10 ms·

EU data regions are a reflexive action by companies that try to hold on to their EU customers (and more and more are leaving, surprisingly the larger ones seem

EU data regions are a reflexive action by companies that try to hold on to their EU customers (and more and more are leaving, surprisingly the larger ones seem to be leading here). Realize that as long as you are still hosted on US owned infrastructure or that if there are US (or: five-eyes) owned companies anywhere in the stack your data can still be forcibly pulled and often without you being aware that this happened. There are only very few such stacks that are 100% owned by EU entities.

selectively 2mo ago
[dead]
V__ 2mo ago
For anyone curious, it's the CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act
- samudrijan 2mo ago
  The point of control is Congress, until we stop electing corpratist politicians, we will continue to get bad legislation.
  - redserk 2mo ago
    It doesn't matter if it's Congress. At the end of the day America's internal governance systems are America's problem. The rest of the world should not care if a certain branch is causing issues, and frankly, is starting to come to that conclusion. It's unfortunate for us, but we very rarely isolate individual government systems for other nations.
- braiamp 2mo ago
  Which wouldn't matter where the data is located, so I don't think that this is the reason Fastmail is doing it, because a savvy enough company would know that the problem is that the company is US based.
  - kid64 2mo ago
    They're Australian
    - petcat 2mo ago
      Australian companies are also subject to the USA Cloud Act. As is the UK, with Canada coming on board soon too. Even the entire EU is in the process of negotiating the same agreement. https://www.justice.gov/archives/opa/pr/united-states-and-canada-welcome-negotiations-cloud-act-agreement https://www.justice.gov/archives/opa/pr/united-states-and-ca... https://www.justice.gov/archives/opa/pr/justice-department-and-european-commission-announces-resumption-us-and-eu-negotiations https://www.justice.gov/archives/opa/pr/justice-department-a...
      - yborg 2mo ago
        Your linked information doesn't indicate anywhere that Australia or any other foreign government is subject to US law. The latter states that negotiation with the EU on this topic was suspended in 2019. Things have changed. With Chinese law in regards to data within Chinese jurisdiction a long-standing thing and an unfriendly American government potentially in power for an extended period, other countries are realizing the importance of data sovereignty.
        petcat 2mo ago
        https://www.justice.gov/criminal/criminal-oia/cloud-act-agreement-between-governments-us-and-australia https://www.justice.gov/criminal/criminal-oia/cloud-act-agre... > The latter states that negotiation with the EU on this topic was suspended in 2019. Dated 2023: > Justice Department and European Commission Announces Resumption of U.S. and EU Negotiations on Electronic Evidence in Criminal Investigations The negotiations are still ongoing. Canada is further along than the EU.
- tzs 2mo ago
  It's weird how everyone focuses on that part of the CLOUD Act. The CLOUD Act actually did two things: (1) that, and (2) provided an expedited way for the US to enter into Mutual Legal Assistance Treaties (MLATs) with other countries. It was the MLAT thing that the various civil liberties groups object to (I'll cover the problems with those down below). There was very little objection to the first part. The first part was not controversial because pretty much every country has something equivalent (for reasons I'll cover below), as did the US except specifically in the case of data covered by the SCA due to poor drafting. One of the big reasons for the SCA was created was the emerging "third party doctrine" meant that instead of having to get a warrant or subpoena against you to get your data they could simply subpoena it from any of your service providers that had it. The SCA made it so the third party doctrine subpoenas would not apply to stored communications. There were still cases where the government would need to compel the service provider to turn over the data. They wanted something with the probable cause requirements of a warrant but the delivery method of a subpoena. (A subpoena asks someone who controls the data to turn a copy over. A warrant is for when the government wants to raid the data center and seize the data. Since that involves the government directly acting where the data is located it only applies to someplace where they have jurisdiction). So they created a new thing, the SCA warrant. The called it a "warrant" because it had the probable cause requirements of a warrant, but neglected to add something saying that in other respects it functions like a subpoena. I'll call this a pseudo-warrant. The SCA was not the first pseudo-warrant. That would be the warrants under the Wiretap Act of 1968. Territoriality questions did not arise under that because by its nature the data it sought copies of was always in the US. With the SCA the data might not necessarily be in the US. Years later Microsoft argued that because it is a "warrant" it should have the territorial restrictions that normal warrants have. The CLOUD Act clarified that it was indeed supposed to be like a subpoena as far as territoriality goes. There have been some more pseudo-warrants created since then, but their drafters learned from the SCA and made sure the original legislation was clear on just what they were. The reason pretty much every country has something like that, going back well before online documents, is because not having such a thing leads to big problems. If anyone in the country could shield