What the CLOUD Act Does
Before 2018, it was genuinely unclear whether US law applied to data that American companies stored on servers outside the United States. The question was heading to the Supreme Court in the form of United States v. Microsoft Corp. — a case arising from a warrant demanding emails stored on Microsoft's servers in Ireland. Congress answered before the Court could. The CLOUD Act, signed on March 23, 2018, pre-empted the Microsoft Ireland case entirely: yes, US warrants apply to data held by US companies anywhere in the world.
The practical consequence is sweeping. Any company incorporated in the United States — or any company with sufficient legal presence in the US — must comply with US government data demands for data stored on any server, in any country. There is no geographic safe harbor. There is no EU residency shield. There is no server-location exception.
"The CLOUD Act allows U.S. law enforcement to access data stored anywhere in the world by U.S. service providers, without requiring notification to the person whose data is being sought."
— EFF, 2018
EU Data Residency Doesn't Help
In the years since the CLOUD Act passed, major cloud providers have introduced "EU data residency" and "EU data boundary" products. These products are real, technically: they limit where data is physically stored. They do not limit who can legally demand it. The CLOUD Act binds the company, not the server.
A CLOUD Act Warrant Yields Only Ciphertext
With 1Cryptor, even a fully compliant, legally valid CLOUD Act demand to your cloud provider produces nothing useful. The provider hands over AES-256-GCM ciphertext. Without your passphrase — which never leaves your device — it is unreadable.