Why the parent company decides jurisdiction, not the server location

Legal reach over data follows who controls the provider, not where the servers sit. Why EU servers alone don't make a service EU-sovereign.

Updated By enum

The jurisdiction that matters for your data is the jurisdiction of the company that controls it. A server in Frankfurt run by a subsidiary of a US company can still be reached by US legal process through the parent. A server in a US data centre run by an EU company with no foreign owner answers to EU law through its operator. This is why staysin.eu classifies providers by who owns and operates them, and treats the physical server location as information, not as the verdict.

What does data sovereignty mean on staysin.eu?

On staysin.eu, sovereignty is not the rule that bits must never leave the EU. It is the question of who has control over the data processing when something happens. Put concretely: who can be legally compelled to hand over the data, to intercept it, or to deny access to it?

Courts and authorities issue orders to legal persons, not to buildings. A disclosure order goes to a company, and that company is expected to produce the data it controls. So the useful question is which companies sit between you and your data, and which governments can give those companies orders.

Why aren't EU servers enough?

The US CLOUD Act of 2018 added section 2713 to the Stored Communications Act. It requires US providers of electronic communication or remote computing services to preserve, back up or disclose data "within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States." The test in the statute is possession, custody or control. The location of the data is expressly not the test.

Section 702 of the Foreign Intelligence Surveillance Act (50 U.S.C. § 1881a) is a second route. It allows US intelligence agencies to target non-US persons reasonably believed to be outside the United States, and to direct electronic communication service providers to assist. The people whose data is collected under Section 702 are by definition located abroad, so moving the servers abroad does not take a provider out of its scope.

The Court of Justice of the EU examined these programmes in Schrems II (case C-311/18, judgment of 16 July 2020). The Court found that Section 702 and related US surveillance programmes were not limited to what is strictly necessary and did not give EU data subjects actionable rights before an independent body. On that basis it invalidated the EU-US Privacy Shield adequacy decision. The European Commission adopted a new adequacy decision, the EU-US Data Privacy Framework, in July 2023. That decision governs transfers of personal data; it does not change which companies US law can compel.

EU law pushes in the other direction. Article 48 GDPR says a third-country court judgment or authority decision requiring a controller or processor to disclose personal data is only recognised or enforceable if it is based on an international agreement, such as a mutual legal assistance treaty. A provider that is subject to both systems can therefore receive an order under one that the other does not recognise. Where the parent company sits decides whether that conflict can arise at all.

Legal reach follows contractual and corporate control, not the physical location of the bytes. "Hosted in Germany" describes where a disk is. It does not say who can be ordered to read it.

How does staysin.eu decide if a provider is EU?

A provider counts as EU only when all three of these criteria hold:

  1. Country: the provider's operational country is an EU member state.
  2. Holding: the provider has no parent or holding company outside the EU.
  3. Own infrastructure: the provider runs its own production stack and does not resell a non-EU service.

The second criterion covers foreign ownership. A non-EU-owned subsidiary is non-EU regardless of where it operates, because foreign authorities can direct an order at the parent. This applies to any non-EU parent, including UK, Swiss and EEA parents, since staysin.eu counts only the 27 EU member states as EU.

The third criterion covers resellers. An EU-branded CDN that delivers through a non-EU CDN, or an EU SaaS that runs entirely on a non-EU cloud platform, is non-EU. The EU company is the contractual party, but operational control, and with it legal reach, sits with the underlying contractor. Mixed setups, where a provider has a small footprint of its own but resells third-party capacity for most of its delivery, are classified as resellers.

What do real examples look like?

These entries come from the curated provider database that staysin.eu uses for every check.

  • HostEurope operates in Germany and is classified non-EU: "Owned by GoDaddy (US) – subject to US legal process despite German operations."
  • Hosting Concepts operates in the Netherlands and is classified non-EU. The database records that it has been owned by CSC Global (US) since 2019 and operates the Openprovider brand: "CLOUD Act reach via the US parent despite Dutch operations."
  • Dogado (Germany) and One.com (Denmark) are both classified non-EU: "Part of group.one (UK/Canada PE owners)."
  • Loopia operates in Sweden and is classified non-EU: "Owned by Visma (Norway, EEA but not EU)."
  • Jimdo is a German company classified as a reseller: "German brand, but runs on AWS, Cloudflare, and Google Cloud. EU contractual party, fully non-EU operational stack."
  • Bunny.net is a Slovenian company classified as a reseller: "Slovenian company, but most of its CDN delivery runs on infrastructure operated by DataCamp Limited (UK)."

The rule also works in the other direction. An EU hoster with no non-EU parent that runs its own servers in a US data centre is classified EU. The box is in the US, but legal compulsion runs through the EU operator.

How does staysin.eu show this in a check result?

When you check a domain, for example staysin.eu/example.com, staysin.eu identifies the operator of the hosting, DNS, mail, CDN and third-party services. It matches each one against its provider database using ASNs, hostnames and HTTP headers, validated against PeeringDB.

The verdict for a matched provider comes from the curated EU flag, which combines the three criteria above. The IP geolocation of the server is shown next to it but does not change the verdict. When the two differ, the result shows both, for example "EU · Germany via United States". When a provider is non-EU only because of its owner or its reseller status, the verdict reads "Non-EU control", so the EU country name is not mistaken for the problem. Server location is the one check that is pure IP geolocation, because it is the physical-location data point.

The provider database is curated by hand, and ownership changes. Each entry carries the date it was last reviewed, and providers not in the database fall back to IP geolocation. The full rules are on the methodology page, and aggregate results across checked domains are on the stats page.

Is this legal advice?

No. staysin.eu is a technical indicator based on public data and fixed classification criteria, not a legal audit. Whether a specific order can reach a specific provider depends on facts and law that a check from outside cannot see.

Sources