documents from subpoenas (or whatever the equivalent is called in that country) by merely storing them across a border every company with documents that it needs to keep but that might be incriminating later would get sent to a storage facility across a border as soon as they were no longer actively using them. For example as soon as a car company in Detroit releases a new car all the documents where during development engineers brought up safety concerns which management decided to not address would be sent across the bridge to a storage facility in Canada. With electronic documents it is even easier. You would not have to wait until you aren't actively using the documents to stick them outside the country. Just stick your file server across a border and make sure you only have copies in country when someone is actively reading or editing them. And so pretty much everywhere subpoenas compel someone in the country who controls the documents to fetch them (or copies) and turn them over. The actual location of the documents is completely irrelevant. The thing that was worrying about the CLOUD Act was the MLAT provisions. MLATs are treaties where the participating countries agree on law enforcement. They include things like sharing information and cooperating on investigations. Normally these are enacted just like any other treaty. The executive branch negotiates them and then the Senate votes on ratification. The CLOUD Act adds an expedited process where the Attorney General and the Secretary of State can sign an MLAT. Congress is not involved. These agreements allow foreign law enforcement to make requests directly to US service providers instead of going through the diplomatic channels normal MLAT requests go through, and they allow them access to stored communications that the SCA would normally block. There are some safeguards. The foreign government is not supposed to intentionally target US people who are in the US and are not not supposed to use the data they get to infringe freedom of expression. There's also a 180 day window before these executive MLATs take effect during which Congress can block them by passing a joint resolution to do so. Civil rights groups and many others were not impressed with those safeguards.
mrtesthah 2mo ago
Ok, but Fastmail is an Australian company based in Melbourne.
- OJFord 2mo ago
  But whose cloud infrastructure do they use? (I don't know, but it might likely be AWS, GCP, or Azure.)
  - microtonal 2mo ago
    That it described in the linked post: We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers.
  - calvinmorrison 2mo ago
    None. It's racked and stacked old school
- toomuchtodo 2mo ago
  As a FastMail customer who spends a portion of the year in the US, I am happy to pay to move my data to the EU region, even if they cannot yet fully guarantee all my data will remain outside of US access at this time. Defense and mitigations in depth, over time. We must always start somewhere, and perfect is never the target (as it does not exist).
  - tmgldn 2mo ago
    Agree - small steps always positive here
- petcat 2mo ago
  Australia and the US entered into a bilateral agreement in 2024 which made Australian companies subject to the US CLOUD Act. https://www.justice.gov/criminal/criminal-oia/cloud-act-agreement-between-governments-us-and-australia https://www.justice.gov/criminal/criminal-oia/cloud-act-agre...
ffsm8 2mo ago
> your data can still be forcibly pulled and often without you being aware that this happened as a german i feel the urge to point out that this technically also applies to european companies... With more hurdles for the US, but still technically applicable
- usernomdeguerre 2mo ago
  True, I think the calculus is more about who you think is more trustworthy than what tools they have to damage you.
- slow_typist 2mo ago
  Especially if European companies have an office and significant share of customers in the US.
- jacquesm 2mo ago
  That's true but the EU still has a - mostly - functioning legal system. See 'Schrems' and other lawsuits that came out as they should have.
  - perks_12 2mo ago
    Take a look at how they play with regards to chat control. The EU is just the same corrupt BS like D.C., only with a lot more virtue signaling.
    - jacquesm 2mo ago
      Sorry, I don't agree with that. The amount of corruption in the USA right now is simply off the scale.
      - sneak 2mo ago
        Nah, it’s just more visible. It’s not that much of a sea change. And it’s ridiculously naive to pretend that the major countries in Europe don’t have their own mechanisms to regularly and effectively bypass any democratic inconveniences when necessary. They regularly push through things that no constituent would ever want or vote for.
amelius 2mo ago
How does Apple handle it?
- xnickb 2mo ago
  Why would apple care? Eu is what a quarter of their business? And where exactly will those people move? They're locked into the Apple infra.
  - askonomm 2mo ago
    Fastmail has very nice email sync for iCloud that I use :)
rufasterisco 2mo ago
Can you point me towards some resources that show EU customers moving? Not that I don’t trust the statement, I just would like to know more.
- jacquesm 2mo ago
  I hope Airbus is large enough for you? https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cloud https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cl... And many others besides, pretty much every company I've looked at in the last year is either acutely aware of the problem or they are already executing on it. With Trump and his merry band of criminals repeatedly stating they're going to take Greenland by force you can't blame them either, that would effectively put the EU on a war footing with the United States (I still can't believe I'm writing this sort of thing and it is not entirely fiction), the end result of that would be that there would be an absolute run on EU hosted capacity. They're just trying to beat the rush and hope they'll never be proven to be right.
