The most important facts in brief

• The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act) is a US federal law from 2018 that allows US authorities to request data from US cloud service providers – regardless of the storage location.
  
• It is considered a strategic risk and a potential breach of the GDPR, as it deprives EU citizens and companies of effective legal protection.
  
• Sensitive documents such as legally valid contracts and personal proof of identity are particularly at risk, as they represent valuable business or personal assets.
  
• The secure strategic answer for companies is to consistently opt for European platforms and data storage locations that are exclusively subject to EU law (GDPR, eIDAS).
  
• As a 100% European platform, sproof offers the necessary digital sovereignty and is therefore the risk-free alternative for your signature management.

The core of the problem: extraterritorial access

European companies are increasingly confronted with conflicts between US and EU law in a digital world. The US CLOUD Act (Clarifying Lawful Overseas Use of Data Act), which came into force in 2018, is at the center of this dilemma.

It authorizes US law enforcement authorities to request data from US cloud providers – such as Amazon, Microsoft or Google. The decisive, strategically relevant point is that these requests are independent of the geographical storage location of the data. Whether your digital contracts are located in Frankfurt, Dublin or Amsterdam is irrelevant from the perspective of the CLOUD Act, as long as the service provider is a US company.this creates a legal gray area, as US access potentially conflicts with the strict requirements of the European General Data Protection Regulation (GDPR).

The CLOUD Act and the violation of the GDPR

The strategic risk is clear: the GDPR requires that personal data may only be transferred to or processed in third countries if an adequate level of protection (Art. 45 GDPR) is guaranteed.

However, following the rulings of the European Court of Justice (ECJ, e.g. Schrems II), it was determined that US surveillance laws such as the CLOUD Act do not provide adequate protection for EU data.

Aspect	GDPR (EU law)	US CLOUD Act (US law)
Legitimation of access	Court order in the EU, strong justification	US arrest warrant or subpoena, lower hurdles
Notification	Those affected must be informed	Provider may be subject to a duty of confidentiality (no notification)
Territorial reach	Restricted to EU territory	Extraterritorial, applies worldwide to US providers

In the case of a digital signature process, this concerns highly sensitive data: The contracts themselves, but also the proof of identity and the entire audit trail (signature protocol).

Digital contracts and the underlying identity verification are your company ‘s most critical data assets. No compromise can be made here in terms of sovereignty.

The path to risk minimization: internal action

The solution for European companies is not just to be aware of the CLOUD Act, but to take action:

1. Identify critical workloads: Evaluate which data (contracts, HR files, IP documents) have a high need for protection.
   
2. Choose a sovereign European infrastructure: Rely on European, eIDAS-compliant signature and hosting solutions for these critical areas.
   
3. Secure access and identity management: Ensure that both access and digital identity verification for signature-relevant data remain under European control – for example through trust services regulated in Europe (eIDAS-compliant).

Digital sovereignty: sproof as the European answer

The conflict surrounding the CLOUD Act highlights the need for Europe’s digital sovereignty. Companies must act proactively to make their data infrastructure immune to the access rights of third countries.

sproof was developed as a European platform with precisely this strategic orientation. Our perspective is uncompromising:

1. EU law exclusive: sproof solutions, including sproof Sign, sproof Ident, sproof Widget, sproof Fastlane, sproof eID Hub, sproof Validate are 100% developed in Europe and hosted on European servers. They are exclusively subject to the GDPR and eIDAS.
   
2. No CLOUD Act threat: Since sproof is not a US company and does not operate any US subsidiaries, US authorities cannot enforce access via the CLOUD Act.
   
3. eIDAS certification: Our services meet the highest European trust standards, in particular for the Qualified Electronic Signature (QES).

This choice is not just a question of legal compliance, but a strategic competitive advantage that signals maximum trust to your customers and partners.

Protect your most critical data. Choose digital sovereignty. Start your transition now to a 100% European signature platform that guarantees your compliance security →