EU Email Providers & US Cloud: What Works

Yes, a European email provider can still use US cloud services, but the legal and technical landscape has changed significantly since the Schrems II ruling. The key is that the provider must implement additional safeguards—such as end-to-end encryption, data localization, or contractual clauses—to ensure that US authorities cannot access EU user data without a lawful basis. This article explains the current rules, the practical options, and what you should look for when choosing a provider.

Background: Why US Clouds Became a Problem

The core issue is the conflict between EU data protection law (GDPR) and US surveillance law. Under GDPR, personal data of EU citizens can only be transferred to a third country if that country ensures an “adequate” level of protection. For years, the EU-US Privacy Shield framework provided a legal basis for transfers, but in July 2020, the Court of Justice of the European Union (CJEU) struck it down in the Schrems II case. The court ruled that US surveillance programs (like PRISM and UPSTREAM) could access EU data without sufficient safeguards, and that EU citizens had no effective judicial remedy. This left many European companies, including email providers, without a clear legal basis for using US cloud services.

How the Rules Work Now

After Schrems II, the European Data Protection Board (EDPB) issued guidance on how to transfer data legally. The main options are:

• Standard Contractual Clauses (SCCs): These are pre-approved contracts between the EU exporter and the non-EU importer. They must be supplemented with additional measures if the destination country’s laws conflict with GDPR.
• Derogations: In limited cases, transfers can happen with the data subject’s explicit consent, or for the performance of a contract. These are narrow and not suitable for routine email processing.
• Data Localization: The provider can choose a cloud provider that stores and processes data only within the EU, avoiding international transfers altogether.
• End-to-End Encryption: If the email content is encrypted in a way that the US cloud provider cannot read, the risk of surveillance is minimized. However, metadata (sender, recipient, timestamps) may still be exposed.

What European Email Providers Actually Do

In practice, many European email providers have changed their infrastructure. Some, like ProtonMail (now Proton), use their own data centers in Switzerland and the EU. Others, like Posteo and Mailbox.org, host in Germany. However, some providers still rely on US cloud giants like AWS or Google Cloud for certain operations, such as spam filtering or backups. In those cases, they must implement strict safeguards, such as:

• Encrypting data before it leaves the EU
• Using EU-based sub-processors where possible
• Conducting a Transfer Impact Assessment (TIA) to evaluate the risk
• Obtaining explicit consent from users for the transfer

Common Misconceptions

A common misconception is that using a US cloud service automatically violates GDPR. That’s not true. The violation occurs if the transfer lacks a valid legal basis and adequate safeguards. Another misconception is that all US cloud services are equally risky. Some, like Microsoft and Google, offer EU Data Boundary solutions that keep data within the EU, but the legal issue remains because US authorities can still request data from the US parent company. Encryption is the most effective mitigation, but it’s not a silver bullet—if the email provider holds the decryption keys, they can be compelled to hand them over.

How to Choose a Provider

When evaluating an email provider, consider these factors:

• Data residency: Where are the servers located? Are they in the EU/EEA or Switzerland?
• Encryption: Is email encrypted at rest and in transit? Can the provider read your emails?
• Sub-processors: Does the provider list its sub-processors? Are any in the US?
• Transparency: Does the provider publish a transparency report on government requests?
• Certifications: ISO 27001, SOC 2, or GDPR compliance certifications are good signs.

Costs and Trade-offs

Using EU-only infrastructure often costs more than using US hyperscalers. For example, a small email provider might pay 20-30% more for EU cloud services due to higher energy and labor costs. This can translate into higher subscription fees for users. However, some providers offer free tiers supported by paid plans. The trade-off is between cost and data sovereignty. If you’re a business handling sensitive data, the extra cost may be worth it. For personal use, you might accept a US cloud provider if they offer strong encryption and transparent policies.

Alternatives to US Clouds

If you want to avoid US clouds entirely, look for providers that use:

• EU-based cloud providers: Such as OVHcloud (France), Scaleway (France), Hetzner (Germany), or Exoscale (Switzerland).
• Self-hosted email: Some providers offer managed email on your own domain, but the underlying infrastructure may still be in the EU.
• Decentralized email: Projects like Mailfence (Belgium) or Tutanota (Germany) use their own servers and end-to-end encryption.

Frequently Asked Questions

Is it legal for a European email provider to use AWS?

Yes, if the provider has implemented SCCs and additional safeguards, and has conducted a TIA. However, it’s a legal gray area because US surveillance law is still considered inadequate by the CJEU. Many providers choose to avoid US clouds altogether to reduce risk.

What is a Transfer Impact Assessment (TIA)?

A TIA is a document that assesses whether the laws of the destination country (e.g., the US) undermine the protections of the SCCs. It must consider the type of data, the likelihood of government access, and the remedies available to individuals. If the TIA finds a problem, the provider must suspend the transfer or add more safeguards.

Can end-to-end encryption solve the problem?

End-to-end encryption means the email content is encrypted on your device and only you and the recipient can decrypt it. This prevents the cloud provider from reading the content, but metadata (subject line, sender, recipient, timestamps) is still visible. For many users, this is a significant improvement, but it doesn’t eliminate all risks.

Are there any EU-US data transfer agreements now?

Yes, a new framework called the EU-US Data Privacy Framework (DPF) was adopted in July 2023. It replaced the invalidated Privacy Shield. However, it has already faced legal challenges, and its long-term viability is uncertain. Many companies are waiting to see if it survives court scrutiny.

What should a business do if its email provider uses US clouds?

First, ask the provider for their TIA and list of sub-processors. If you’re not satisfied, consider switching to a provider that uses EU-only infrastructure. Also, ensure your own data processing agreements with the provider include GDPR-compliant clauses.

Does using a US cloud for email mean my data is automatically exposed to the NSA?

Not automatically. The NSA’s access is limited by law and requires a warrant or a court order, though the scope of such orders is broad. The risk is that the US government could compel the cloud provider to hand over data without your knowledge. Encryption and data localization reduce this risk.

Related

• NFC Reader on Your Phone: 9 Things You’re Not Doing
• Smart TV DNS Settings: Why They Change & How to Fix
• RabbitMQ Hosting for Startups: Managed vs Self-Hosted