  - rufasterisco 2mo ago
    Tnx!
  - mlrtime 2mo ago
    "This is not Airbus abandoning US big tech. It will keep AWS for its Skywise aviation-data platform and a customer-support tool. It also still runs Microsoft and Google productivity suites, plus Salesforce, Coupa and Workday."
- toomuchtodo 2mo ago
  HN Search: airbus critical apps scaleway - https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=airbus%20scaleway&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Gov.uk has replaced Stripe with Dutch provider Adyen - https://news.ycombinator.com/item?id=48415217 https://news.ycombinator.com/item?id=48415217 - June 2026 (235 comments) Netherlands reaches deal with European cloud company to decrease U.S. tech reliance - https://nltimes.nl/2026/04/24/netherlands-reaches-deal-european-cloud-company-decrease-us-tech-reliance https://nltimes.nl/2026/04/24/netherlands-reaches-deal-europ... - April 24th, 2026 Wary of US Big Tech, the EU looks to build its “EuroStack” - https://sherwood.news/world/wary-of-us-big-tech-the-eu-looks-to-build-its-eurostack/ https://sherwood.news/world/wary-of-us-big-tech-the-eu-looks... - March 18th, 2026 Why European Companies Are Leaving US Cloud Providers in 2026 — And Where They're Going - https://massivegrid.com/blog/european-companies-leaving-us-cloud/ https://massivegrid.com/blog/european-companies-leaving-us-c... - March 12th, 2026 Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech - https://www.theregister.com/off-prem/2025/12/22/europe-gets-serious-about-cutting-us-digital-umbilical-cord/2654348 https://www.theregister.com/off-prem/2025/12/22/europe-gets-... - December 22nd, 2025 Schleswig-Holstein waves auf Wiedersehen to Microsoft stack - https://www.theregister.com/software/2025/10/15/schleswig-holstein-waves-auf-wiedersehen-to-microsoft-stack/1543638 https://www.theregister.com/software/2025/10/15/schleswig-ho... - October 15th, 2025 EU Banks Launch Wero Payments to Dislodge Visa, Mastercard - https://news.ycombinator.com/item?id=41666833 https://news.ycombinator.com/item?id=41666833 - September 2024 (88 comments) https://european-alternatives.eu/ https://european-alternatives.eu/ https://euro-stack.com/ https://euro-stack.com/
atmosx 2mo ago
That’s true and Fastmail runs on AWS. But it’s a start and a “feature” many have requested for years. It’s funny because the HQ and I believe their workforce is located in Australia.
- chrismorgan 2mo ago
  Fastmail has never used AWS, and this article is pretty clear about how they have always used their own hardware and traditional colocation. Fastmail used to be based in Melbourne only, but after the Pobox merger it ended up with an office in Philadelphia too. No idea how the balance of things is between the offices now.
  - atmosx 2mo ago
    That’s interesting, I thought they were hosted on AWS. Thanks for sharing.
- calvinmorrison 2mo ago
  Fastmail runs on its own infra.
- preisschild 2mo ago
  But how is it actually "a start" or improves anything at all? It doesnt matter where the "physical location" of the data is. It matters who has access to it.
- jph00 2mo ago
  Not only is that not true, but in fact FastMail predates AWS by some years. Source: I founded FastMail.
  - jph 2mo ago
    Great username :-) I'm a happy longtime Fastmail customer and I'm migrating to the new EU area.
- deleted 2mo ago
  [deleted]
microtonal 2mo ago
Yeah, this does absolutely not solve the CLOUD Act issues. However, it is good to look at what the ramifications of the CLOUD Act is for e-mail: - The US could request your data. You probably shouldn't use e-mail for anything sensitive anyway for many reasons. E-Mail was traditionally not encrypted and I think that many servers still allow plain-text communication. The protocols are old and there are all kinds of downgrade attacks. Aside from that, even if your service does not fall under the CLOUD Act, you are probably f*cked anyway, because most people you communicate with are using services that fall under the CLOUD Act. - The US can force the provider to block your account. The workarounds are: regularly backup your e-mail (easy for services that offer IMAP) and, most importantly, use a domain with an extension that is not under the control of a US (or probably five eyes) registrar. Use an E2E-encrypted messenger with perfect forward secrecy, etc. for most personal communication.
- 1over137 2mo ago
  Something like 99% of email is now done over TLS.
  - SoftTalker 2mo ago
    Yes but it will almost always work with self signed or expired certificates, or downgrades to clear text if that's what it takes to deliver the message.
    - inigyou 2mo ago
      I thought a few years ago Gmail started demanding TLS so now any mail server that anyone cares about supports TLS.
      - SoftTalker 2mo ago
        I had a mail server running with a LetsEncrypt cert. I never set up the cron job to renew it, and months later realized that the certificate had expired. Gmail never glitched sending mail to my server. This was some time in 2025, so not too long ago.
calvinmorrison 2mo ago
Fastmail is an Australian company
- gib444 2mo ago
  And hosted on US infrastructure, satisfying the "or" clause in their post
  - sodapopcan 2mo ago
    The article says they installed their own servers, though. What am I missing here?
kisamoto 2mo ago
Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with their US data center. Would their EU servers be vulnerable to the CLOUD Act?
- jacquesm 2mo ago
  Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.
