Skip to Content


 US CLOUD Act

The Clarifying Lawful Overseas Use of Data (CLOUD) Act of 2018 changed the rules for American tech giants (such as Microsoft, AWS, and Google).

  • Global reach: Previously, companies could refuse to disclose data stored on servers outside the U.S. (e.g., in an Amsterdam data center). The CLOUD Act mandates that U.S.-based companies must provide data under their control, regardless of where the server is physically located.


  • The encryption link: If a U.S.-based provider manages the encryption keys—as is the case with standard cloud storage—they are legally required to use those keys to provide the authorities with readable data upon receiving a valid warrant.
us a flag on gray concrete building

PRISM en Section 702 (FISA)

PRISM is a program under the Foreign Intelligence Surveillance Act (FISA), specifically section 702. 

While the CLOUD Act is primarily focused on criminal investigations, PRISM is aimed at foreign intelligence.

  • Direct access: Under PRISM, U.S. intelligence agencies (such as the NSA) can collect communications that flow through the servers of American internet companies.


  • Compelled cooperation: Companies can be secretly compelled to create technical "backdoors" or share keys, often accompanied by a gag order (a prohibition on speaking that prevents them from informing the customer).

The Cloud Security Paradox

Although encryption is often seen as a universal solution, the way keys are stored determines whether you are legally protected against U.S. legislation such as the CLOUD Act.

Encryption at Rest

Standard Cloud-encryption

In this scenario, the cloud provider manages the entire security chain. While data is encrypted on their disks, the provider holds the keys required to decrypt that data for maintenance or backup purposes.




The risk: Because the provider possesses the technical means to decrypt your data, they are legally obligated under the CLOUD Act to surrender it in an unencrypted format if ordered by U.S. authorities. This poses a significant risk to your data sovereignty.

Bring Your Own Key - BYOK

Bring your own key

Here you generate a key yourself as an organization and "lend" it to the cloud provider so they can run your applications. This feels safer, but there is a catch: the key is still in the provider's infrastructure to process the data.

The risk: The provider still retains functional access. In the event of a legal conflict, they could be compelled to utilize the keys residing within their system to grant access. Consequently, the risk remains moderate: while you have gained more control, the underlying legal vulnerability persists.

(Hold Your Own Key - HYOK)

Keeping the key under your own control

This is the only method where the organization maintains full control of the encryption keys entirely outside the cloud environment. Data is encrypted before it leaves your secure perimeter and is transmitted to the cloud.

The cloud provider only sees unreadable "noise" and never has access to the key.



The risk: This scenario presents a low risk. Even if the provider receives a subpoena, they simply cannot decrypt the data. They can only hand over a stack of encrypted files that U.S. agencies cannot do anything with without your key.

For organizations subject to strict European privacy regulations (GDPR), transitioning from 'provider trust' to HYOK (Hold Your Own Key) is often the only way to effectively block the extraterritorial reach of U.S. legislation.

Data breach