A German map pin is not sovereignty
"Made in Europe" is the easiest claim in cloud storage to make and the hardest to verify. A US company opens a Frankfurt region, drops a German flag on the pricing page, and calls it European. The bytes do sit in Europe. The legal control over them does not. Two different questions, and most marketing pages blur them on purpose.
Here is the line that matters. Residency is where your data physically lives. Sovereignty is who can be legally compelled to hand it over. A map pin answers the first and says nothing about the second, because the second is decided by corporate ownership, not geography.
Why the parent company is the whole game
If a provider's ultimate parent is a US corporation, the US CLOUD Act reaches its data no matter where the servers sit. That is not hypothetical. On 18 June 2025, Microsoft France's director of public and legal affairs, Anton Carniaux, was asked under oath before a French Senate inquiry whether he could guarantee that French public-sector data in Microsoft's cloud would never be handed to US authorities. His answer: "Non, je ne peux pas le garantir." No, I cannot guarantee that — adding only that it had never happened yet. An EU data boundary does not change who holds the keys to the boundary.
The institutions are catching up to what engineers already knew. On 27 May 2026 the European Commission presented its Tech Sovereignty Package, which openly contemplates restricting AWS, Azure, and Google Cloud from processing the most sensitive public-sector data — healthcare, finance, justice — across all 27 member states. A sovereign-cloud label on a US-owned region is a residency promise wearing a sovereignty costume.
The five questions
If you are working out whether a provider is genuinely European or US-owned with a European address, these five questions sort it. Each is answerable from public information. A provider that dodges any of them has answered it anyway.
1. Who ultimately owns the company?
Trace the corporate tree to the top — not the local sales entity, the ultimate parent. A "GmbH" subsidiary of a Delaware corporation is subject to US law. Beebeeb is operated by Initlabs B.V., incorporated in the Netherlands (KvK 95157565), with no US parent and no US-owned holding company above it. If you cannot find a provider's ultimate parent in five minutes, that is the finding, not an inconvenience.
2. Under which jurisdiction can it be compelled?
The CLOUD Act binds US persons. A European-incorporated company with no US presence cannot be served one, because jurisdiction follows incorporation and operational footprint, not the address on the data center. Ask the concrete version: if a US court issued a secret production order tomorrow, would this company be legally obligated to comply? For a Dutch company operating only in Europe, the honest answer is no.
3. Where do the encryption keys actually live?
This is the question that makes the other four nearly moot. If the provider holds the keys, jurisdiction decides who can read your files. If you hold the keys and the provider mathematically cannot, jurisdiction barely matters, because a court order can only ever produce ciphertext nobody can decrypt. Most mainstream providers hold the keys by default. Dropbox's standard storage is not zero-knowledge: files are AES-256 encrypted at rest, but Dropbox retains the keys, with end-to-end encryption offered only as an add-on for paid team folders. Beebeeb is zero-knowledge on every tier, including the free one. Your passphrase derives your keys on your device with Argon2id (256 MB, 4 iterations), and the master key is wrapped with AES-256-GCM. The server stores ciphertext and never sees a key. The full key derivation chain and threat model live on our security page.
4. Who are the sub-processors, and are they published?
Under GDPR Article 28, a processor must disclose its sub-processors and let you object to new ones. This is where "made in Europe" quietly leaks. A provider can be European on paper while routing analytics through a US adtech firm, support tickets through a US helpdesk, email through a US sender. Each is a sub-processor and a separate CLOUD Act surface. A genuinely European provider keeps the list short and publishes it. Ask for it. If the support desk itself runs on a US platform, the "European" claim has a hole.
5. Can you verify the claims, or only trust them?
Marketing is a claim; source code is evidence. If the encryption is open source, anyone can confirm that keys are derived client-side and the server genuinely cannot read files — you are not taking a brochure's word for it. Beebeeb's product clients are open source: the web app, the CLI, the core crypto library, and the mobile and desktop clients. The server and this site are private, and we say so rather than letting "open source" imply more than it covers. An independent security audit is planned, and the findings will be published in full, including whatever we would rather they did not say.
What the checklist disqualifies
Run a hyperscaler through these and it fails at question one. AWS, Azure, and Google Cloud are US companies; an EU region changes residency, not ownership. iCloud is US-owned and not zero-knowledge for most data by default. Dropbox and Google Drive are US-owned and hold your keys. None of these are bad products, and several do things Beebeeb does not yet do — iCloud is cheaper at small tiers and tightly woven into Apple's devices, Dropbox's collaboration is mature. But "made in Europe" is a claim about legal exposure, and on that one axis a US parent settles it.
European-incorporated providers that hold your keys pass the first two questions and stall at the third. They are out of CLOUD Act reach yet still technically able to read your files, so a European court order or a breach still exposes plaintext. That is a real improvement over a hyperscaler. It is also an incomplete answer to the question the checklist is really asking: can anyone other than you read this?
The honest version
"Made in Europe" should mean a European company, under European jurisdiction, no US parent, a short and published sub-processor list, keys that live on your device, and code you can read. Not a flag on a pricing page. Beebeeb stores data on dedicated servers in Falkenstein, Germany, runs on a Dutch B.V. with no US ownership, and is zero-knowledge by architecture, not by policy.