  - yread 2mo ago
    I dont share your optimism: The US can just say: let us access this one customer or we will ruin your vpcs in the US. What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot? Im just happy my business is not important enough
    - kazen44 2mo ago
      the alternative being hetzner giving away EU based information to the US? which would absolutely destroy their reputation in the EU. (which is a far larger market for them). The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.
      - jacquesm 2mo ago
        Let me tell you about that time when I walked around in a DC in NL and ran into an unaccompanied FBI liaison officer... I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.
    - 2mo ago
DarrenDev 2mo ago
EU sovereign clouds are taking off right now - especially when it comes to sensitive data (government, healthcare, etc.). Lots of players moving into the space. The common denominator - nothing touches the US. AWS, Azure, GCP, Oracle, Schwarz Digits, SAP
- jacquesm 2mo ago
  You can strike at least four of those.
- easton 2mo ago
  Requiring that you believe those companies that they won’t hand the keys over to the US at the first ask. Like, the critical problem with the AWS sovereign pitch is that you must believe that they won’t give the keys to the US, and they also won’t give the source code that’s hosted in the US to the government either for them to find vulnerabilities in. I don’t know if that’s good enough unless you just need the data to stay in the EU and you don’t care if another country sees it. I know they probably did some work on it (what if primary AWS goes rogue and the EU entity must work without it) but I don’t know if they explained how they’re safe to the public.
  - jacquesm 2mo ago
    The harder problem here is that any real EU sovereign platform would have to come with ironclad guarantees that it isn't going to be directly or indirectly sold to a US party. And when enough customers move that marketshare is affected the bags with money tempting shareholders will get larger and larger.
    - rufasterisco 2mo ago
      Isn’t that counterbalanced by the fact that the reason they exist in the first place is to be a sovereign platform? I am assuming the reason companies switch to them is not price or tech. US cloud providers have the advantage on both. Selling EU companies data would mean destroying trust over their main selling point, not to mention incur on EU wrath. Feels like living one whistleblower away from doom. I refer to fully EU clouds, parent list includes US clouds that do not need bags of money, Clouds Act in enough.
BrandoElFollito 2mo ago
The French head of Microsoft ctor not, under oath, say that Microsoft can guarantee sovereignty. This is the evidence that until you have a EU company, under EU rules and not present in the US at all, you cannot have sovereignty.
realo 2mo ago
pCloud is an example. Swiss corporation with data centers in Luxembourg.
thisislife2 2mo ago
True. Australia is part of the Five Eyes alliance. Fastmail is an Australian company. Australia also has the Assistance and Access Act - https://havenmessenger.com/blog/posts/australia-assistance-access-act/ https://havenmessenger.com/blog/posts/australia-assistance-a... - which just stops shy of asking Australian tech companies, like Fastmail, to build backdoors into their products so that the government can "legally access" data from them. (When the law passed, Fastmail lost many clients - https://www.itnews.com.au/news/fastmail-loses-customers-faces-calls-to-move-over-anti-encryption-laws-519783 https://www.itnews.com.au/news/fastmail-loses-customers-face... ).
- jeffparsons 2mo ago
  > just stops shy of asking Australian tech companies, like Fastmail, to build backdoors into their products so that the government can "legally access" data from them It stops just short of saying that you must do thispreemptively, but is pretty clear that you must do it if they ask you to.
  - girvo 2mo ago
    And you can’t tell anyone if you do, on pain of jail.
  - sph 2mo ago
    Why do I never hear about this ‘feature’ from American products like gmail which 99% of the HN audience is using? Isn’t USA a member of Five Eyes? I admit it is a concern, as a Fastmail user, but this discussion only seems to happen on the Fastmail threads, yet no one bats an eye if one is suggested to open a gmail account like everybody else.
    - jacquesm 2mo ago
      Because everybody on HN is most likely aware that Google is an American company and that by using them you pretty much can assume that your data can be compromised without your knowledge or recourse. Post Snowden there should be zero doubt about that. Fastmail is worthy of scrutiny because people might believe that they are materially different when in practice they probably are not.
MYEUHD 2mo ago
What about the 9-eyes and the 14-eyes? All the added eyes are European (Denmark, France, the Netherlands, Norway; Germany, Belgium, Italy, Spain, and Sweden)
prism56 2mo ago
I just try hard to pick e2e or encrypted at rest then I guess it doesn't matter to some extent if there's a breach or where it's hosted... I hope
sureglymop 2mo ago
I wonder how much a European company would care? I mean to say, perhaps this is more about customer sentiment and image than something maybe benign to their profits like five eyes involvement.
inigyou 2mo ago
Five Eyes is only surveillance, right - they don't transfer court orders or arrest warrants? So Australia may spy on data entering and leaving the Australian server that serves US customers, but they can't just seize the server based on the Five Eyes agreement. BTW it's expanded to Fourteen Eyes and it's generally good to assume that all Western governments are cooperating to about this degree.

