{"id":404,"date":"2026-10-05T22:27:08","date_gmt":"2026-10-05T20:27:08","guid":{"rendered":"https:\/\/mu.klytic.com\/?page_id=404"},"modified":"2026-10-06T10:10:23","modified_gmt":"2026-10-06T08:10:23","slug":"protect-business-cloud-act","status":"publish","type":"page","link":"https:\/\/mu.klytic.com\/en\/protect-business-cloud-act\/","title":{"rendered":"How can a business protect itself from the CLOUD Act?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-page\" data-elementor-id=\"404\" class=\"elementor elementor-404 elementor-336\" data-elementor-post-type=\"page\">\n\t\t\t\t<div class=\"elementor-element elementor-element-07def0d e-con-full kly-g e-flex e-con e-parent\" data-id=\"07def0d\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-ad985c7 e-con-full kly-g-hero e-flex e-con e-parent\" data-id=\"ad985c7\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-572927d e-con-full kly-g-hero-in e-flex e-con e-parent\" data-id=\"572927d\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7d79020 elementor-widget elementor-widget-text-editor\" data-id=\"7d79020\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-crumb\"><a href=\"\/en\/\">Home<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/\">Guides<\/a><span>\u203a<\/span><a href=\"\/en\/guides\/#souverainete\">Sovereignty<\/a><\/p><p class=\"kly-g-pill\" style=\"--pill:#38bdf8\">Sovereignty<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fb1d53c elementor-widget elementor-widget-heading\" data-id=\"fb1d53c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"heading.default\">\n\t\t\t\t\t<h1 class=\"elementor-heading-title elementor-size-default\">How can a business protect itself from the CLOUD Act?<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-12826de elementor-widget elementor-widget-text-editor\" data-id=\"12826de\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-lead\">A business protects itself from the CLOUD Act by choosing who holds its data, not merely by moving its servers. The 2018 US law allows a US authority, in the course of a proceeding, to require a provider subject to US jurisdiction to produce the data that provider holds or controls, including when that data is stored outside the United States. It does not create automatic access to European datacenters.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-6585173 elementor-widget elementor-widget-text-editor\" data-id=\"6585173\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p class=\"kly-g-meta\"><span>Updated <b>October 2026<\/b><\/span><span><b>10 min<\/b> read<\/span><span>Official sources cited<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-9a17a86 e-con-full kly-g-body e-flex e-con e-parent\" data-id=\"9a17a86\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t<div class=\"elementor-element elementor-element-17aeb7f e-con-full kly-g-article e-flex e-con e-parent\" data-id=\"17aeb7f\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4e09eda elementor-widget elementor-widget-text-editor\" data-id=\"4e09eda\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What the law does, and what it does not do<\/h2><p>The CLOUD Act (Clarifying Lawful Overseas Use of Data Act) amends US law on stored communications. Three limits help avoid misreadings.<\/p><ul><li>It targets a provider subject to US law. A French company that operates its own servers is not, on that basis alone, the recipient of a US order.<\/li><li>It presupposes a proceeding. It is not a permanent copy of European email services sent to a US administration.<\/li><li>It does not disappear because the disk is in Amsterdam, Dublin or Paris, as long as the US provider has possession or control of the data.<\/li><\/ul><p>The real risk is therefore narrower than is often claimed, and more lasting: a targeted request, addressed to the provider, in the course of a proceeding.<\/p><p>The law also provides for agreements between governments to govern certain cross-border requests. This aspect does not change the purchasing question: who, in your chain, is a US provider with control of the data?<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8bdd498 elementor-widget elementor-widget-text-editor\" data-id=\"8bdd498\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>How an order applies<\/h2><p>The order is addressed to the provider and covers the data in its possession or control. The customer then depends on what the provider does with the request.