challenging a demand in court is not the same as being structurally unable to satisfy it, and a challenge can be lost — which is a different thing from a subsidiary that, by corporate structure, simply cannot be compelled. That second thing is not what got built.
Asked at a French Senate hearing on June 10, 2025, whether he could guarantee under oath that French citizens' data would never reach US authorities, Microsoft France's legal counsel Anton Carniaux answered plainly: "No, I cannot guarantee that."
That answer came not from a critic but from the vendor, under questioning, about its own EU offering. When the company selling you sovereignty tells a legislature it can't guarantee the one thing the word is supposed to mean, the marketing and the reality have visibly come apart.
Why FISA 702 makes location almost irrelevant
The CLOUD Act is the demand most buyers fixate on. Section 702 of FISA is the quieter, broader one: it authorizes compelled assistance from US "electronic communication service providers" for foreign-intelligence collection, and the 2024 RISAA reauthorization widened who counts as one. A 702 directive does not care which Brandenburg rack your bytes live on; it attaches to the provider, not the address. And because 702 orders are classified, the public "we'll challenge it" promise is functionally unavailable.
FISA 702 is currently set to sunset on April 20, 2026 absent reauthorization, but betting your data-protection posture on Congress letting a surveillance authority lapse is not a strategy. The structural point survives the date either way: if the entity holding your keys is reachable by US compelled-assistance law, the country printed on the data-center sign is a second-order detail.
The fix architecture can't buy: keys the provider never holds
Here is the line a German subsidiary cannot cross. AWS and Azure can encrypt your data, and in most configurations they hold, or can recover, the keys. A demand that compels the provider to produce data is only useful if the provider can decrypt it. So the question that actually decides exposure is not "where is the data" or "who runs the building." It is "who holds the keys." If the provider holds them, jurisdiction over the provider is jurisdiction over your plaintext — German GmbH or not. The only structural escape is for the provider to never hold a usable key, and no amount of sovereign-tier restructuring can manufacture that, because it is a cryptographic fact, not a legal one.
That is the model we build at Beebeeb. Files are encrypted client-side with AES-256-GCM; your master key is derived from your passphrase with Argon2id tuned to 256 MiB of memory; sharing uses X25519 key agreement; login runs on OPAQUE so the server never sees your password; recovery is a BIP39 phrase only you hold, and keys are zeroized from memory after use. Our servers in Falkenstein, Germany store ciphertext we cannot read. A subpoena to us produces encrypted blobs and nothing to decrypt them with — not because of a policy we could be ordered to break, but because the key never reached us. Beebeeb is operated by Initlabs B.V., a Dutch company under EU and Dutch law. An independent audit is planned and the findings will be published; until then, the architecture is the claim, and our product clients are open source so you can check it.
So is the hyperscaler sovereign tier worth it?
For plenty of buyers, genuinely yes. If your threat model is GDPR data-residency, cutting US operational access, and showing a regulator that data sits in Europe under European staff, AWS European Sovereign Cloud and Azure's EU Data Boundary clear that bar and bring the full hyperscaler service catalog with them. But if your threat model includes the US government itself — a CLOUD Act warrant, a classified 702 directive, the scenario Carniaux declined to rule out — a US-parent subsidiary does not protect you, because both the parent and the keys are reachable. The hyperscalers aren't unique; Apple's iCloud has the same shape, where strong encryption exists but the default isn't zero-knowledge and Apple is a US company under the same law.
| Question that decides exposure | Hyperscaler sovereign tier | Zero-knowledge provider |
|---|---|---|
| Parent reachable by CLOUD Act / 702? | Yes — US parent | No — Dutch company |
| Provider holds your keys? | Usually yes | No — keys never leave your device |
| Subpoena yields plaintext? | Possible | Ciphertext only |
Sovereign-by-architecture and sovereign-by-jurisdiction are different products. The €7.8 billion buys the first. If you need the second, you need a provider that isn't a US company and holds no key it could be forced to surrender. Beebeeb's encryption is zero-knowledge on every tier, no exceptions, if you want to test the claim against your own files before trusting it with anything that matters.