selectively 2mo ago

[dead]

V__ 2mo ago

For anyone curious, it's the CLOUD act: > The CLOUD Act primarily amends the Stored Communications Act (SCA) of 1986 to allow federal law enforcement to compel U.S.-based technology companies via warrant or subpoena to provide requested data stored on servers regardless of whether the data are stored in the U.S. or on foreign soil. [1] https://en.wikipedia.org/wiki/CLOUD_Act https://en.wikipedia.org/wiki/CLOUD_Act

samudrijan 2mo ago
The point of control is Congress, until we stop electing corpratist politicians, we will continue to get bad legislation.
- redserk 2mo ago
  It doesn't matter if it's Congress. At the end of the day America's internal governance systems are America's problem. The rest of the world should not care if a certain branch is causing issues, and frankly, is starting to come to that conclusion. It's unfortunate for us, but we very rarely isolate individual government systems for other nations.
braiamp 2mo ago
Which wouldn't matter where the data is located, so I don't think that this is the reason Fastmail is doing it, because a savvy enough company would know that the problem is that the company is US based.
- kid64 2mo ago
  They're Australian
  - petcat 2mo ago
    Australian companies are also subject to the USA Cloud Act. As is the UK, with Canada coming on board soon too. Even the entire EU is in the process of negotiating the same agreement. https://www.justice.gov/archives/opa/pr/united-states-and-canada-welcome-negotiations-cloud-act-agreement https://www.justice.gov/archives/opa/pr/united-states-and-ca... https://www.justice.gov/archives/opa/pr/justice-department-and-european-commission-announces-resumption-us-and-eu-negotiations https://www.justice.gov/archives/opa/pr/justice-department-a...
    - yborg 2mo ago
      Your linked information doesn't indicate anywhere that Australia or any other foreign government is subject to US law. The latter states that negotiation with the EU on this topic was suspended in 2019. Things have changed. With Chinese law in regards to data within Chinese jurisdiction a long-standing thing and an unfriendly American government potentially in power for an extended period, other countries are realizing the importance of data sovereignty.
      - petcat 2mo ago
        https://www.justice.gov/criminal/criminal-oia/cloud-act-agreement-between-governments-us-and-australia https://www.justice.gov/criminal/criminal-oia/cloud-act-agre... > The latter states that negotiation with the EU on this topic was suspended in 2019. Dated 2023: > Justice Department and European Commission Announces Resumption of U.S. and EU Negotiations on Electronic Evidence in Criminal Investigations The negotiations are still ongoing. Canada is further along than the EU.
tzs 2mo ago
It's weird how everyone focuses on that part of the CLOUD Act. The CLOUD Act actually did two things: (1) that, and (2) provided an expedited way for the US to enter into Mutual Legal Assistance Treaties (MLATs) with other countries. It was the MLAT thing that the various civil liberties groups object to (I'll cover the problems with those down below). There was very little objection to the first part. The first part was not controversial because pretty much every country has something equivalent (for reasons I'll cover below), as did the US except specifically in the case of data covered by the SCA due to poor drafting. One of the big reasons for the SCA was created was the emerging "third party doctrine" meant that instead of having to get a warrant or subpoena against you to get your data they could simply subpoena it from any of your service providers that had it. The SCA made it so the third party doctrine subpoenas would not apply to stored communications. There were still cases where the government would need to compel the service provider to turn over the data. They wanted something with the probable cause requirements of a warrant but the delivery method of a subpoena. (A subpoena asks someone who controls the data to turn a copy over. A warrant is for when the government wants to raid the data center and seize the data. Since that involves the government directly acting where the data is located it only applies to someplace where they have jurisdiction). So they created a new thing, the SCA warrant. The called it a "warrant" because it had the probable cause requirements of a warrant, but neglected to add something saying that in other respects it functions like a subpoena. I'll call this a pseudo-warrant. The SCA was not the first pseudo-warrant. That would be the warrants under the Wiretap Act of 1968. Territoriality questions did not arise under that because by its nature the data it sought copies of was always in the US. With the SCA the data might not necessarily be in the US. Years later Microsoft argued that because it is a "warrant" it should have the territorial restrictions that normal warrants have. The CLOUD Act clarified that it was indeed supposed to be like a subpoena as far as territoriality goes. There have been some more pseudo-warrants created since then, but their drafters learned from the SCA and made sure the original legislation was clear on just what they were. The reason pretty much every country has something like that, going back well before online documents, is because not having such a thing leads to big problems. If anyone in the country could shield documents from subpoenas (or whatever the equivalent is called in that country) by merely storing them across a border every company with documents that it needs to keep but that might be incriminating later would get sent to a storage facility across a border as soon as they were no longer actively using them. For example as soon as a car company in Detroit releases a new car all the documents where during development engineers brought up safety concerns which management decided to not address would be sent across the bridge to a storage facility in Canada. With electronic documents it is even easier. You would not have to wait until you aren't actively using the documents to stick them outside the country. Just stick your file server across a border and make sure you only have copies in country when someone is actively reading or editing them. And so pretty much everywhere subpoenas compel someone in the country who controls the documents to fetch them (or copies) and turn them over. The actual location of the documents is completely irrelevant. The thing that was worrying about the CLOUD Act was the MLAT provisions. MLATs are treaties where the participating countries agree on law enforcement. They include things like sharing information and cooperating on investigations. Normally these are enacted just like any other treaty. The executive branch negotiates them and then the Senate votes on ratification. The CLOUD Act adds an expedited process where the Attorney General and the Secretary of State can sign an MLAT. Congress is not involved. These agreements allow foreign law enforcement to make requests directly to US service providers instead of going through the diplomatic channels normal MLAT requests go through, and they allow them access to stored communications that the SCA would normally block. There are some safeguards. The foreign government is not supposed to intentionally target US people who are in the US and are not not supposed to use the data they get to infringe freedom of expression. There's also a 180 day window before these executive MLATs take effect during which Congress can block them by passing a joint resolution to do so. Civil rights groups and many others were not impressed with those safeguards.