<\/p><p>Under 18 U.S.C. \u00a7 2703(h), the provider may move to quash or modify the order if it believes that the customer is not a \u201cUnited States person\u201d, does not reside in the United States, and that disclosure would create a material risk of violating the laws of a \u201cqualifying foreign government\u201d. It has 14 days after service to do so.<\/p><p>A \u201cqualifying foreign government\u201d is a country that has concluded an executive agreement with the United States that has entered into force. The US Department of Justice publishes agreements with the United Kingdom, signed on 3 October 2019, and with Australia, signed on 15 December 2021. No agreement is in force with the European Union; EU\u2013US negotiations on electronic evidence resumed in 2023. The Department\u2019s page mentions no agreement with France.<\/p><p>The consequence: the challenge mechanism specific to \u00a7 2703(h) presupposes such an agreement. A French business should not count on this remedy as an established protection.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0bad22a elementor-widget elementor-widget-text-editor\" data-id=\"0bad22a\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Why the location of the disk is not enough<\/h2><p>The law\u2019s criterion is control, not geography. Take an industrial SME with two sites that has chosen a European data region with a US software vendor. Its messages are stored in Europe. But the company that administers the service and can restore a mailbox remains American. Faced with an order, the storage region does not change the question: are these data under its control?<\/p><p>On 10 June 2025, before the French Senate commission of inquiry on public procurement, the director of public and legal affairs of Microsoft France was asked whether he could guarantee under oath that the data of French citizens entrusted to Microsoft via Ugap would never be transmitted, following an order from the US government, without the explicit consent of the French authorities. His answer: \u201cNo, I cannot guarantee it, but, once again, it has never happened yet.\u201d Both halves of the sentence matter. The first describes the legal framework; the second, the practice observed by the company.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-86036fc elementor-widget elementor-widget-text-editor\" data-id=\"86036fc\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>The conflict with the Data Protection Act 2017<\/h2><p>Mauritian law approaches the question from the other end. Under section 36 of the Data Protection Act 2017, a transfer of personal data outside Mauritius is permitted only with demonstrated appropriate safeguards, the explicit consent of the individual, or where it is necessary in one of the cases provided for by law, such as the performance of a contract or a legal obligation.<\/p><p>In Mauritius, the Data Protection Act 2017 is enforced by the Data Protection Office, headed by the Data Protection Commissioner (section 4). It applies to controllers and processors established in Mauritius or using means of processing there, and a controller not established in Mauritius must appoint a representative there (section 3(5)). No one may act as a controller or processor without being registered with the Commissioner (section 14).<\/p><p>A US provider serving Mauritian clients may therefore find itself caught between two legal systems: a US order on one side, and on the other a Mauritian law that governs any transfer of data out of the country. Section 36 does not settle this conflict on the provider\u2019s behalf. For the buyer, the issue is concrete: ask how this provider handles such a request, whether it challenges it, and whether it informs the customer when the law allows.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7cfa613 elementor-widget elementor-widget-text-editor\" data-id=\"7cfa613\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>The basis for transfers outside Mauritius<\/h2><p>A service from a US software vendor generally involves transfers outside Mauritius: storage in a region located outside the country, support access, escalations. Each must rest on one of the bases in section 36: demonstrated appropriate safeguards, the explicit consent of the individual, or a necessity provided for by law. The Act also requires appropriate security measures, including pseudonymisation and encryption (section 31), and notification of a breach to the Commissioner without undue delay, no later than 72 hours after becoming aware of it (section 25).