Your data, their rules

The growing risks of hosting EU data in the US cloud

Oct 26, 2025

So, AWS was down recently. It took down a chunk of the internet with it, too. The outage was caused by an operational issue in US-EAST-1, one of AWS’ primary regions. A problem with DynamoDB snowballed to impact many critical services.

It’s a big deal and it’s not. Sometimes, cloud providers have outages. Doesn’t matter where you host. But when something bad happens in a US public cloud, it’s jarring to see the degree of trouble that causes in the EU as well.

That’s what I want to focus on here: How European digital infrastructure relies on a handful of US companies, the risks it poses, and what we can do about it.

To clarify, we need to answer three questions:

Is hosting EU services in US clouds still a good idea?
What are the options for EU-sovereign hosting?
How should an EU business choose its hosting strategy?

Let’s get into it.

The cloud race is over: US hyperscalers won

This probably won’t surprise you. Today, most businesses have adopted the cloud. As many 90% of them, according to a 2021 O’Reilly survey [1]. The vast majority of that cloud capacity is provided by the “Big Three”: AWS, Azure and Google Cloud, in that order [2].

The advent of cloud offered many benefits: faster iteration, scalability and cost savings through consumption-based billing plus economies of scale. Although businesses migrating to the cloud had varied cost savings success (–144% to +500%) [3], I think for a long time the Big Three delivered on their core promise.

So they won hard, and they won globally. To a point where they now hold massive leverage over today’s internet businesses. That’s when the dynamic starts shifting.

Squeezing the lemon

That’s a Danish saying, by the way. You use it when someone exploits a situation fully, to their own benefit. But if you squeeze a lemon too hard, it runs out of juice.

Global cloud spend is going up. Of course it is, because more businesses are using more cloud. At the same time, ~80% of businesses report that their cloud spend is higher than expected, according to a 2024 CloudZero survey [4]. That number has been going up too.

Wasn’t cloud supposed to be cheaper? Well. We have seen the Big Three reduce prices over time, but they’re not tracking with effeciency gains in available hardware. In 2014, Google Cloud reported that hardware costs improved 20-30% annually while public cloud prices only fell by 8% a year [5]. Google’s cloud platform pricing would start following the Moore’s Law curve, announcing price reductions on various core offerings.

In 2022, Google announced a 50% price hike for multi-region nearline storage and a doubling of storage network fees [6]. AWS has hiked prices too, for example through the introduction of the Public IPv4 Charge [7]. I have my own anecdotes for Azure, like when they deprecated Azure CDN in favour of Front Door, forcing us to take on new idle fees and an effective downgrade to our Web Application Firewall if we didn’t pay up for the “Premium” SKU.

These days, AWS operating margins are approaching 40% [8], quite the step up from 28% back in 2015 [9]. You have to wonder how these cloud companies are getting rich so much quicker than the rest of us.

US-EU relationship strain

Putting aside how we each might feel about the current US administration, it’s clear that the situtation is posing a risk to European businesses.

First, there’s the US CLOUD Act, signed into law by Donald Trump in 2018 [10].

The CLOUD Act lets US law enforcement compel American companies to provide access to data stored abroad, even if that data is in a European data center and belongs to a non-US entity.

It gives the US government the ability to access data controlled by American-owned clouds without the cooperation of (or disclosure to) European authorities. This conflicts with Europe’s GDPR, which seeks to protect the privacy of EU citizens by preventing their personal information to be transfered without legal basis [11].

Then we have the “kill switch” story. Following the arrest warrants for Isreali officials issued by the International Criminal Court, the ICC chief prosecutor lost access to his Microsoft email account as sanctioned by the US government [12]. While there is contention over the details, this has sparked serious discussions about over-reliance on US digital infrastructure by EU authorities.

Concentration risk

Time for a reality check.

We must expect that corporations will maximise shareholder profit. Corporations are supposed to do that.

We must expect that authoritarian governments will maximise their reach. In their frame of mind, that’s rational.

But the over-concentration on three US-owned cloud providers is leaving EU consumers exposed. We see that reflected in growing cloud spend, shrinking control over European data, and an increasing barrier to exit due to vendor lock-in and borderline anti-competitive behaviour [13].

That doesn’t mean that everyone should stop using the Big Three, though. It also doesn’t mean we, in the EU, need to get rid of all US technology services. But I think it would be healthy for European business leaders to ponder:

Do you think this trajectory is headed for better or for worse?

If you think worse, figuring out how to reduce your dependency on the Big Three could be a smart strategy. Let’s explore the alternatives so you can make an informed choice about what to do next.

