Why does it matter that your data stays in Europe?

You've probably seen it in the terms of service without giving it much thought: your data is stored "in Frankfurt" or "within the EU." Sounds reassuring. But that's really only half the picture. Just as important is who owns the company behind the service — not just where the server itself happens to be located.

That's where it gets interesting.

An EU server doesn't always mean European protection

Many people assume the choice is between storing data in Europe or in the US. But the reality is a bit more confusing than that. A company can use a cloud service that stores data in Frankfurt or Stockholm — while the company behind the service is American, and therefore subject to American law.

This applies to several of the large, well-known cloud services: even when they open European data centers, it's still an American company that owns and operates the infrastructure. And that, fundamentally, is what determines which rules apply — not which country the server room happens to be in.

Why American law can matter even in Europe

There's an American law — the US CLOUD Act — that, in short, gives US authorities the ability to request data from American companies, regardless of where their servers are physically located in the world. In other words: the fact that data is stored in Sweden doesn't automatically make it inaccessible, if the company that owns the service is American.

Broadly, it can work something like this:

CLOUD Act isn't the only law of this kind, either. FISA 702 gives US intelligence agencies the right to collect data on people outside the US from American providers — without the person affected ever finding out. That law played a major role in the EU Court of Justice striking down Privacy Shield in 2020.

This creates a situation where American law and GDPR don't always pull in the same direction. Right now, there's an agreement between the EU and the US — the Data Privacy Framework — that permits the use of American providers, but it's the third such attempt. The two previous ones, Safe Harbor and Privacy Shield, were both struck down by the EU Court of Justice. The current agreement survived an initial court challenge in 2025, but has, since the summer of 2026, once again come under scrutiny: both EU data protection authorities and the privacy organization noyb have pointed out that a US Supreme Court ruling may have undermined the oversight the agreement relies on. The point is simpler than all that, though: it's the company's home jurisdiction that determines which laws apply — not where the server stands.

It's about more than personal data

GDPR and personal data tend to dominate this conversation, but it's worth remembering that what sits in a cloud service is rarely just names and email addresses. In practice, it's a large part of a company's everyday operations:

That's why it matters where — and with whom — these kinds of tools are run, meaning who could, in theory, gain access to the information.

A few simple questions to ask your providers

You don't need to be a lawyer to make an informed choice. Here are some reasonable questions to ask providers of chat, file storage, and project tools:

Rukkor is built on the same principle

Rukkor is a European company, registered and operated within the EU. All data is physically stored within the EU, and we don't use any American subprocessors — no AWS, Azure, Google Cloud, or Cloudflare behind the scenes. That means your files, messages, and calls aren't subject to the US CLOUD Act, whether directly or through a subprocessor.

That's an important part of complying with GDPR — but just as important is that you, as a customer, know exactly who owns and is responsible for your data.

Rukkor is an all-in-one platform for chat, video calls, file storage, and project planning — a European alternative to tools like Teams, Slack, and Dropbox.