The verdict in three sentences
The 2018 Cloud Act allows US authorities to compel a provider subject to US law to hand over data it controls, even when stored in Europe: picking the "Paris" or "Frankfurt" region of a US hyperscaler does not solve the issue. For a mid-size company whose website collects form data and that bids on public contracts, a provider under European law (OVHcloud, Scaleway, Outscale, Clever Cloud, Hetzner) removes most of the risk for EUR 15 to 80 per month. A SecNumCloud-qualified offer is only essential if a public buyer or contract explicitly requires it.
Where the risk actually comes from
A corporate website is more than a brochure. It processes contact forms, job applications, sometimes quote requests with technical attachments, and relies on a chain of processors: host, CDN, email delivery service, analytics tool, connected CRM. Every link subject to US law is a potential Cloud Act exposure.
The EU-US Data Privacy Framework, adopted in 2023, eases transfers under the GDPR, but it does not neutralize the Cloud Act and is still being challenged before European courts. For an IT director, the question to document is simple: which data, at which processor, under which jurisdiction.
| Website component | Cloud Act-exposed option | European-law alternative | Monthly cost gap 2026 |
|---|---|---|---|
| Application hosting | AWS, Azure, Google Cloud (EU region) | OVHcloud, Scaleway, Outscale, Hetzner | Often cheaper in Europe |
| CDN and DDoS protection | Cloudflare, Akamai, CloudFront | OVHcloud CDN, Bunny (Slovenia), Gcore (Luxembourg) | EUR 0 to 50 |
| Transactional email | SendGrid, Mailgun, Amazon SES | Brevo, Mailjet, Scaleway TEM | EUR 0 to 30 |
| Analytics | Google Analytics 4 | Self-hosted Matomo, Plausible, Piano Analytics | EUR 0 to 40 |
| Forms and CRM | HubSpot, Salesforce | Native forms + EU-hosted CRM | Variable |
| Anti-spam captcha | reCAPTCHA | Friendly Captcha, hCaptcha EU mode | EUR 0 to 20 |
Hosting tiers and their cost
| Tier | Example offer | Monthly price 2026 | When to choose it |
|---|---|---|---|
| Standard European VPS | OVHcloud VPS, Scaleway Instances, Hetzner Cloud | EUR 15 to 80 | Corporate site, simple forms |
| Managed European public cloud | Clever Cloud, Scaleway Serverless, OVHcloud Public Cloud | EUR 80 to 300 | Variable traffic, high availability |
| SecNumCloud-qualified offer | OVHcloud Bare Metal Pod, Outscale, Cloud Temple | EUR 300 to 1,500 | Contractual requirement or sensitive data |
| US hyperscaler, EU region | AWS, Azure, GCP | EUR 50 to 400 | Avoid if the Cloud Act is a criterion |
| "Trusted cloud" joint venture | S3NS, Bleu | On quote, often EUR 500 and up | Need hyperscaler services under European control |
Public list prices or 2026 orders of magnitude. Migrating a corporate site (audit, cutover, testing, DNS, replacing third-party services) usually costs EUR 1,500 to 6,000 and takes 2 to 6 weeks.
Documents to produce for a public tender
Public buyers and large accounts increasingly ask for:
- The record of processing activities for the site, listing processors and their countries.
- The European Commission's standard contractual clauses for any remaining non-EU processor.
- A transfer impact assessment (TIA) evaluating the risk of access by a foreign authority.
- A hosting statement specifying the host's jurisdiction and where backups are located.
- Where relevant, the SecNumCloud qualification reference of the chosen offer.
Budget 2 to 5 days of legal or DPO work to assemble this file, about EUR 1,200 to 4,000 if outsourced.
Mini case study
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Illustrative scenario: Thomas, IT director of a 400-employee company in Lyon that bids on 25 public tenders a year, hosts the corporate site on AWS in the Paris region with Cloudflare, SendGrid and Google Analytics, for about EUR 180 per month.
He moves to OVHcloud Public Cloud with Bunny CDN, Brevo and Matomo: EUR 140 per month. Migration EUR 4,500, legal file EUR 2,000, so EUR 6,500 invested. The EUR 40 monthly saving only returns EUR 480 a year. The real gain lies elsewhere: if the lack of jurisdiction guarantees costs him even one technical score point on a EUR 300,000 a year contract at 20% margin, keeping a single contract covers the migration almost 9 times.
FAQ
Does hosting on AWS in an EU region protect against the Cloud Act?
No. The Cloud Act applies to providers subject to US law, wherever the data is stored. An EU region addresses latency and part of the GDPR, not jurisdiction.
Is a SecNumCloud offer mandatory?
No, unless a contract, public buyer or sector regulation explicitly requires it. For a standard corporate site, a European-law host at EUR 15 to 80 per month is usually enough.
How much does migrating to a European host cost?
Between EUR 1,500 and 6,000 for a corporate site, depending on how many third-party services need replacing. Timeline is 2 to 6 weeks, DNS cutover included.
Is Cloudflare a problem?
Cloudflare is a US company that sees your site's decrypted traffic. If the Cloud Act matters to your clients, a European CDN costs EUR 0 to 50 more per month.
Is the Data Privacy Framework enough?
It frames transfers under the GDPR, but does not remove the Cloud Act and could be invalidated like its predecessors in 2015 and 2020. Do not build your compliance on it alone.
Let's scope your project. Send us your current services (hosting, CDN, email, analytics, CRM): we price the migration to a European-law stack, including the file to hand to buyers. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