mrtesthah 2mo ago

Ok, but Fastmail is an Australian company based in Melbourne.

OJFord 2mo ago
But whose cloud infrastructure do they use? (I don't know, but it might likely be AWS, GCP, or Azure.)
- microtonal 2mo ago
  That it described in the linked post: We’ve installed our own servers, co-located in a secure facility in Amsterdam, set up by our own engineers.
- calvinmorrison 2mo ago
  None. It's racked and stacked old school
toomuchtodo 2mo ago
As a FastMail customer who spends a portion of the year in the US, I am happy to pay to move my data to the EU region, even if they cannot yet fully guarantee all my data will remain outside of US access at this time. Defense and mitigations in depth, over time. We must always start somewhere, and perfect is never the target (as it does not exist).
- tmgldn 2mo ago
  Agree - small steps always positive here
petcat 2mo ago
Australia and the US entered into a bilateral agreement in 2024 which made Australian companies subject to the US CLOUD Act. https://www.justice.gov/criminal/criminal-oia/cloud-act-agreement-between-governments-us-and-australia https://www.justice.gov/criminal/criminal-oia/cloud-act-agre...

ffsm8 2mo ago

> your data can still be forcibly pulled and often without you being aware that this happened as a german i feel the urge to point out that this technically also applies to european companies... With more hurdles for the US, but still technically applicable

usernomdeguerre 2mo ago
True, I think the calculus is more about who you think is more trustworthy than what tools they have to damage you.
slow_typist 2mo ago
Especially if European companies have an office and significant share of customers in the US.
jacquesm 2mo ago
That's true but the EU still has a - mostly - functioning legal system. See 'Schrems' and other lawsuits that came out as they should have.
- perks_12 2mo ago
  Take a look at how they play with regards to chat control. The EU is just the same corrupt BS like D.C., only with a lot more virtue signaling.
  - jacquesm 2mo ago
    Sorry, I don't agree with that. The amount of corruption in the USA right now is simply off the scale.
    - sneak 2mo ago
      Nah, it’s just more visible. It’s not that much of a sea change. And it’s ridiculously naive to pretend that the major countries in Europe don’t have their own mechanisms to regularly and effectively bypass any democratic inconveniences when necessary. They regularly push through things that no constituent would ever want or vote for.

amelius 2mo ago

How does Apple handle it?

xnickb 2mo ago
Why would apple care? Eu is what a quarter of their business? And where exactly will those people move? They're locked into the Apple infra.
- askonomm 2mo ago
  Fastmail has very nice email sync for iCloud that I use :)

rufasterisco 2mo ago

Can you point me towards some resources that show EU customers moving? Not that I don’t trust the statement, I just would like to know more.