<\/p><p>These rules govern transfers within the meaning of Mauritian law. They do not take a US provider out of the scope of the CLOUD Act. A prudent business documents this legal basis and plans what to do if it falls. This monitoring belongs in the documentation of processing activities, not in a slogan.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-205014c elementor-widget elementor-widget-text-editor\" data-id=\"205014c\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What actually reduces exposure<\/h2><p><strong>Choose the operator.<\/strong> If the company that bills, backs up and administers the service is European, and does not depend on a US group for possession of the data, a CLOUD Act order is not addressed to it. This is the main lever.<\/p><p><strong>Read the list of subcontractors.<\/strong> A European operator that sends emails, backups or support to a US subcontractor reintroduces a provider subject to US law. The list of subcontractors is part of the protection. The common mistake: checking the main hosting provider and forgetting the ticketing tool or the backup.<\/p><p><strong>Distinguish the software vendor from the operator.<\/strong> Using software whose vendor is American is not the same as entrusting the data to that vendor. Zimbra is published by Synacor, in the United States. When it is installed and backed up by a European hosting provider, in that provider\u2019s facilities, the operational holder of the mailboxes is the hosting provider. The contract must prohibit the vendor from accessing content, and state who applies the patches.<\/p><p><strong>Treat support as access.<\/strong> A technician who opens a mailbox or a backup is processing data. Where that technician is located, the record of the access and its reason matter as much as the location of the disk.<\/p><p><strong>Encrypt with a key you hold, where the service allows it.<\/strong> Encryption at rest with a key held by the provider protects against disk theft. It does not prevent the provider from reading the data to deliver the service, nor from producing them if compelled to. Encryption with a key that only you hold changes the picture for content. On a full suite, it does not always cover every stage: some stages require the service to process the content, and encryption there is then in the hands of the software vendor or the operator (filtering and quarantine, indexing for search, document processing in a CRM). The right questions are therefore: at which stages does the provider manage the key, how long do the data remain there, and who can access them? The scope has to be read.<\/p><p><strong>Keep an exit.<\/strong> Regular exports, open formats, and a restore test. Legal protection without a recoverable copy is incomplete.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-86dc7bb elementor-widget elementor-widget-text-editor\" data-id=\"86dc7bb\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>What is not enough<\/h2><ul><li>Announcing \u201cEurope-hosted\u201d or \u201cMauritius-hosted\u201d without naming the operator. The criteria that matter are detailed on the page <a href='\/en\/sovereign-cloud-definition\/'>definition, criteria and limits<\/a>.<\/li><li>Signing a DPA and considering the matter closed. The DPA organises data protection obligations between the customer and the provider. It does not take a US software vendor out of US law.<\/li><li>Believing that a Microsoft or Google data region cancels out the CLOUD Act. These regions describe where certain data are stored and processed. The vendor remains American.<\/li><li>Requiring SecNumCloud for an SME\u2019s email service when the real need is a European operator. SecNumCloud is a qualification of an offering, useful when the tender or the nature of the data requires it. The ANSSI catalogue states which offerings hold it. Klytic does not hold it. Nor should OVHcloud\u2019s Zimbra email offering be confused with the OVHcloud infrastructure offerings that are qualified for named scopes.<\/li><\/ul><p>Nor is the CLOUD Act the only criterion. A business with data of low sensitivity, which depends on advanced Microsoft 365 or Google Workspace features and documents the basis for its transfers, can reasonably stay. The choice becomes questionable when it has not been made: no one has named the holder of the data or planned an exit. The pages <a href='\/en\/european-vs-american-cloud\/'>European cloud or American cloud<\/a> and <a href='\/en\/microsoft-365-vs-sovereign-solution\/'>Microsoft 365 or a sovereign solution<\/a> explore this trade-off.