Your network carries the world's data.
Who has access to your operations?

Yes. The CLOUD Act (18 U.S.C. § 2713) applies based on the nationality of the cloud provider, not the location of the data. If a European telecom operator uses AWS, Microsoft Azure, or Google Cloud to manage any part of its operations — billing, OSS/BSS, network management, internal communications — US law enforcement can compel that US provider to disclose the data, regardless of whether the data is stored in Frankfurt, Paris, or Stockholm. The provider has no legal basis to refuse under US law. This directly conflicts with GDPR Article 48, which prohibits handing EU personal data to foreign authorities without an international agreement. As of 2026, no such agreement resolves this conflict. European operators using US hyperscalers are permanently exposed to this legal paradox.

Yes — explicitly. NIS2 Directive Annex I lists "providers of electronic communications networks or services" in the first category of essential entities, alongside energy, transport, water, health, and digital infrastructure. This classification applies without any size threshold: all licensed telecom operators in the EU are essential entities. As essential entities, they face the strictest obligations under Article 21, including risk management measures for their ICT supply chains, incident reporting obligations (significant incidents must be reported to ENISA within 72 hours), and accountability requirements for their technology vendors. An operator using US-controlled communications platforms for SOC or NOC operations must document this as a supply-chain risk, demonstrate that it is managed, and — given the CLOUD Act exposure — would struggle to demonstrate adequate management in any credible risk assessment.

No. This is the core misconception that regulators and operators are increasingly confronting. Physical location of data is irrelevant under the CLOUD Act — what matters is the nationality of the provider. AWS, Microsoft, and Google are US companies. A CLOUD Act order compels them to produce data from any data centre they operate, including those in Frankfurt, Dublin, or Amsterdam. In June 2025, Microsoft's French subsidiary confirmed in a Senate hearing that it cannot guarantee data sovereignty against US authorities even for its "sovereign cloud" product offerings. This is not a design flaw that can be patched — it is a structural consequence of the provider being subject to US law. The only resolution is to use infrastructure that is not subject to US jurisdiction: European or sovereign-by-design providers, self-hosted solutions, or platforms like AMVLET that are built without any US corporate structure or dependency.

The Communications and Information Technology Commission (CITC) requires that subscriber data — including CDRs, billing records, and service usage data — remains within the Kingdom of Saudi Arabia. The National Cybersecurity Authority (NCA) mandates that licensed telecom operators implement sovereign cybersecurity infrastructure, meaning that the platforms used to manage network security, incident response, and operational communications must not be subject to foreign jurisdictional access. SDAIA enforces the Personal Data Protection Law (PDPL), and Article 29 of that law treats any remote access to data stored in Saudi Arabia by a foreign party as a cross-border data transfer — triggering the PDPL's transfer restrictions and maximum fines of SAR 5 million per violation, doubled for repeat offences. SAMA applies additional requirements for telecom operators offering financial or payment services. Together, these four authorities create a comprehensive sovereign mandate that US cloud infrastructure categorically cannot satisfy.

AMVLET provides a sovereign communications layer purpose-built for telecom operators who must maintain confidential internal communications — NOC, SOC, executive, and inter-operator channels — without creating CLOUD Act, GDPR, NIS2, or PDPL exposure. The platform operates entirely outside US jurisdiction, with cryptographic keys held exclusively by your organisation. Deployments are available on EU-sovereign cloud infrastructure, on your own on-premises infrastructure, or fully air-gapped for the most sensitive operational environments. AMVLET supports cross-operator federation, enabling secure communications between partner operators for roaming, interconnect, and incident coordination without routing through any US-controlled intermediary. Built-in audit trails, role-based access controls, and supervision tools support your NIS2 Article 21 supply-chain risk documentation and GDPR Article 32 security obligations. We work directly with legal and compliance teams to produce the documentation required for your regulatory obligations.