Why Move Your Business Data from US Clouds to a Private EU Cloud

In short: trust in a cloud provider comes down to four questions. Who can be forced to hand over your data? Who can switch your service off? Who sets your price? And can you leave? For a US hyperscaler, the honest answer to the first two includes the US government, and the answer to the last two is mostly the provider. For a private cloud in the EU, the answer to all four is you, under European law. That is why sensitive and critical workloads are moving, while global and commodity ones can stay where they are.

This is a trust problem, not a technology problem

Nobody serious argues that AWS, Azure or Google Cloud are badly run. They are fast, feature-rich and secure against most attackers. Trust is a different test. It asks what happens when the interests of the provider, or of the government it answers to, stop lining up with yours. For years European businesses could assume that would never matter. Since 2025 a French Senate hearing, a sanctions case, an EU kill-switch debate and a regulator calling out lock-in have shown that it can.

We covered the market data, the full timeline and the EU rules in our earlier analysis, Europe’s Cloud Exit. This article is about the decision itself: why the trust gap exists, why the hyperscalers’ “sovereign” editions narrow it without closing it, and why a private cloud in the EU is, for most critical workloads, the cleanest answer.

1. US law follows the company, not the data center

Putting your data in Frankfurt or Dublin answers where it is. It does not answer who can be compelled to hand it over. The US CLOUD Act requires providers under US jurisdiction to disclose data in response to valid US legal process “regardless of where the company stores the data”, as the US Department of Justice puts it. US intelligence law, notably FISA Section 702, reaches the same companies. When the French Senate asked Microsoft France’s director of legal affairs in June 2025 whether he could guarantee that French customers’ data would never be handed to US authorities without French consent, he answered under oath: “No, I cannot guarantee it.” He added that it had never happened. Both statements can be true. The point is that the guarantee is not his to give, and the same holds for every US-owned provider.

The legal bridge for personal data is shaky too. The EU-US Data Privacy Framework is still in force, but it leans on US oversight bodies whose independence the US Supreme Court weakened in Trump v. Slaughter on 29 June 2026. The European Data Protection Board has asked the Commission to assess the impact, and noyb has asked for the framework to be repealed. The two previous EU-US data deals were struck down by the EU’s top court in 2015 and 2020. A data strategy that depends on a third deal surviving is a bet, not a plan.

2. A political kill switch is no longer theoretical

In May 2025 the Associated Press reported that, after US sanctions on the International Criminal Court, its chief prosecutor lost access to his Microsoft email. Microsoft denies suspending services to the court itself, and the details remain disputed. The lesson businesses drew does not depend on those details: a US provider must follow US sanctions and export rules, and those rules can change with an executive order. The ICC later moved about 1,800 workstations to the German open-source suite openDesk.

Europe’s leaders and its largest companies now say the quiet part out loud. When the Commission presented its tech sovereignty package in June 2026, Executive Vice-President Henna Virkkunen said it wants to make sure cloud providers running critical workloads do not have a “kill switch”, and that US companies would struggle to reach the highest sovereignty levels because of the CLOUD Act. A month later Airbus picked the French provider Scaleway for about 70 critical applications, citing protection against exactly that risk. Microsoft has committed contractually to contest in court any order to suspend its European cloud operations. That is a welcome promise, and it is also an acknowledgement that the order could come.

3. “Sovereign” editions narrow the gap but keep the owner

The hyperscalers have answered with sovereign products, and some of the engineering is impressive. The AWS European Sovereign Cloud, live in Brandenburg since January 2026, is run by EU legal entities with EU-resident staff. On 24 October 2026 AWS disconnected it from its global network backbone for several hours as an independence test, and reported on 1 November that service availability was not affected. Microsoft offers sovereign public and private cloud options, and Google sells sovereign tiers through partners such as S3NS in France.

What none of them changes is who owns the company at the top. The AWS offering is, in the words of Forrester’s Dario Maisto, “still entirely owned by the US mother company”. A US parent can be served with US orders, and it controls the software, the updates and the roadmap of what runs in your sovereign region. Independent questions also remain open, such as how long such a region can run without its parent’s control plane, identity tokens and certificates. When the European Commission scored bidders for its own €180 million sovereign cloud tender in April 2026, the contract went to four European groups, and the Google-linked bid reached only the minimum sovereignty level. Sovereign editions are a real step up from a standard EU region. They are not the same thing as European control.

4. You do not set the price, and leaving was built to be hard

Three companies hold about 70% of Europe’s cloud market. That concentration shows up in your contract: proprietary managed services that only run on one platform, discounts tied to multi-year spend commitments, and egress fees for taking your own data out. In June 2026 the European Commission set out its preliminary view that AWS and Azure should be designated gatekeepers under the Digital Markets Act, pointing to lock-in effects. A final decision was reported as possible this month.

The economics can favour leaving. The software company 37signals spent more than $3.2 million a year on AWS. After moving its compute onto about $700,000 of its own Dell servers, its cloud bill fell by about $2 million a year, and replacing its S3 storage with its own arrays was expected to save a further $1.3 million a year, The Register reported in May 2025. Your numbers will differ, and a private cloud needs people to run it. But for steady, predictable workloads, paying a hyperscaler’s premium for elasticity you never use is a choice, not a law of nature. From 12 January 2027 the EU Data Act removes switching and egress charges entirely, so the biggest one-off cost of leaving disappears.

5. Their bad day becomes your bad day

When thousands of European businesses share one provider’s control plane, a single fault lands on all of them at once. In October 2025 an AWS failure in its US-East region disrupted around 2,000 companies for about 14.5 hours, and nine days later an Azure configuration error took retailers and Dutch Railways offline. No data center is immune to failure, private ones included. The difference is that in your own private cloud you decide how many sites you run, how failover works and when it is tested, rather than waiting for a status page.

The trust test: US cloud, sovereign edition or private EU cloud

Why a private EU cloud is the strongest answer for critical data

A European public cloud already removes the US-parent problem, and for many general workloads it is the right choice. For the data and systems your business cannot afford to lose, leak or have switched off, a private cloud goes further:

It is not the answer to everything. A private cloud needs round-the-clock operations, which means an in-house team or a managed partner. Spiky workloads, global consumer apps and specialist AI services can still be better on a hyperscaler. That is why only 4% of European organizations plan to use local providers exclusively, according to IDC. The goal is not to leave the hyperscalers on principle. It is to stop trusting them with the things you cannot afford to lose.

If the answers make your board uncomfortable, that discomfort is the risk you are carrying today.

How RHC Solutions moves your data to a private EU cloud

RHC Solutions has run, secured and recovered critical infrastructure for businesses since 1994, with teams in Lisbon, Sofia and Larnaca inside the EU. We are not tied to one platform: we work with European providers such as OVHcloud and with AWS, Azure and Google Cloud, so we can tell you honestly which workloads should move and which should stay. We assess your trust exposure, design a private cloud in European data centers chosen with you, migrate in phases without big-bang downtime, and then run it 24/7 with managed security, tested disaster recovery across two sites and the audit evidence your GDPR, NIS2 and DORA obligations require. You keep the keys.

Sources and further reading