Contents
Using US SaaS remains legal for EU companies: since July 2023, an adequacy decision covers US firms certified under the Data Privacy Framework. But that framework is being challenged before the EU Court of Justice, and the CLOUD Act applies even to data stored in Europe: for sensitive data, prefer a European host.
Your CRM, HR tool or support platform may well be published by a US company. Is that a problem for your sensitive data? The honest answer is “it depends on the data”, and the legal framework has shifted several times in ten years. Here is where it stands today for companies subject to the GDPR, the concrete risks, and how to decide tool by tool. This page is factual and points to official texts (checked in October 2026): it does not replace advice from a lawyer or your data protection officer.
The legal framework as of October 2026
In principle, the GDPR prohibits transferring personal data outside the European Union unless the destination country offers a level of protection deemed adequate or appropriate safeguards are in place (Chapter V of Regulation (EU) 2016/679).
For the United States, the history is eventful. The Privacy Shield was struck down by the EU Court of Justice in 2020 (the Schrems II ruling). On July 10, 2023, the European Commission adopted a new adequacy decision: Implementing Decision (EU) 2023/1795, known as the Data Privacy Framework.
The CNIL’s questions and answers on US adequacy (in French) highlight two points:
- the decision only covers US companies that are certified and appear on the official list;
- for the others, appropriate safeguards are required (standard contractual clauses, for example) along with a case-by-case assessment of the level of protection.
The framework is under challenge. The EU General Court dismissed French MP Philippe Latombe’s action for annulment on September 3, 2025 (case T-553/23). An appeal was lodged with the Court of Justice at the end of October 2025; to my knowledge, it had not been decided at the time of writing. An invalidation, as in 2020, would force companies to rework their contracts overnight.
| Vendor situation | Legal basis for the transfer | What you need to do |
|---|---|---|
| US-based, certified under the Data Privacy Framework | Adequacy decision 2023/1795 | Check the certification, record it in your processing register |
| US-based, not certified | Standard contractual clauses or another Article 46 safeguard | Sign the clauses, assess the level of protection |
| European, hosted in the EU, no parent company outside the EU | No transfer outside the EU | Standard GDPR data processing agreement |
| SecNumCloud-qualified offering | No transfer, protection against non-EU laws | For the most sensitive needs |
The point people forget: the CLOUD Act
Many US vendors offer “European hosting”. It helps, but it does not solve everything. The CLOUD Act, passed in 2018, amended US law to require providers to disclose data in their possession, custody or control, whether that data is located inside or outside the United States, as the US Department of Justice white paper explains.
These requests go through a legal process and target specific investigations: this is not open access. But for trade secrets, health data or a sensitive case file, the mere possibility may be unacceptable to you or to your clients.
That is the purpose of ANSSI’s SecNumCloud qualification: its FAQ (in French) states that the provider must be subject exclusively to EU law, with headquarters in the EU, non-European shareholders in the minority and data located in the EU.
Assessing the risk, data type by data type
The right reflex is not to drop everything, but to classify:
- Everyday data (calendars, ordinary sales correspondence): a certified US SaaS is generally acceptable, with clean documentation.
- Sensitive personal data (health, detailed HR records, opinions): needs a close look. In France, for example, hosting personal health data falls under a specific regime requiring a certified host, set out in Article L1111-8 of the French Public Health Code.
- Trade secrets (formulas, negotiated prices, plans): the risk is not only legal, it is strategic.
- Client requirements: more and more large accounts and public buyers ask where the data sits and under which jurisdiction.
What custom software allows, and what it costs
A custom application lets you choose the host: a European provider, a specific region, or even a qualified offering if needed. The code and data belong to you, which makes changing host easier later. My usual stack (Supabase, PostgreSQL) can be hosted in the EU; the exact choice of host and its ownership structure is made during scoping, based on how strict your requirements are.
| Need | Price reference | Timeline |
|---|---|---|
| Review an existing tool and its data flows | Express audit $660 (€589)excl. VAT, full audit $2,300 (€1,990)excl. VAT | A few days to 7 days |
| Focused business app replacing a SaaS for sensitive data | $6,800 to $22,400 (€6,000–€20,000)excl. VAT | 1 to 3 months |
| Migrating data from the current tool | Data migration module: $900 (€800)excl. VAT in the estimator | Within the schedule |
Hosting remains your cost, from a few tens to a few hundred euros a year depending on the offering. The estimator gives you a range for your case, and the page on hosting your data in France or the EU details the options.
When to keep your US SaaS
I will be straightforward: for most office, video conferencing or marketing tools, a certified US vendor remains a reasonable choice, and replacing it would cost more than the risk. Keep it if the data is ordinary, the vendor is certified, your contracts are up to date and no client requires otherwise. Custom software makes sense for a defined scope: the HR module, the sensitive client file, the tool that handles your trade secrets. It can also extend existing software without replacing it.
Where to start
- List your tools and, for each one, the vendor’s country, hosting location and type of data.
- Check the certification of US vendors on the official list, and your contractual clauses.
- Isolate the truly sensitive data: that is what may justify a dedicated tool.
- Have the analysis reviewed by your data protection officer or a lawyer, then price the custom option for that scope only.
Frequently asked questions
Is a US SaaS hosted in a European data center shielded from US law?
Not entirely. According to the US Department of Justice, the CLOUD Act requires providers subject to US law to disclose data in their possession, custody or control, wherever it is stored. Hosting in Europe reduces other risks, but not that one.
How do I check whether a US vendor is covered by the Data Privacy Framework?
The French data protection authority (CNIL) advises checking the official US Department of Commerce list at dataprivacyframework.gov and reviewing the company’s entry: which entities are covered, subsidiaries included, and which categories of data (commercial, HR). If the vendor is not listed, other safeguards are needed, such as standard contractual clauses.
Should we drop all our US tools?
No. For email, video calls or a CRM without sensitive data, the risk is often acceptable and can be documented. The question mainly arises for health data, detailed HR data, trade secrets, or when a client or public tender requires it.
What is SecNumCloud?
It is a qualification issued by ANSSI, the French national cybersecurity agency, to cloud offerings that meet a demanding standard, including criteria to protect data from non-EU laws: headquarters in the EU, majority European ownership, data located in the EU. It is mainly required in the public sector and for highly sensitive data.