> For the complete documentation index, see [llms.txt](https://docs.glbnxt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.glbnxt.com/platform/security-and-compliance/data-location-is-not-data-control.md). # Data Location Is Not Data Control A common assumption in cloud security is that storing data in a European data centre is sufficient to guarantee European data sovereignty. It is not. The physical location of data and the legal control over that data are two fundamentally different things, and conflating them creates a false sense of compliance. When an organisation stores data with a provider headquartered in the United States, that data remains subject to US jurisdiction regardless of where it is physically hosted. This is the direct consequence of the US Clarifying Lawful Overseas Use of Data Act, commonly known as the CLOUD Act, enacted in March 2018. The CLOUD Act grants US law enforcement agencies the authority to compel any US based company to disclose data in its possession, custody, or control, even when that data resides on servers located in the European Union. The law applies to the corporate entity, not the data centre address. This creates an irreconcilable conflict with the European General Data Protection Regulation. Article 48 of the GDPR explicitly states that court orders or judgments from third country authorities are not, in themselves, a lawful basis for transferring personal data out of the EU. The European Data Protection Board has confirmed this position, concluding that service providers subject to EU law cannot legally base the disclosure of personal data to US authorities on CLOUD Act requests alone. Yet the CLOUD Act requires precisely that, and it does so without requiring notification to the affected data subject or cooperation with European judicial authorities. The practical consequence is stark. A US headquartered cloud provider operating data centres in Frankfurt, Amsterdam, or Paris is still legally obligated to comply with a US government data access request. Contractual commitments to challenge such requests, while commercially reassuring, are subordinate to the provider's obligations under US federal law. The CJEU's Schrems II ruling invalidated the EU US Privacy Shield on exactly this basis: US surveillance law provides access to European personal data in ways that are incompatible with GDPR, and European citizens lack effective judicial redress within the US legal system. #### Why GLBNXT Works Exclusively with European Vendors GLBNXT addresses this structural conflict at its root. Rather than relying on contractual workarounds or data residency configurations layered on top of US controlled infrastructure, GLBNXT exclusively partners with technology vendors that are headquartered in Europe and operate under European legal jurisdiction. This is a deliberate architectural decision, not a preference. When every vendor in the supply chain is a European legal entity, no component of the platform is subject to the CLOUD Act or any equivalent extraterritorial data access legislation from non European governments. There is no corporate parent in a foreign jurisdiction that could be compelled to hand over data. There is no legal mechanism through which a non European authority can bypass European courts to demand access to information processed on the GLBNXT platform. This approach delivers sovereignty that is structural rather than contractual. It means that GDPR, NIS2, and other European regulatory frameworks are the sole applicable data protection regime, without conflict from foreign legislation. It means that data access requests can only be made through proper European legal channels, with full judicial oversight and due process protections for data subjects. And it means that the organisations using GLBNXT do not inherit the compliance risk that comes with any dependency on a US controlled provider. For organisations operating in regulated sectors, handling sensitive public sector data, or simply taking their GDPR obligations seriously, this distinction between data location and data control is not academic. It is the difference between a sovereignty claim and a sovereignty guarantee. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.glbnxt.com/platform/security-and-compliance/data-location-is-not-data-control.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.