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-256f490 elementor-widget elementor-widget-text-editor\" data-id=\"256f490\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>A step-by-step approach<\/h2><ol><li>List the processing activities: email, files, CRM, telephony, backups, support.<\/li><li>For each one, name the company that holds the data.<\/li><li>Exclude or regulate those that are US providers with control of the content.<\/li><li>Write down the list of subcontractors and review it every year.<\/li><li>Test an export.<\/li><\/ol><p>Example: a 25-person accounting firm that goes through this exercise often finds that the email service is clearly identified, but that the e-signature tool, file sharing with clients or the backup were added without checking the operator. These are the lines to regulate first.<\/p><p>Microsoft 365, Google Workspace and Klytic are compared on the page <a href='\/en\/microsoft-365-google-workspace-or-klytic\/'>Microsoft 365, Google Workspace or Klytic<\/a>; the general criteria, in <a href='\/en\/what-is-sovereign-cloud\/'>what is a sovereign cloud<\/a>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ad86537 elementor-widget elementor-widget-text-editor\" data-id=\"ad86537\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Frequently asked questions<\/h2><h3>Is a datacenter in France enough to rule out the CLOUD Act?<\/h3><p>No. The law targets the provider subject to US law that has possession or control of the data, wherever they are stored. The location of the disk remains useful, but it does not answer the question of the operator.<\/p><h3>Can the provider challenge an order?<\/h3><p>\u00a7 2703(h) provides for a motion to quash or modify, within 14 days of service. This remedy presupposes an executive agreement in force with the country concerned. The US Department of Justice page mentions no agreement with France, and none is in force with the European Union.<\/p><h3>Does the Data Protection Act 2017 protect my data?<\/h3><p>It sets a Mauritian rule: a transfer outside Mauritius requires appropriate safeguards, the explicit consent of the individual or a necessity provided for by law (section 36). It places the US provider in a conflict of laws, without resolving it on the provider\u2019s behalf.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-566645d kly-g-klytic elementor-widget elementor-widget-text-editor\" data-id=\"566645d\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Where Klytic stands<\/h2><p>Dedicace Software, a French company, operates Klytic. Hosting is provided in any geographical area corresponding to the applicable jurisdiction, subject to the availability of the required services, for example in Europe or Mauritius, or on the customer\u2019s servers. The email software is Zimbra, published in the United States: protection comes from the operator and the operating contract, not from the vendor\u2019s nationality. The software vendor has no access to the data and cannot compel Klytic to hand them over.<\/p><p>The data are held entirely by the customer, or by Klytic on the customer\u2019s behalf, in a geographical area that falls under the applicable jurisdiction. They are encrypted natively, or according to the customer\u2019s choice. The key is held by the customer, or kept in the customer\u2019s account, and Klytic has no access to it.<\/p><p>Some stages rely on encryption managed by Klytic, because the service has to process the content: emails and documents processed in the CRM, and emails placed in quarantine by the filtering, which are encrypted in the database. The exception is the email service: if the customer has not enabled encryption with its own key, its emails are stored encrypted with a key managed by Klytic. Conversely, emails encrypted by the customer can be indexed for search if the customer has given its key to its email client.<\/p><p>In transit, emails are encrypted from the moment they pass through Klytic MTA filtering, then between the platform\u2019s servers, and on every access to the mailbox: webmail, email client or mobile, from the company network as well as from outside. Only one stage does not depend on Klytic: sending to another domain. Encryption is maintained there when the recipient\u2019s server supports it, which is often the case; otherwise, the message makes this last journey in clear text, as with any email provider. To guarantee confidentiality all the way to the recipient in every case, the message itself must be encrypted (S\/MIME or PGP).