Both laws reach a US-incorporated provider no matter where the servers sit. The CLOUD Act is the one EU buyers name in a vendor questionnaire, but it's the narrower threat: targeted, warrant-based, and challengeable. FISA Section 702 is the one that should worry a DPO more, because it's bulk, warrantless, and gives a European data subject no notice and no court to appeal to. A server in Frankfurt changes neither answer. Who holds the decryption keys does.
What does the CLOUD Act actually let the US do?
The Clarifying Lawful Overseas Use of Data Act, passed in 2018, amended the Stored Communications Act to settle a then-open question: can a US warrant reach data a US company stores abroad? The answer it wrote into law is yes. The test is control, not location. If a US-incorporated provider can technically retrieve the data — from a data centre in Falkenstein, Dublin, or anywhere else — a US court can compel it to.
What's easy to miss is how procedurally ordinary the CLOUD Act is. To get the content of communications, the Department of Justice still needs a warrant from a judge, backed by probable cause that a crime was committed and that the data is evidence of it. The provider can move to quash a request that conflicts with another country's law — that challenge mechanism is written into the statute. And it's individualized: a named account, a specific investigation. It looks, in shape, like the legal process most people picture when they imagine "the government asking for data."
That's why it's the lesser of the two threats to a European business storing ordinary files. There's a paper trail, and there's at least a path to push back.
Why is FISA 702 the bigger threat to EU data?
Because it has none of those brakes. Section 702 of the Foreign Intelligence Surveillance Act authorizes US intelligence agencies — principally the NSA, with the FBI querying the results — to collect the communications of non-US persons located outside the United States, directly from US providers. You, the European data subject, are the intended class. No individualized warrant. No notice. No US court where an EU citizen can file for redress.
The Court of Justice of the EU built its entire Schrems II judgment (Case C-311/18, July 2020) on exactly this. It struck down the Privacy Shield because FISA 702 and Executive Order 12333 permit collection that fails the EU's necessity-and-proportionality test, and because EU data subjects had no actionable remedy in the US under Article 47 of the Charter. The replacement — the EU-US Data Privacy Framework — survived its first court challenge in September 2025, when the General Court dismissed the Latombe case. But that decision is now under appeal before the CJEU, the same court that has already torn up two predecessor frameworks. Treating the DPF as settled law is a bet, not a fact.
FISA 702 itself isn't settled either. The 2024 Reforming Intelligence and Securing America Act reauthorized it for just two years — the shortest extension Congress has ever granted — pushing the sunset to April 20, 2026. RISAA also widened the definition of "electronic communication service provider" enough that civil-liberties groups warned it could rope in entities as mundane as a building's landlord with access to networking equipment. The direction of travel is wider, not narrower.
The two laws, side by side
| CLOUD Act (2018) | FISA Section 702 | |
|---|---|---|
| Purpose | Criminal investigations | Foreign intelligence |
| Target | A named account / specific case | Classes of non-US persons abroad |
| Legal threshold | Warrant, probable cause, judge | Annual program approval, no individual warrant |
| Are you told? | Sometimes (gag orders common) | No, never |
| Can you challenge it? | Provider can move to quash | No EU-subject redress (the Schrems II hole) |
| Who's exposed | Anyone a US provider holds data for | Non-US persons specifically |
The honest summary: the CLOUD Act is the warrant you might eventually hear about; FISA 702 is the collection you never will. For an EU citizen, the second is structurally worse, because the entire mechanism is designed around the fact that you are foreign and have no standing.
Why server location is a distraction
"Our data is stored in the EU" is the line you'll see on a hundred sales decks, and under both laws it's close to irrelevant. The CLOUD Act's control-not-location test was written precisely to defeat the "but it's on a German server" defense. FISA 702 reaches the US provider, not the disk. A service like Dropbox can host every byte in a European region and still be a US company that holds your encryption keys and can be compelled to hand over readable files. The same goes for the hyperscalers' "sovereign" EU tiers when the ultimate parent is American — the subsidiary stays reachable through the parent.
So the question that actually moves the needle isn't where. It's who can decrypt.
What holding only ciphertext changes
A legal demand can only compel a provider to produce what it has. If the provider holds your files in plaintext, or holds the keys to decrypt them, the answer to a CLOUD Act warrant or a FISA 702 directive is readable data. That's the default at most cloud providers, because they need to read your files to index, preview, and de-dupe them.
Zero-knowledge storage breaks that. With client-side encryption, your files are sealed with AES-256-GCM on your own device before they ever leave it. The key is derived from your passphrase with Argon2id and never transmitted. The provider stores ciphertext and nothing else. Compel that provider — by warrant, by 702 directive, by anything — and what it can hand over is an opaque blob it cannot open. The legal reach is unchanged; the payload is worthless.
I'll be precise about the limit, because this is where overclaiming starts. Zero-knowledge protects file contents. It does not erase metadata: a provider still sees account identifiers, file sizes, timestamps, and login IP addresses. Those can be compelled, and they can be revealing. A genuinely private design minimizes what it collects, but no honest provider should tell you the metadata problem disappears. It doesn't. What disappears is the readable content.
There's a jurisdictional layer too. Beebeeb is operated by a Dutch company, Initlabs B.V., with data in Falkenstein, Germany — outside US incorporation, so neither the CLOUD Act nor FISA 702 names us in the first place. But we don't lean on jurisdiction as the guarantee, because jurisdictions can be pressured and laws change. The guarantee is architectural: we can't be compelled to decrypt what we were never able to decrypt. Our product clients are open source, so that claim is checkable in the code rather than taken on faith.
If you want to test the architecture instead of the marketing,
Pick your provider on the law that actually applies. The CLOUD Act and FISA 702 both reach a US company wherever its servers live. The one variable left in your control is whether that company is holding your files, or holding noise.