---
title: "The US CLOUD Act: what it means for companies in Switzerland"
description: "What the 2018 CLOUD Act requires, why the location of a data centre is not enough, and which questions you can put to a provider."
url: https://elchi.dev/en/wissen/cloud-act
language: en
---

[Knowledge](https://elchi.dev/en/wissen)

# The US CLOUD Act: what it means for companies in Switzerland

A data centre in Zurich or Frankfurt sounds like Swiss or European law. For data held by an American provider, that has only been half true since 2018.

As of 8 October 2026 6 min read Samuel Krauss

## What the law requires

The Clarifying Lawful Overseas Use of Data Act, the CLOUD Act for short, was passed in March 2018 as part of a spending bill. It added a provision to US criminal procedure, 18 U.S.C. § 2713: a provider of electronic communication or remote computing services must disclose its customers' content and records within its "possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States".

The last part is the one that matters. Where the disk stands makes no difference to the duty to disclose. What counts is whether the provider is subject to American law and controls the data.

## Where it comes from

At the end of 2013, US investigators demanded from Microsoft the emails of a customer that were stored in a data centre in Ireland. Microsoft refused: an American warrant, it argued, did not reach into Ireland. The case went to the Supreme Court. Before the court decided, Congress passed the CLOUD Act, and on 17 April 2018 the court declared the case moot. The law had answered the question, and against Microsoft's position.

## What has been said about it in Switzerland

In June 2022 the Swiss Federal Data Protection and Information Commissioner advised Suva, the national accident insurer, to reconsider its plans with Microsoft 365, although the data was to be stored in a data centre in Switzerland. His main reason was the theoretically possible access by the American parent company. He treated it as a disclosure of data abroad that could happen even against the will of those responsible in Switzerland. Suva considered the risk highly unlikely; no court has decided the question so far.

## What a provider can do about it

Little. The law lets a provider challenge an order when disclosure would break the law of another country. That option is tied to agreements the United States makes with individual states, such as the agreement with the United Kingdom that has applied since October 2022. Switzerland has no such agreement. A provider's promise to challenge requests is therefore an intention, not a guarantee.

## What you can ask a provider

Who owns the provider, and who owns its parent company? A data centre in Switzerland helps little if the company running it is subject to American law.

Which sub-processors see your data? A European provider may send mail through an American service or keep backups with an American store. The list of sub-processors says so.

Which data is affected? Stored content such as mailboxes and accounts weighs more than a single notification. An honest provider separates the two and names every exception.

## How we handle it

Stored data, meaning accounts, mailboxes, content and databases, sits on our own servers at European providers in Switzerland, Germany, the Netherlands and France. Where we use a service from the United States, we name it: Resend for notification mails, Stripe for EMX payments, Cloudflare for the DNS zones.

## Sources

1.  [18 U.S.C. § 2713, Cornell Law School](https://www.law.cornell.edu/uscode/text/18/2713)
2.  [Understanding the CLOUD Act's expansive reach, Skadden, 2018](https://www.skadden.com/-/media/files/publications/2018/12/understanding_the_cloud_acts_expansive_reach.pdf)
3.  [US Supreme Court dismisses US v. Microsoft as moot, Sullivan & Cromwell](https://www.sullcrom.com/us-supreme-court-dismisses-us-v-microsoft-as-moot-after-cloud-act-signed-into-law)
4.  [EDÖB rät Suva von Microsoft 365 ab, Netzwoche, 15. Juni 2022](https://www.netzwoche.ch/news/2022-06-15/edoeb-raet-suva-von-microsoft-365-ab)
5.  [US-UK bilateral data sharing agreement comes into force October 3, Perkins Coie](https://perkinscoie.com/insights/update/us-uk-bilateral-data-sharing-agreement-comes-force-october-3)

This article explains; it does not advise. For a legal assessment of your case, ask a lawyer.

[Everything on data location and security](https://elchi.dev/en/vertrauen) [How the cluster is built](https://elchi.dev/en/infrastruktur)