A client emails you a contract, you drop it into your notes or document tool to find it later. You almost never ask where that file actually ends up. The question is worth asking: most consumer productivity tools, tasks, notes, documents, are run by American companies, and that address has real consequences for who can, in theory, access your data.
The Cloud Act: the company's nationality matters more than the server's address
The Cloud Act is a US federal law passed in 2018. It requires any company under US jurisdiction to hand over, on request from authorities, the data it holds, wherever its servers are physically located. A US provider storing your files in a datacenter in Paris or Frankfurt still has to comply with a US request: the obligation follows the company, not the country where the machine sits.
In practice, choosing a European host for your files isn't enough to escape this if the company running the service is still American, or belongs to a US group. The server's geographic location and the nationality of the company operating it are two different questions, and only the second one determines who can be compelled to hand over your data.
GDPR governs transfers outside the EU, without erasing the problem
GDPR sets a precise framework for any transfer of personal data outside the European Union: an adequacy decision from the European Commission for certain countries, standard contractual clauses, or binding internal rules within the same group. That framework exists, but it doesn't by itself neutralize the tension with an extraterritorial law like the Cloud Act.
France's data protection authority, the CNIL, makes this point in its guide on transfers of data outside the EU: standard contractual clauses aren't enough if the destination country's law prevents the provider from actually honoring them. That's exactly the situation the Cloud Act creates for a US company, wherever it technically hosts the data. Hence the CNIL's own invitation, in its practical guide on transfer impact assessments, to check case by case whether contractual safeguards actually hold up against the provider's home country law, rather than assuming they do.
What it changes for a small team storing sensitive data
No legal department to comb through a cloud contract's clauses, in a small structure: the topic quickly becomes something nobody ever looks at. It's worth a glance the moment a tool stores more than harmless notes: a contract with a client, meeting minutes that mention a commercial strategy, an HR file.
Two simple habits change the picture:
- Ask where and by whom a tool is actually operated, not just where its servers sit (often listed in the terms of service or a dedicated security page).
- Check whether data gets resold or shared with third parties, particularly for advertising purposes.
The risk stays theoretical for the vast majority of everyday use: no need to switch everything overnight, or to dramatize it. It remains one criterion among others, particularly relevant for anyone handling client documents or sensitive internal information.
Where your data lives when you use Flots
Flots hosts its data in the European Union. Files stored in the Documents space live in a private, encrypted space: none has a public URL, every preview or download goes through a short-lived link. The team building Flots is French, with no foreign funding, and data is never resold to third parties. The point also comes up in our Notion vs Flots comparison, where hosting is one of the differences between the two tools.
The question "where is my data?" isn't just for large companies with a dedicated compliance team. For a small team or a freelancer, it's a simple criterion to check before dropping in a client file or a sensitive meeting note.
Store your work documents on infrastructure hosted in Europe.
Files, notes and projects kept in one place, in a private and encrypted space.
