United States
US CLOUD Act
Applies to: Any provider subject to US jurisdiction: US companies, and foreign companies with enough US contacts.
Since 2018, a provider subject to US jurisdiction must preserve or disclose data in its "possession, custody, or control" when served with valid US legal process, whether the data is stored in the United States or anywhere else. Where the data sits does not decide it; who controls it does.
The US Department of Justice says the Act did not create new jurisdiction, but that US jurisdiction "is not limited to U.S. corporations, U.S. headquartered companies, or companies owned by U.S. persons." A Canadian owner lowers the exposure; it does not remove it. This site never calls a vendor immune.
Whether a US parent controls data held by its Canadian subsidiary is, in the DOJ's words, "a fact-dependent inquiry." DOJ policy is to seek enterprise data from the enterprise customer first where practical. Canada and the United States announced negotiations on a CLOUD Act agreement in March 2022; none has been signed.
“…regardless of whether such communication, record, or other information is located within or outside of the United States.”
What to check in a listing
- Who owns the vendor, and who owns its parent? (the Owner field)
- Who runs the servers underneath: a US cloud or not? (the Infrastructure field)
- Can you hold the encryption keys, so the provider can only produce ciphertext?
The law and the regulator
- 18 U.S.C. § 2713 (Cornell LII) · checked 2026-10-13
- US DOJ white paper on the CLOUD Act, April 2019 · checked 2026-10-13
- US DOJ CLOUD Act resources · checked 2026-10-13
A summary, not legal advice. Laws change; report a correction.