<\/p><p>Access to files is tightly restricted through limited access rights, and a connection audit raises an alert in the event of a fraudulent attempt. As with any provider, the contract must describe this possession, this encryption and their scope. See also the page <a href='\/en\/hosting-sovereignty\/'>hosting and sovereignty<\/a>.<\/p><p>Klytic does not hold the SecNumCloud qualification. None of these statements constitutes general immunity: a French operator remains subject to French law.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7a5e437 kly-g-disclaimer elementor-widget elementor-widget-text-editor\" data-id=\"7a5e437\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>This page describes a general framework. It does not constitute legal advice.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-705d4ff kly-g-legal elementor-widget elementor-widget-text-editor\" data-id=\"705d4ff\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p><b>Legal status as of 5 October 2026.<\/b> This text does not replace a contract review. In Mauritius, the Data Protection Act 2017 governs the processing of personal data and its transfer outside the country; the Data Protection Office oversees its application. The ANSSI catalogue is authoritative for SecNumCloud.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8a10344 kly-g-sources elementor-widget elementor-widget-text-editor\" data-id=\"8a10344\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Sources<\/h2><p>Accessed in October 2026.<\/p><ul><li>18 U.S.C. \u00a7 2713, text introduced by the CLOUD Act: disclosure of data in the provider\u2019s possession or control, including outside the United States. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2023-title18\/html\/USCODE-2023-title18-partI-chap121-sec2713.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><li>18 U.S.C. \u00a7 2703, including subsection (h): the provider\u2019s motion to quash or modify, 14-day time limit, concept of a qualifying foreign government. <a href='https:\/\/www.govinfo.gov\/content\/pkg\/USCODE-2022-title18\/html\/USCODE-2022-title18-partI-chap121-sec2703.htm' rel='noopener' target='_blank'>govinfo<\/a><\/li><li>U.S. Department of Justice, CLOUD Act Resources: agreements with the United Kingdom and Australia, negotiations with the European Union. <a href='https:\/\/www.justice.gov\/criminal\/cloud-act-resources' rel='noopener' target='_blank'>justice.gov<\/a><\/li><li>Data Protection Office, \u201cThe Data Protection Act 2017\u201d (Act No. 20 of 2017). <a href='https:\/\/dataprotection.govmu.org\/Documents\/DPA_2017.pdf' rel='noopener' target='_blank'>dataprotection.govmu.org<\/a> Sections 3(5), 4, 14, 25, 31 and 36: scope, authority, registration, breach notification, security, transfers outside Mauritius.<\/li><li>French Senate, commission of inquiry on public procurement, record of the week of 9 June 2025 (hearing of 10 June 2025). <a href='https:\/\/www.senat.fr\/compte-rendu-commissions\/20250609\/ce_commande_publique.html' rel='noopener' target='_blank'>senat.fr<\/a><\/li><li>ANSSI, SecNumCloud FAQ. <a href='https:\/\/cyber.gouv.fr\/enjeux-technologiques\/cloud\/faq-qualification-secnumcloud\/' rel='noopener' target='_blank'>cyber.gouv.fr<\/a><\/li><li>Zimbra, FAQ (software vendor: Synacor). <a href='https:\/\/www.zimbra.com\/faqs\/' rel='noopener' target='_blank'>zimbra.com\/faqs<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-ab08286 e-con-full kly-g-aside e-flex e-con e-parent\" data-id=\"ab08286\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-7430143 elementor-widget elementor-widget-html\" data-id=\"7430143\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"html.default\">\n\t\t\t\t\t<nav class=\"kly-g-toc\" aria-label=\"Contents\"><p>On this page<\/p><ol><\/ol><\/nav>\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ecbbf0f elementor-widget elementor-widget-text-editor\" data-id=\"ecbbf0f\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<div class=\"kly-g-cta\"><h3>A French operator for your data<\/h3><p>Email, documents, video conferencing, CRM and telephony, hosted in the zone that matches your jurisdiction, for example in Europe or Mauritius, or on your premises.<\/p><p><a class=\"kly-g-btn\" href=\"\/en\/contact\/\">Talk to an advisor \u2192<\/a><\/p><p style=\"margin:0\"><a class=\"kly-g-btn ghost\" href=\"\/en\/hosting-sovereignty\/\">Klytic hosting<\/a><\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-6c8c23f e-con-full kly-g-related e-flex e-con e-parent\" data-id=\"6c8c23f\" data-element_type=\"container\" data-e-type=\"container\" data-settings=\"{&quot;ekit_has_onepagescroll_dot&quot;:&quot;yes&quot;}\">\n\t\t\t\t<div class=\"elementor-element elementor-element-55b38e8 elementor-widget elementor-widget-text-editor\" data-id=\"55b38e8\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<h2>Read next<\/h2><div class=\"kly-g-grid\"><a class=\"kly-g-card\" href=\"\/en\/what-is-sovereign-cloud\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">What is a sovereign cloud?