Why EU Hosting Matters for SaaS and AI Teams: GDPR, Schrems II and the CLOUD Act

The GDPR applies when you process personal data in the context of an establishment in the EU (Article 3(1)), and, if you have no EU establishment, to processing of personal data of people in the EU that relates to offering them goods or services or to monitoring their behaviour there (Article 3(2)). Where that data is hosted and which company hosts it then decide how much international transfers and access by foreign authorities come into play. The GDPR restricts transfers of personal data out of the EEA, US law can require US cloud and communication providers to hand over data they hold abroad, and AI prompts tend to be full of personal data.

This post explains the rules in plain terms and ends with a checklist for choosing a provider. It is not legal advice: for your specific case, ask your data protection officer or a lawyer.

The GDPR rule for transfers

Chapter V of the GDPR (Articles 44 to 50) covers "transfers of personal data to third countries or international organisations". A third country is any country outside the EU and the European Economic Area. Article 44 sets the principle: personal data may only leave if the conditions of that chapter are met. There are three main routes:

• Adequacy decision (Article 45): the European Commission decides that a country protects personal data at a level essentially equivalent to the EU. Data can then flow there without further safeguards.
• Appropriate safeguards (Article 46): for example the standard contractual clauses that the Commission adopted in Decision (EU) 2021/914, or binding corporate rules inside a group of companies (Article 47).
• Derogations (Article 49): narrow exceptions for specific situations, not a basis for routine hosting.

Breaking these rules is in the GDPR's highest fine tier: up to 20 million euros or 4% of worldwide annual turnover, whichever is higher (Article 83(5)).

Schrems II: why a contract alone was not enough

On 16 July 2020 the Court of Justice of the EU decided Case C-311/18, known as Schrems II. It declared the EU-US Privacy Shield, the adequacy decision for the United States at the time, invalid. The Court found that US surveillance programmes were not limited to what is strictly necessary, and that people whose data was transferred had no way to bring a case before an independent body with guarantees equivalent to EU law.

The standard contractual clauses survived, but with a condition. The protection has to be essentially equivalent to the EU's, and the assessment must take into account the relevant parts of the destination country's legal system, in particular access by public authorities. Exporter and recipient have to check this before the transfer. If the clauses cannot be honored, the transfer has to be suspended or ended.

For teams this turned a signature into homework: before relying on the clauses, you look at the law of the country your data goes to.

The EU-US Data Privacy Framework

On 10 July 2023 the Commission adopted Implementing Decision (EU) 2023/1795, a new adequacy decision for the EU-US Data Privacy Framework (DPF). Personal data can flow to US companies that participate in the framework without additional safeguards. Companies join by committing to a set of privacy obligations; the US Department of Commerce administers the framework, and the Federal Trade Commission or the Department of Transportation, depending on the organisation, enforces the commitments. On the government side, the framework limits access by US intelligence services to what is necessary and proportionate and created a Data Protection Review Court for complaints from EU individuals.

Two things to keep in mind:

• It covers only participating companies. A US provider that is not certified needs another route, such as standard contractual clauses.
• It has been challenged. The EU General Court dismissed an annulment action on 3 September 2025 (Case T-553/23), and the claimant appealed to the Court of Justice (Case C-703/25 P); the appeal was still pending when this post was written. Both earlier frameworks for the US, Safe Harbour and Privacy Shield, were declared invalid by that Court.

The US CLOUD Act: location is not the whole story

The Clarifying Lawful Overseas Use of Data Act was enacted on 23 March 2018 as part of the Consolidated Appropriations Act, 2018. It added 18 U.S.C. 2713: providers of electronic communication or remote computing services must meet their obligations under that chapter (Chapter 121 of title 18) to preserve, back up or disclose communications and customer records in their "possession, custody, or control", through the applicable legal process, regardless of whether that data is located inside or outside the United States.

In practice, a US provider with a data center in Frankfurt can receive a US order covering data stored there. The GDPR pulls the other way: under Article 48, a foreign court judgment or authority decision that requires a transfer or disclosure can only be recognized or enforced in the EU if it is based on an international agreement, such as a mutual legal assistance treaty. That does not rule out every disclosure, because Article 48 applies "without prejudice to other grounds for transfer", but any disclosure still needs a legal basis under Article 6 and a transfer ground under Chapter V. The provider has to resolve that conflict, and your data sits in the middle of it.

For a US recipient that is certified under the DPF, the adequacy decision covers the transfer itself: according to the EDPB, it needs no separate transfer tool and no supplementary measures. Check that the recipient is currently on the DPF List, and keep meeting your other GDPR obligations. What an EU region alone does not change is which country's law the provider answers to.

Why AI makes this more pressing

The GDPR defines personal data as any information relating to an identified or identifiable person, for example through a name, an identification number, location data or an online identifier (Article 4(1)). Look at what AI features usually process:

• support tickets and chat histories with names, email addresses and order numbers,
• CVs, contracts, invoices and medical letters uploaded for summaries or extraction,
• call transcripts and meeting notes,
• whole document stores indexed for retrieval-augmented generation (RAG).

Every prompt with that content is processing of personal data, and if the model runs in a third country, it can be a transfer. So for every AI component, ask the same questions as for your database: where does inference run, are prompts and outputs stored or logged and for how long, are they used for training, and which model provider sits behind the API as a sub-processor?

Checklist: choosing a provider

1. Headquarters and ownership. Where is the provider incorporated, and who owns it? The CLOUD Act is about data in a provider's possession, custody or control, so the company behind the service matters as much as the data center.
2. Region of the data. Can you pick an EU region for apps, databases, backups and logs, and does data stay there unless you move it? Where do the dashboard, API and account data run?
3. Remote access and onward transfers. Who can access the data, and from where? Access by the provider's own staff abroad needs appropriate security. Making data available to a separate company outside the EEA, such as a sub-processor, requires a Chapter V transfer basis, which the exporter must assess and document. Servers in Frankfurt do not settle this on their own.
4. Sub-processors. Ask for the list with each company's country. Under Article 28(2) a processor may not engage another processor without your prior written authorisation, specific or general. Check how you are told about changes.
5. Data processing agreement (DPA). Article 28(3) requires a contract (or another legal act) with your processor. Check that you can sign it without an enterprise deal, and which transfer route it relies on if data leaves the EU.
6. Certifications. ISO 27001 or SOC 2 reports for the provider and its data centers show that security controls are audited. They say nothing about which country's law applies, so read them together with points 1 and 2.
7. AI specifics. Inference location, prompt and output retention, training use and the model provider behind the API.

How Nodion handles this

Nodion is run by Nodion GmbH, a German company headquartered in Stuttgart. Nodion's APIs and control plane are hosted in Germany. The EU Central region is in Frankfurt am Main; according to the regions docs, its data center holds ISO 27001, ISO 9001, ISO 14001 and ISO 50001 certifications, is PCI DSS compliant and has a SOC 2 report, and the infrastructure provider holds ISO 27001, is PCI DSS compliant and has a SOC 1 report.

You pick the region when you create a service, and it does not move later. Apps, databases, volumes, buckets, the registry, logs and metrics for that service stay in the region you picked. The infrastructure providers per region are listed as sub-processors in the regions docs, and the DPA is self-service. Nodion also runs regions in the US, so pick EU Central when you create a service that should run in the EU.