You enforce data sovereignty.
Are your own communications protected?

There is no outright legal prohibition — but the GDPR accountability principle (Article 5(2)) requires that controllers demonstrate compliance with data protection obligations. A supervisory authority that processes personal data of data subjects in the context of an enforcement investigation — including communications about that investigation — must apply the same standards it enforces on others. Routing that data through a US-controlled platform creates a structural accountability problem that has no straightforward legal resolution. France concluded the same and deployed a sovereign video platform across all state services in January 2026.

No. The CLOUD Act (18 U.S.C. § 2713) applies based on the nationality and control of the service provider, not the physical location of the data. A Microsoft, Google, or Amazon data centre in Frankfurt or Dublin is still subject to CLOUD Act orders. The EU Court of Justice confirmed this conflict in Schrems II (C-311/18), ruling that US surveillance law creates an irresolvable incompatibility with GDPR protections. The only reliable mitigation is a provider that is not subject to US law — headquartered, operated, and legally governed within the EU or another non-US jurisdiction.

CLOUD Act orders are frequently accompanied by non-disclosure requirements that prevent the cloud provider from notifying the data subject — or in this case, the regulatory body — that a disclosure has occurred. This means a supervisory authority may have its enforcement communications, case files, or inter-authority coordination accessed by US authorities without ever being informed. From a GDPR Article 33 and 34 perspective, this creates a situation where the data controller (the DPA itself) cannot fulfil its own breach notification obligations because the breach is invisible. The operational and reputational consequences of this scenario are severe.

NIS2 classifies certain public administration bodies and cybersecurity authorities as essential entities, and Article 21 requires essential entities to apply risk management measures to their ICT supply chains — including communications platforms. While NIS2 does not explicitly mandate sovereign cloud, the supply-chain accountability requirement means that an essential entity using a US-controlled communications platform must conduct a risk assessment, document the risks, and demonstrate that they are appropriately managed. For regulatory bodies whose mandate includes enforcing these same standards, the practical and reputational bar is higher than for other essential entities.

AMVLET provides regulatory-grade sovereign communications infrastructure that operates entirely outside US jurisdiction. Deployments can be self-hosted on the authority's own infrastructure, air-gapped for the highest-sensitivity environments, or deployed on EU-governed regional cloud with no US dependency. All communications are end-to-end encrypted with cryptographic keys held exclusively by your authority — AMVLET has zero access. The platform supports cross-authority federation, allowing multiple DPAs or agencies to communicate securely without routing through any US-controlled intermediary. Audit trails, access controls, and supervision tools are built-in, supporting your own compliance obligations under GDPR, DORA, NIS2, and PDPL.