<\/span><span class=\"q\">A sovereign cloud is judged by its operator, the applicable law, control over access and data exit. The datacenter\u2019s location is not enough.<\/span><span class=\"m\"><span>8 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/sovereign-cloud-definition\/\" style=\"--cat:#0077cc\"><span class=\"c\">Sovereignty<\/span><span class=\"t\">Sovereign cloud: definition, criteria and limits<\/span><span class=\"q\">An operational definition of sovereign cloud, ten verifiable criteria for a tender, and the limits of the term: SecNumCloud, location, access, exit.<\/span><span class=\"m\"><span>9 min read<\/span><b>Read \u2192<\/b><\/span><\/a><a class=\"kly-g-card\" href=\"\/en\/european-alternatives-microsoft-365\/\" style=\"--cat:#6d28d9\"><span class=\"c\">Comparisons<\/span><span class=\"t\">European alternatives to Microsoft 365: 2026 guide<\/span><span class=\"q\">Selection criteria, then Microsoft 365, Google Workspace, OVHcloud, Nextcloud, Infomaniak, other players and Klytic. When each one is relevant.<\/span><span class=\"m\"><span>17 min read<\/span><b>Read \u2192<\/b><\/span><\/a><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t<div class=\"elementor-element elementor-element-539316dd e-con e-atomic-element e-div-block-base e-default-div e-c9fd865-4a50 \" data-id=\"539316dd\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"539316dd\" data-e-type=\"e-div-block\" data-id=\"539316dd\">\n    <div class=\"elementor-element elementor-element-4f79afcb e-con e-atomic-element e-div-block-base e-default-div e-4fa9fe-ce86 \" data-id=\"4f79afcb\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"4f79afcb\" data-e-type=\"e-div-block\" data-id=\"4f79afcb\">\n    \t\t\t<p class=\"e-4dcf5c70-2ec7 e-paragraph-base e-default-p\" data-interaction-id=\"330a7a35\" data-e-type=\"widget\" data-id=\"330a7a35\">Welcome offer<\/p>\n\t\t\t\t\t<h2 data-interaction-id=\"56f1f7d5\" class=\"e-347faa43-4e20 e-heading-base e-default-h2\" data-e-type=\"widget\" data-id=\"56f1f7d5\">30-day free trial, assisted migration<\/h2>\n\t\t\t\t\t<p class=\"e-7f6310da-1caa e-paragraph-base e-default-p\" data-interaction-id=\"2ce27288\" data-e-type=\"widget\" data-id=\"2ce27288\">No-commitment trial offer. An advisor will call you back to understand your needs and prepare your Klytic space.<\/p>\n\t\t<div class=\"elementor-element elementor-element-35ea29a1 e-con e-atomic-element e-div-block-base e-default-div e-1cd48b22-e6da \" data-id=\"35ea29a1\" data-element_type=\"e-div-block\" data-e-type=\"e-div-block\" data-interaction-id=\"35ea29a1\" data-e-type=\"e-div-block\" data-id=\"35ea29a1\">\n    \t\t\t<a href=\"\/en\/30-day-free-trial\/\" target=\"_self\" class=\"e-4a7886e3-652d e-button-base e-default-a\" data-interaction-id=\"19bfa8f1\" data-e-type=\"widget\" data-id=\"19bfa8f1\">\n\t\ud83d\ude80 Start free trial\n<\/a>\n\t\t\t\t\t<a href=\"\/en\/pricing\/\" target=\"_self\" class=\"e-137e863d-dd0d e-button-base e-default-a\" data-interaction-id=\"326d82ab\" data-e-type=\"widget\" data-id=\"326d82ab\">\n\tSee pricing\n<\/a>\n\t\t\n<\/div>\n\n<\/div>\n\n<\/div>\n\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"elementor_header_footer","meta":{"_seopress_titles_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_titles_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_social_fb_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"How can a business protect itself from the CLOUD Act? | Klytic","_seopress_social_twitter_desc":"The CLOUD Act targets the provider subject to US law, not the country of the disk. Operator, subcontractors, keys, support: the measures that matter.","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"class_list":["post-404","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/404","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/comments?post=404"}],"version-history":[{"count":1,"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/404\/revisions"}],"predecessor-version":[{"id":429,"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/pages\/404\/revisions\/429"}],"wp:attachment":[{"href":"https:\/\/mu.klytic.com\/en\/wp-json\/wp\/v2\/media?parent=404"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}