Why European Companies Are Moving Their Files Away From US Cloud Storage
A growing number of European businesses are quietly moving their document storage away from the large American cloud providers they signed up with years ago, and the shift has little to do with price or features.
The Legal Mechanism Most Businesses Only Discover After Signing Up
The driving concern is jurisdiction: who can legally demand access to a company's files, and under what law, once those files sit on a server owned by a US-headquartered company.
The US CLOUD Act allows American authorities to compel US-based cloud providers to hand over data they control, regardless of where the physical server storing that data is located, even if it sits in a data centre in Frankfurt or Amsterdam.
This creates a direct tension with GDPR, which requires EU personal data to be protected under EU legal standards, meaning a European company can end up in a position where two different legal systems make conflicting demands about the same files.
Switching to a Self-Hosted Alternative
Many IT decision-makers assumed for years that choosing a European data centre region within a US provider's platform solved this problem. It doesn't, since the CLOUD Act reaches the company itself, not merely the servers it operates.
Adopting Nextcloud from hosting.de gives a company full control over where its files actually live and which legal jurisdiction governs them, since the platform runs on infrastructure the business or its chosen European provider directly controls, rather than a foreign parent company's terms of service.
This kind of migration typically doesn't require abandoning familiar workflows either, since modern self-hosted platforms support the same file syncing, sharing links and collaborative editing that staff are already used to from mainstream consumer cloud tools.
How Widespread the Concentration Actually Is
Roughly 70 percent of Europe's cloud infrastructure currently runs through three American companies, according to analysis from Planet Crust's review of enterprise data sovereignty, a concentration that leaves the continent's digital infrastructure more exposed to a single jurisdiction's legal reach than most businesses realise when they sign up.
European sovereign cloud spending is projected to grow 83 percent in 2026 alone, a sharp acceleration that reflects how quickly this concern has moved from a compliance footnote to an active procurement criterion for many organisations.
What Gets Lost and What Doesn't in the Transition
The most common complaint during migration isn't about missing features, it's about the learning curve for administrators who've never had to manage their own cloud infrastructure before, having relied entirely on a third-party platform's defaults.
Third-party integrations and mobile apps for self-hosted platforms have matured considerably in the past few years, closing much of the gap that once made switching away from mainstream providers a genuine functional downgrade rather than just a jurisdictional one.
Deciding Whether the Switch Is Actually Necessary for a Given Business
Not every business handles data sensitive enough to justify this kind of migration. A small retail site with minimal customer data faces a very different risk calculation than a healthcare provider or a law firm handling privileged client information.
A reasonable middle ground for many organisations is starting with the most sensitive categories of data, contracts, health records or financial documents, rather than attempting to migrate every file across the business in a single disruptive project.
The regulatory landscape is also shifting quickly enough that a wait-and-see approach carries its own risk. The European Commission's Cloud Sovereignty Framework, launched in October 2025, signals that procurement requirements favouring European-controlled infrastructure are likely to tighten rather than loosen over the coming years.
Businesses that begin this transition now, even gradually, avoid the scramble that typically follows a new compliance deadline announced with only a few months of lead time, a pattern that has already played out repeatedly across other areas of EU digital regulation.
The Takeaway
Whatever the eventual regulatory shape turns out to be, the underlying operational logic already holds today: a business that understands exactly where its data lives, and under which legal jurisdiction, is simply better positioned than one that never asked the question.
For businesses still weighing this decision, the practical first step isn't a full migration plan but a simple inventory: which files currently sit with a US-controlled provider, and which of those actually contain data sensitive enough to warrant the move.
That single inventory exercise, completed in an afternoon, usually clarifies the decision far more effectively than any amount of further reading on the underlying legal debate. It turns an abstract policy question into a concrete, actionable business decision.