jacquesm 2mo ago
I hope Airbus is large enough for you? https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cloud https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cl... And many others besides, pretty much every company I've looked at in the last year is either acutely aware of the problem or they are already executing on it. With Trump and his merry band of criminals repeatedly stating they're going to take Greenland by force you can't blame them either, that would effectively put the EU on a war footing with the United States (I still can't believe I'm writing this sort of thing and it is not entirely fiction), the end result of that would be that there would be an absolute run on EU hosted capacity. They're just trying to beat the rush and hope they'll never be proven to be right.
- rufasterisco 2mo ago
  Tnx!
- mlrtime 2mo ago
  "This is not Airbus abandoning US big tech. It will keep AWS for its Skywise aviation-data platform and a customer-support tool. It also still runs Microsoft and Google productivity suites, plus Salesforce, Coupa and Workday."
toomuchtodo 2mo ago
HN Search: airbus critical apps scaleway - https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=airbus%20scaleway&sort=byDate&type=story https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... Gov.uk has replaced Stripe with Dutch provider Adyen - https://news.ycombinator.com/item?id=48415217 https://news.ycombinator.com/item?id=48415217 - June 2026 (235 comments) Netherlands reaches deal with European cloud company to decrease U.S. tech reliance - https://nltimes.nl/2026/04/24/netherlands-reaches-deal-european-cloud-company-decrease-us-tech-reliance https://nltimes.nl/2026/04/24/netherlands-reaches-deal-europ... - April 24th, 2026 Wary of US Big Tech, the EU looks to build its “EuroStack” - https://sherwood.news/world/wary-of-us-big-tech-the-eu-looks-to-build-its-eurostack/ https://sherwood.news/world/wary-of-us-big-tech-the-eu-looks... - March 18th, 2026 Why European Companies Are Leaving US Cloud Providers in 2026 — And Where They're Going - https://massivegrid.com/blog/european-companies-leaving-us-cloud/ https://massivegrid.com/blog/european-companies-leaving-us-c... - March 12th, 2026 Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech - https://www.theregister.com/off-prem/2025/12/22/europe-gets-serious-about-cutting-us-digital-umbilical-cord/2654348 https://www.theregister.com/off-prem/2025/12/22/europe-gets-... - December 22nd, 2025 Schleswig-Holstein waves auf Wiedersehen to Microsoft stack - https://www.theregister.com/software/2025/10/15/schleswig-holstein-waves-auf-wiedersehen-to-microsoft-stack/1543638 https://www.theregister.com/software/2025/10/15/schleswig-ho... - October 15th, 2025 EU Banks Launch Wero Payments to Dislodge Visa, Mastercard - https://news.ycombinator.com/item?id=41666833 https://news.ycombinator.com/item?id=41666833 - September 2024 (88 comments) https://european-alternatives.eu/ https://european-alternatives.eu/ https://euro-stack.com/ https://euro-stack.com/

atmosx 2mo ago

That’s true and Fastmail runs on AWS. But it’s a start and a “feature” many have requested for years. It’s funny because the HQ and I believe their workforce is located in Australia.

chrismorgan 2mo ago
Fastmail has never used AWS, and this article is pretty clear about how they have always used their own hardware and traditional colocation. Fastmail used to be based in Melbourne only, but after the Pobox merger it ended up with an office in Philadelphia too. No idea how the balance of things is between the offices now.
- atmosx 2mo ago
  That’s interesting, I thought they were hosted on AWS. Thanks for sharing.
calvinmorrison 2mo ago
Fastmail runs on its own infra.
preisschild 2mo ago
But how is it actually "a start" or improves anything at all? It doesnt matter where the "physical location" of the data is. It matters who has access to it.
jph00 2mo ago
Not only is that not true, but in fact FastMail predates AWS by some years. Source: I founded FastMail.
- jph 2mo ago
  Great username :-) I'm a happy longtime Fastmail customer and I'm migrating to the new EU area.
deleted 2mo ago
[deleted]

microtonal 2mo ago

Yeah, this does absolutely not solve the CLOUD Act issues. However, it is good to look at what the ramifications of the CLOUD Act is for e-mail: - The US could request your data. You probably shouldn't use e-mail for anything sensitive anyway for many reasons. E-Mail was traditionally not encrypted and I think that many servers still allow plain-text communication. The protocols are old and there are all kinds of downgrade attacks. Aside from that, even if your service does not fall under the CLOUD Act, you are probably f*cked anyway, because most people you communicate with are using services that fall under the CLOUD Act. - The US can force the provider to block your account. The workarounds are: regularly backup your e-mail (easy for services that offer IMAP) and, most importantly, use a domain with an extension that is not under the control of a US (or probably five eyes) registrar. Use an E2E-encrypted messenger with perfect forward secrecy, etc. for most personal communication.

1over137 2mo ago
Something like 99% of email is now done over TLS.
- SoftTalker 2mo ago
  Yes but it will almost always work with self signed or expired certificates, or downgrades to clear text if that's what it takes to deliver the message.
  - inigyou 2mo ago
    I thought a few years ago Gmail started demanding TLS so now any mail server that anyone cares about supports TLS.
    - SoftTalker 2mo ago
      I had a mail server running with a LetsEncrypt cert. I never set up the cron job to renew it, and months later realized that the certificate had expired. Gmail never glitched sending mail to my server. This was some time in 2025, so not too long ago.

calvinmorrison 2mo ago

Fastmail is an Australian company

gib444 2mo ago
And hosted on US infrastructure, satisfying the "or" clause in their post
- sodapopcan 2mo ago
  The article says they installed their own servers, though. What am I missing here?

kisamoto 2mo ago

Does this still apply if there are separate legal entities for US & EU operations? Take Hetzner as an example. They have a separate US company to deal with their US data center. Would their EU servers be vulnerable to the CLOUD Act?

