The CLOUD Act requires companies subject to US law to hand US authorities the data they control, wherever that data is stored.
So the useful question is not "where is the server?" but "who controls it?". A file hosted in Paris by an American company remains within reach of a US warrant. The same file hosted in Paris by a European company with no US ties does not.
For a meeting recording, which holds the voices and words of people who chose nothing, the difference is not theoretical.
What the text says
The Clarifying Lawful Overseas Use of Data Act, known as the CLOUD Act, was signed into law on 23 March 2018. It amends the Stored Communications Act with a simple rule (18 U.S.C. § 2713): a service provider must disclose data in its possession, custody or control, whether that data sits inside or outside the United States.
The text answers a specific dispute. In 2013 Microsoft refused to hand US prosecutors emails stored in its Dublin data centre, on the grounds that they were in Ireland. The case was before the Supreme Court when Congress settled the question by statute. The Court then dismissed the case as moot.
Control, not geography
The test is the control the company exercises, not the location of the disk. That is why the "European region" promises of the big US cloud providers do not settle the question: they say where the data sleeps, not who can be compelled to wake it.
The point was confirmed under oath. Heard by a French Senate inquiry in June 2025, Microsoft France's director of public and legal affairs said he could not guarantee that French citizens' data would never be passed to US authorities without the French authorities' agreement.
Why the GDPR is no shield
The GDPR and the CLOUD Act contradict each other without cancelling each other out. Article 48 of the GDPR only allows a transfer demanded by a foreign court if it rests on an international agreement, typically a mutual legal assistance treaty. The CLOUD Act lets authorities skip that step.
A company caught between the two has to choose which law it breaks. The CLOUD Act gives it a way to challenge the request before a US judge, but only when the country concerned has signed one of the executive agreements the law provides for. The United Kingdom has one. The European Union has been negotiating one since 2019.
| Text | What it settles | What it does not |
|---|---|---|
| CLOUD Act (2018) | US authorities' access, in a criminal investigation, to data controlled by a provider subject to US law. | Data location: it plays no part. |
| GDPR, Article 48 | The ban on complying with a foreign demand without an international agreement. | What happens to a company that US law compels anyway. |
| Data Privacy Framework (2023) | Commercial data transfers to certified US companies. | The CLOUD Act, which remains in force. |
The CLOUD Act is not the only law involved
The CLOUD Act governs criminal investigations: it takes a warrant, issued by a judge, in a specific case. Section 702 of the Foreign Intelligence Surveillance Act (FISA) goes further. It lets US intelligence agencies monitor non-US persons located abroad, through US providers, without an individual warrant.
That law, together with Executive Order 12333, led the Court of Justice of the European Union to strike down the Privacy Shield in its Schrems II ruling of 16 July 2020. The Data Privacy Framework that replaced it in 2023 adds safeguards and a redress mechanism. It removes neither Section 702 nor the CLOUD Act.
Who is affected in practice
Any company subject to US law, which includes the three largest cloud providers: Amazon Web Services, Microsoft Azure and Google Cloud. It also includes the US software vendors built on them, and a large share of AI services, including the most widely used transcription models. A recorder's app can be published by a European company and still hand your files to one of these players: what counts is the subcontractor.
What it means for a meeting recording
A meeting recording is not a file like any other. It holds names, figures, intentions, and often things nobody would have written down. For some professions it also holds a secret protected by law: the lawyer's, the notary's, the doctor's.
Most AI recorders sold in France transcribe with American models on American servers. The CLOUD Act is then not even the first issue: the data has already left the European Union. We look at this for one of them in our Notus vs Plaud Note comparison.
Three questions to ask a provider
- Who transcribes? Does the model listening to your meeting belong to a company subject to US law?
- Who hosts? Not where, who. The host's head office and its parent company matter more than the data centre's address.
- For how long? A deleted file cannot be handed to anyone. Retention is the simplest protection there is.
What actually protects you
- Encryption you hold the keys to. A provider can only hand over what it controls. If the data is encrypted with keys it does not hold, all it can hand over is an unreadable file.
- Deletion. A recording erased once the minutes exist can no longer be requested. It is the cheapest and most effective measure there is.
- The full chain of subcontractors. Ask for the list: host, transcription model, email delivery tool. A single US link is enough to reopen the question.
For the most sensitive data, the French cybersecurity agency ANSSI's SecNumCloud qualification has included protection against extraterritorial laws since version 3.2. It is currently the only French public label that answers the question explicitly.
Key takeaways
- The CLOUD Act covers data controlled by a provider subject to US law, wherever it is stored.
- A server in France does not protect you if its operator answers to US law.
- The GDPR forbids handing data over, but does not protect a company compelled to do it.
- Before location, ask who transcribes, who hosts, and for how long.
Sources: Clarifying Lawful Overseas Use of Data Act, 23 March 2018, 18 U.S.C. § 2713; US Supreme Court, United States v. Microsoft Corp., 17 April 2018; Regulation (EU) 2016/679 (GDPR), Article 48; CJEU, 16 July 2020, C-311/18, Schrems II; French Senate, inquiry into public procurement, hearing of 10 June 2025; ANSSI, SecNumCloud framework 3.2.
Notus is hosted in France by a provider established in the European Union, and transcribes with Mistral AI, a French company. Your recordings are never used to train a model.
Discover Notus →