The US CLOUD Act and European data: the conflict no contract fixes.
The US CLOUD Act can compel US providers to hand over data stored in Europe. Why that clashes with GDPR, why contracts don't solve it, and what does.
The US CLOUD Act can compel US companies to hand over data they control, wherever it is stored, including in Europe. EU data protection authorities say that conflicts with GDPR. No contract can override a law, so the only fix is structural: an operator outside US jurisdiction, keys you hold, and a network that enforces borders. That is what VISUM does.
What the CLOUD Act says.
Passed in 2018, the Clarifying Lawful Overseas Use of Data Act requires US providers to disclose data in their possession, custody or control in response to a valid US order, regardless of whether it is stored inside or outside the United States.
Why Europe objects.
Under GDPR Article 48, a foreign court order alone is not a lawful basis to transfer personal data out of the EU. In 2019 the European Data Protection Board and Supervisor concluded that a CLOUD Act order would generally not meet that test. In 2025, Microsoft told the French Senate it could not guarantee that European customer data would never be handed to US authorities.
Addresses and promises.
Storing data in a European region does not change who controls it. A contract clause saying the provider will resist does not bind a US court. Encryption helps only if the provider cannot get the keys.
Control, keys and borders.
Three things together: an operator that is not subject to US jurisdiction, encryption keys held by the customer, and a network that physically refuses to send data where it is not allowed. VISUM is the third: every packet carries a cryptographic visa for its jurisdiction, and packets without one are dropped at the edge.
Short answers
Straight answers to what investors and partners ask us first.
Yes, if a US company has possession, custody or control of it. Where the server stands does not decide it.
AWS is a US company, so data it controls can be subject to US orders. Whether European subsidiaries can refuse is an open legal question.
No. It governs commercial data transfers; it does not stop a US authority from issuing a CLOUD Act order.
See it working.
We show the PRISM proof of concept live, and share the technical brief and data room with qualified investors and partners.
Nothing on this website is an offer to sell or a solicitation to buy securities.