CLOUD Act: why your Swiss data may not be as Swiss as you think.

Many Geneva businesses believe their data is protected because it's "hosted in Europe". The legal reality is more subtle, and it's worth understanding, especially when handling sensitive data.

You chose a serious provider. Your servers sit in a European datacenter, perhaps even a Swiss one. On paper, your data never leaves the continent. And yet, depending on who actually operates those servers, it can remain accessible to a foreign authority. That's the whole paradox of the CLOUD Act, a US law still poorly understood on this side of the Atlantic.

What the CLOUD Act actually says

Passed in the United States in 2018, the Clarifying Lawful Overseas Use of Data Act allows US authorities to require a company subject to US law to hand over the data it holds — regardless of which country that data is physically stored in.

In other words: if your files are hosted by a major US provider, it makes no difference whether the servers are in Frankfurt, Dublin, or Geneva. The company remains obliged to respond to a request issued under US authority. The datacenter's geographic location, a common sales argument, is therefore not a genuine legal protection.

Choosing a European datacenter isn't enough: what matters is who legally holds the key.

Why this concerns Swiss SMEs too

These issues are often assumed to only affect multinationals. That's wrong. A Geneva law firm storing client files, a medical practice holding health records, a fiduciary managing financial information: all of them handle data whose confidentiality isn't just expected, but often legally required.

For these professions, the question isn't theoretical. Entrusting this information to infrastructure subject to a foreign jurisdiction means accepting a grey area that a savvy client, or a regulator, could one day hold against you.

In June 2025, a public confirmation

For a long time, this risk was presented as purely hypothetical. Then, before the French Senate, a Microsoft France executive publicly acknowledged being unable to guarantee that European clients' data would escape a request from US authorities. A statement that made headlines, because it confirmed in black and white what lawyers had been saying for years.

This wasn't an admission of bad faith on the company's part: it's simply a consequence of the law. As long as a provider falls under US jurisdiction, it cannot promise the opposite of what the law requires of it.

What genuine sovereignty actually means

Data sovereignty isn't just a datacenter's postal address. It depends on three cumulative conditions:

• Location: the data is physically located in Switzerland.
• Jurisdiction: the company operating it falls solely under Swiss law, with no ownership or contractual link to a company subject to US law.
• End-to-end control: no foreign subcontractor quietly involved in the hosting or maintenance chain.

It's this combination that makes the difference between advertised sovereignty and sovereignty actually delivered. At F6, we operate our own infrastructure in a Geneva datacenter, with no intermediary subject to foreign law. Your data stays under Swiss jurisdiction alone — not as a marketing promise, but as a direct consequence of our structure.

What should you actually do?

The first step is simple: know where your data actually is and who can access it. Many executives discover, simply by asking the question, that their own provider relies on a US supplier. That's not necessarily a problem for every piece of data, but it should be a conscious choice, not a blind spot.

For sensitive information, switching to genuinely sovereign infrastructure is often simpler and less costly than feared. It always starts with an honest assessment of your current situation.