TrackVPS › Private AI › CLOUD Act and VPS
The CLOUD Act: which VPS providers it clearly covers
Published 21 October 2026Company facts checked 21 October 2026By Can
A US provider must hand over your data to US authorities when ordered, even if your server is in Europe. So the question is not "where is my server?" but "who runs it?" Here is the answer for the 14 providers we track.
Not legal advice. We may earn a commission if you buy through our links.
What the law says
The CLOUD Act passed in 2018. The key line is in 18 U.S.C. § 2713. A provider must preserve or disclose data "within such provider's possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States."
In plain words: if the company controls your data, the location does not matter. The US Department of Justice keeps its own CLOUD Act resources page if you want the official side.
What this means when you rent a VPS
4 of the US companies we track sell servers in Europe: RackNerd, IONOS, AWS Lightsail, DigitalOcean. A server in Frankfurt or Amsterdam from them is still a server run by a US company.
If you want your data outside that reach, the first filter is the company, not the datacentre. That is why our EU cloud providers list shows the legal entity and its source page for each provider.
What EU ownership does not fix
- The law says "a provider", not "a US provider". Whether it reaches a European company depends on its ties to the US. We do not assess that, and we did not check for US subsidiaries.
- EU providers still answer to their own police and courts.
- The host controls the hardware. Encrypt what matters and keep the keys yourself.
Questions
What is the CLOUD Act?
A US law from 2018. The part that matters for hosting is 18 U.S.C. § 2713: a provider must hand over data in its 'possession, custody, or control' when US authorities order it, even if the data is stored outside the United States.
Which VPS providers are US companies?
Of the 14 we track, 7 have a US contracting company on the link we use: RackNerd, Kamatera, IONOS, AWS Lightsail, DigitalOcean, Akamai (Linode), Vultr. IONOS is a German group, but its ionos.com offer is sold by IONOS Inc. (Delaware). Kamatera's terms name Kamatera Inc. (US) for US customers; buyers in other regions may contract with another group company.
Does hosting in Frankfurt protect me from the CLOUD Act?
Not if the provider is a US company. The law is about control, not location. A European datacentre run by a US company is still run by a US company.
Are EU-owned providers safe from it?
The law's text says 'a provider', not 'a US provider'. Whether it reaches a European company depends on that company's ties to the US, which we do not assess. EU providers still answer to their own country's police and courts. This is not legal advice.