How to ask your cloud act email provider the right questions, in writing

What you will get out of this

If your company runs its mail, calendar and files on Microsoft 365 or Google Workspace, you probably already know the word CLOUD Act from a compliance newsletter or a nervous conversation with your legal team. What most companies never do is actually write down the questions and send them to their provider. This guide gives you that list: who to send it to, what each question is really testing, and how to read the answers you get back.

This is not about catching your provider in a lie. Microsoft and Google build good products and employ serious security teams. The issue sitting underneath a cloud act email provider question is jurisdiction, not product quality: which country's courts can order that provider to hand over your data, and whether your contract or your region setting changes that answer. Asking the question in writing turns a vague worry into a documented position you can show a client, an auditor, or your own board.

Prerequisites and assumptions

Before you send anything, get three things in order.

• Know who your provider legally is. If you buy Microsoft 365 through a reseller or a managed service provider, your questions may need to go to that reseller first, who then has to go to Microsoft. Find out your actual contracting entity before you write a single email.
• Know what data you are asking about. Mailbox content, calendar entries, Teams or Meet transcripts, OneDrive or Drive files, and metadata like sender and recipient lists can all be treated differently in a provider's own policies. Be specific about which one you mean.
• Accept that some answers will be legally careful, not evasive. A large US provider's legal team will often answer in the language of its own policy documents. That is normal. Your job is to compare what they say against the law, not against what you hoped to hear.

If you want the background on why this question exists at all, the legal mechanics are covered in more detail in our earlier piece on whether your email is still GDPR compliant next year. This article assumes you already understand roughly what the CLOUD Act is and focuses on getting a documented answer from your own supplier.

Step by step: the questions to send, and why

Send these as a numbered list in an email or a formal request for information, addressed to your account manager with a request to forward to legal or compliance if needed. Ask for written answers, not a call. A call gives you reassurance; a written answer gives you a paper trail.

Question 1: which legal entity is our data processor, and in which country is it incorporated?

This sounds basic, but it is the whole question in one line. The CLOUD Act applies to a provider based on where the company is incorporated and subject to US jurisdiction, not on where the servers sit. If the answer names a US parent company, such as Microsoft Corporation or Google LLC, as the entity with ultimate control over the data, you have your answer regardless of what comes next.

Question 2: does storing our data in an EU data region change which country's law enforcement can compel disclosure?

Ask this one explicitly, because providers often advertise "EU data boundary" or "data residency in Europe" features in a way that can be read as a sovereignty guarantee. It is not. Choosing a European data region decides where the bytes are stored. It does not change which company holds the keys and which country's courts can order that company to produce the data. Ask the provider to confirm this distinction in writing.

Question 3: have you ever received a request for our company's data from a US authority, and would you be able to tell us if you had?

Many such requests come with a gag order attached, meaning the provider is legally barred from telling the customer it happened. Ask directly whether the provider could notify you, and under what circumstances it could not. A provider that cannot promise to tell you is not being difficult, it is describing the law as it stands. You want that in writing so you understand the real limit of your own visibility.

Question 4: can you guarantee our data will never be disclosed to the US government without our consent or the consent of our national authorities?

Ask this one exactly as written, because it has already been asked and answered once in public. On 10 June 2025, Anton Carniaux, director of public and legal affairs of Microsoft France, testified under oath before a French Senate inquiry. Asked whether he could guarantee that data entrusted to Microsoft through the French public purchasing body UGAP would never be transmitted on a US government order without explicit French agreement, he answered: "Non, je ne peux pas le garantir," and added that it had never happened so far. Both halves of that answer matter: no guarantee, and no known incident to date. If your provider gives you a similarly careful answer, that is consistent with the law, not a red flag specific to them.

Question 5: what is the current legal basis for transferring our personal data to the United States?

Under GDPR, personal data can only leave the European Economic Area on the basis of an adequacy decision or appropriate safeguards such as standard contractual clauses. Ask your provider to name the mechanism they rely on today. As of this writing, the answer for most US providers will be the EU-US Data Privacy Framework, adopted by the European Commission on 10 July 2023.

Question 6: is that legal basis currently being challenged, and what happens to our data if it is struck down?

This is the question that separates a careful compliance posture from a hopeful one. The Data Privacy Framework is the third attempt at an EU-US transfer mechanism. Safe Harbor was struck down by the Court of Justice of the EU in 2015. Privacy Shield was struck down in 2020, when the court found that US surveillance law gave EU citizens no effective remedy. The Data Privacy Framework itself is under challenge right now: the EU General Court dismissed an action against it on 3 September 2025, the applicant appealed on 31 October 2025, and that appeal is pending before the Court of Justice with no judgment yet. Ask your provider what their contingency plan is if history repeats a third time. A good answer describes a concrete fallback. A weak answer restates that the current framework is valid today, which is true but does not answer the question.