jacquesm 2mo ago
Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.
- yread 2mo ago
  I dont share your optimism: The US can just say: let us access this one customer or we will ruin your vpcs in the US. What can you do about it? FDE? Can you keep the keys away from Hetzner? How much hacking would they need to do to get them? Can US government break SecureBoot? Im just happy my business is not important enough
  - kazen44 2mo ago
    the alternative being hetzner giving away EU based information to the US? which would absolutely destroy their reputation in the EU. (which is a far larger market for them). The only way to spin this as hetzner is to go public with this and make it a political point for geopolitics between the EU and the US, and take the loss /call the bluff on the US threat.
    - jacquesm 2mo ago
      Let me tell you about that time when I walked around in a DC in NL and ran into an unaccompanied FBI liaison officer... I don't think any of us have the total picture, but the bits that I do have are sufficient to worry me about the degree to which I am automatically breaking the NDAs I sign by using a computer, email, online data rooms and so on.
  - 2mo ago

DarrenDev 2mo ago

EU sovereign clouds are taking off right now - especially when it comes to sensitive data (government, healthcare, etc.). Lots of players moving into the space. The common denominator - nothing touches the US. AWS, Azure, GCP, Oracle, Schwarz Digits, SAP

jacquesm 2mo ago
You can strike at least four of those.
easton 2mo ago
Requiring that you believe those companies that they won’t hand the keys over to the US at the first ask. Like, the critical problem with the AWS sovereign pitch is that you must believe that they won’t give the keys to the US, and they also won’t give the source code that’s hosted in the US to the government either for them to find vulnerabilities in. I don’t know if that’s good enough unless you just need the data to stay in the EU and you don’t care if another country sees it. I know they probably did some work on it (what if primary AWS goes rogue and the EU entity must work without it) but I don’t know if they explained how they’re safe to the public.
- jacquesm 2mo ago
  The harder problem here is that any real EU sovereign platform would have to come with ironclad guarantees that it isn't going to be directly or indirectly sold to a US party. And when enough customers move that marketshare is affected the bags with money tempting shareholders will get larger and larger.
  - rufasterisco 2mo ago
    Isn’t that counterbalanced by the fact that the reason they exist in the first place is to be a sovereign platform? I am assuming the reason companies switch to them is not price or tech. US cloud providers have the advantage on both. Selling EU companies data would mean destroying trust over their main selling point, not to mention incur on EU wrath. Feels like living one whistleblower away from doom. I refer to fully EU clouds, parent list includes US clouds that do not need bags of money, Clouds Act in enough.

BrandoElFollito 2mo ago

The French head of Microsoft ctor not, under oath, say that Microsoft can guarantee sovereignty. This is the evidence that until you have a EU company, under EU rules and not present in the US at all, you cannot have sovereignty.

realo 2mo ago

pCloud is an example. Swiss corporation with data centers in Luxembourg.

thisislife2 2mo ago

True. Australia is part of the Five Eyes alliance. Fastmail is an Australian company. Australia also has the Assistance and Access Act - https://havenmessenger.com/blog/posts/australia-assistance-access-act/ https://havenmessenger.com/blog/posts/australia-assistance-a... - which just stops shy of asking Australian tech companies, like Fastmail, to build backdoors into their products so that the government can "legally access" data from them. (When the law passed, Fastmail lost many clients - https://www.itnews.com.au/news/fastmail-loses-customers-faces-calls-to-move-over-anti-encryption-laws-519783 https://www.itnews.com.au/news/fastmail-loses-customers-face... ).

jeffparsons 2mo ago
> just stops shy of asking Australian tech companies, like Fastmail, to build backdoors into their products so that the government can "legally access" data from them It stops just short of saying that you must do thispreemptively, but is pretty clear that you must do it if they ask you to.
- girvo 2mo ago
  And you can’t tell anyone if you do, on pain of jail.
- sph 2mo ago
  Why do I never hear about this ‘feature’ from American products like gmail which 99% of the HN audience is using? Isn’t USA a member of Five Eyes? I admit it is a concern, as a Fastmail user, but this discussion only seems to happen on the Fastmail threads, yet no one bats an eye if one is suggested to open a gmail account like everybody else.
  - jacquesm 2mo ago
    Because everybody on HN is most likely aware that Google is an American company and that by using them you pretty much can assume that your data can be compromised without your knowledge or recourse. Post Snowden there should be zero doubt about that. Fastmail is worthy of scrutiny because people might believe that they are materially different when in practice they probably are not.

MYEUHD 2mo ago

What about the 9-eyes and the 14-eyes? All the added eyes are European (Denmark, France, the Netherlands, Norway; Germany, Belgium, Italy, Spain, and Sweden)

prism56 2mo ago

I just try hard to pick e2e or encrypted at rest then I guess it doesn't matter to some extent if there's a breach or where it's hosted... I hope

sureglymop 2mo ago

I wonder how much a European company would care? I mean to say, perhaps this is more about customer sentiment and image than something maybe benign to their profits like five eyes involvement.

inigyou 2mo ago

Five Eyes is only surveillance, right - they don't transfer court orders or arrest warrants? So Australia may spy on data entering and leaving the Australian server that serves US customers, but they can't just seize the server based on the Five Eyes agreement. BTW it's expanded to Fourteen Eyes and it's generally good to assume that all Western governments are cooperating to about this degree.