Limiting things to EU-region AWS might have worked on paper. But in practice there is a lot of conservativism in play. It's not just about doing the bare minimu

Limiting things to EU-region AWS might have worked on paper. But in practice there is a lot of conservativism in play. It's not just about doing the bare minimum to pass the certification audits. Some customers also demand detailed data-flow breakdowns, a manifest of data processing agreements and lengthy check lists to comply with their internal data protection policy. Combine that with with the CJEU toppling safe harbor, the Microsoft case, the snowden leaks etc. it's simply a lot easier to pass customer audits when you run on an exclusive EU-soil, EU-jurisdiction policy. And forward-looking it provides some certitude, i.e. we won't just pass the audits today, we're reasonably sure that if Privacy Shield falls too we'll still be fine. Basically, if you provide SaaS for corporate customers and handle their PII (HR records, occasionally some medical data attached) then the intersection of various demands ends up fairly restrictive.