Question 7: can a US court order override our European data processing agreement?

GDPR Article 48 states plainly that a court order or government demand from a third country does not by itself make a data transfer lawful. Ask your provider to confirm, in writing, that they understand this and how they reconcile it with their obligations under US law when the two conflict. This is the clause most providers will answer carefully, because the honest answer is that the conflict is real and the provider cannot promise to resolve it in your favor every time.

Question 8: who, specifically, can access our mailbox and file content, and under what process?

Ask for the internal process: does access require a warrant, a subpoena, a court order, and is there an internal legal review before compliance? This tells you whether a request would ever be challenged on your behalf, versus fulfilled automatically.

Once you have these eight answers in writing, file them with your data processing records. You now have something concrete to show a client, an auditor, or your own board, instead of a vague sense that things are probably fine.

Verification: how to tell if the answers actually hold up

Reading the answers is only half the job. Here is how to check them against reality rather than against the provider's own marketing language.

• Check the entity named, not the brand. "Microsoft" and "Google Workspace" are brands. The entity that matters is the contracting company: Microsoft Corporation (Redmond, Washington) or Google LLC (Mountain View, California). If the written answer only uses the brand name, ask again for the legal entity.
• Cross-check the transfer mechanism against the European Commission's own adequacy decisions. If your provider claims a mechanism other than the Data Privacy Framework or standard contractual clauses, verify it exists before accepting it.
• Look for the word "cannot guarantee" rather than treating it as a failure. As shown by Microsoft's own testimony under oath, the accurate legal answer from any US-jurisdiction provider is that it cannot be guaranteed. A provider that says this is being honest. A provider that promises an unconditional guarantee is the one to be suspicious of.
• Confirm your region setting does not get reclassified as a safeguard. If the written answer leans on "EU data boundary" as the reassurance, that is a residency feature, not a jurisdiction change, and should be flagged back to the provider for clarification.
• Date-stamp every answer. Given that the Data Privacy Framework itself is under active legal challenge, an answer that is accurate today may need revisiting within a year. Put a review date on the file, not just a filing date.

If you want a broader version of this exercise that covers more than just your email provider, our 12-question sovereignty audit for DPOs walks through the same logic across your whole supplier stack.

Common pitfalls to avoid

• Accepting a sales answer instead of a legal one. Account managers are not always equipped to answer jurisdiction questions precisely. Ask for the response to come from or be reviewed by legal or compliance.
• Treating "we have never received a request like this" as a guarantee for the future. It is a historical fact, not a commitment. Keep both halves of that kind of answer on file.
• Confusing data residency with data sovereignty. A European data center does not change who can be legally compelled to hand over the data. This is the single most common point of confusion in these conversations.
• Asking once and filing it forever. Legal frameworks between the EU and US have been struck down twice already. Treat this as a question you revisit annually, not a box you tick once.

Next steps and related reading

Once you have the written answers, you have three realistic paths: stay with your current provider and document the risk as accepted, negotiate contractual language that goes beyond the standard terms, or move the parts of your daily work that carry the most sensitive data to a European alternative to Google Workspace or a Microsoft 365 alternative that is not itself a US-jurisdiction company.

If you are the one deciding which path makes sense for your organization, two of our other articles are useful background. Choosing between US and EU cloud providers goes deeper into why the Data Privacy Framework might not survive its current legal challenge, and what that means for planning. Understanding what an Outlook alternative actually needs to do to keep mail in Europe covers the practical checklist for evaluating a replacement mail system, beyond just where the servers sit.

Worth noting: Switzerland is neither an EU nor an EEA member, and transfers there are lawful under an EU adequacy decision. A Swiss provider answers to Swiss law, not EU or US law, which is a useful comparison point when you are mapping out what "jurisdiction" actually changes in practice.

A European option that removes the question entirely

There is a simpler way to answer all eight questions above: use a provider that is not under US jurisdiction in the first place. Binadit Workspace is mail, calendar, contacts, drive, office documents, video meetings and appointment scheduling, built and run by Binadit B.V. in Rotterdam, a 100% Dutch-owned company with no foreign parent. Every server runs in the Netherlands, in data centers of European companies, operated by Binadit itself with no supplier outside the EU involved. Because Binadit is Dutch, with no American parent and no outsourced infrastructure, the CLOUD Act does not apply to it, and the question of what happens if the Data Privacy Framework is struck down a third time simply does not arise.

If you want to see how it handles your actual mail flow, shared mailboxes, meetings and file sharing before you decide anything, ask for a demo and a quote, and we will walk through your current setup directly.