EU-sovereign public clouds

As we focus on the Big Three, we sometimes forget that European public cloud offerings exist. They generally have less features, fewer datacenters and modest service level objectives. But there are solid, (actually) EU-sovereign clouds - good enough for many use cases.

Hetzner Cloud is is a popular choice for EU and US businesses looking to optimise cloud cost. They’re based out of Germany, and offer IaaS through datacenters in Central Europe, South-East Asia and the US [14]. Managed services for Kubernetes and databases might be coming [15], but for now, you would have to roll your own or add a PaaS layer with something like Coolify [16]. On the positive, Hetzner is cheaper than most competitors by quite a margin [17].

If you’re looking for managed services, you could consider Scaleway. They’re based in France, and their offerings span wider, including serverless [18] and managed services for Kubernetes [19], Postgres, MySQL, MongoDB, Redis [20]. On some parameters, Scaleway is cheaper than AWS, but it depends how you compare them [21]. A limiting factor is that they only have datacenters in the EU [22].

Finally, I’ll mention OVHcloud. Another French cloud provider. Of the options I’ve listed, OVHcloud has the broadest regional coverage with 43 datacenters across Europe, North America and Asia Pacific [23]. Like Scaleway, they provide managed Kubernetes [24], databases [25] and more. OVHcloud is typically cheaper than AWS, but again, it depends [26].

As you can see, the feature set and regional coverage varies by provider, but they have this in common:

They can probably host your apps (with some migration effort)
They are European-owned and comply with EU regulations
They are generally cheaper to use

Something to keep in mind here is vendor lock. EU public cloud providers appear more open than US ones. But if we migrate from the Big Three to one of these, we ultimately swap one proprietary dependency for another. Each business will have to assess if that’s an acceptable risk.

Your own cloud

You don’t have to be a renter to use cloud technologies. Over the years, open source has been catching up on cloud software. If you can put up the CapEx and deal with the operational complexity, running cloud-native workloads on your own hardware is a viable option.

Enter OpenStack, an open source cloud software project which was co-founded by NASA and RackSpace in 2010 [27]. OpenStack is popular among large European organizations such as CERN, Deutsche Telekom and Banco Santander [28]. It’s modular platform provides what you need for elastic storage, compute, networking and auth.

OpenStack isn’t the only option, either. There’s CloudStack, OpenNebula and proxmox, each with their own characteristics that suit them to different use cases [29].

On the hardware side, we have Oxide. They build specialised cloud computing hardware that ships with cloud platform software, ready to go [30]. Buy Oxide racks and start building.

Though all these approaches have matured significantly over the years, they’re not at feature parity with the US public clouds for managed services. Your engineering team will need to fill in some blanks if you adopt these technologies.

Bare metal

Another way to reduce your dependency on cloud providers is by leaving the cloud altogether. In 2022, 37signals (creators of Basecamp and HEY) made waves by announcing they would do that: exit the cloud and revert to the “old ways” of hosting with owned hardware [31].

Buy servers, rent a rack, put them in it and run your applications on them. If your traffic patterns are predictable and your application architecture isn’t too complex, running on your own hardware offers long-term cost savings and vendor independence. The tradeoff is a higher capital cost and a bigger (or at least different) operational burden.

David Heinemeier Hansson’s chronicle on the 37signals cloud exit is worth a read. It was a bold, but appropriate choice for them. Their application architecture was well-suited [32], they had scale with predictable growth [33], they had $600k to spend on hardware [34] and an ops team that could pull it off [35].

At scale, there is a strong financial case to be made for bringing home your cloud workloads. Sarah Wang and Martin Casado of a16z put it nicely: “You’re crazy if you don’t start in the cloud; you’re crazy if you stay on it” [36].

But how do you decide whether to make the leap?

Weighing the tradeoffs

Choosing a technology platform is a sticky decision with long-term consequences. Each option presents a trade-off: a benefit in one dimension costs you in another.

Here are some factors to weigh against your business constraints.

Short-term cost-effectiveness

How important is minimising initial spend? Pay-as-you-go and managed services of public clouds reduce the barrier to entry when cash is tight.

Long-term cost-effectiveness

Are we optimising for the next five years? As you scale, rental costs add up. Self-hosting requires upfront investment but can lower your total cost of ownership.

Data sovereignty

Who controls your data? A US-owned cloud is subject to the US CLOUD Act. EU-sovereign infrastructure keeps your data under European law.

Vendor independence

How much control do you want to retain? Building on proprietary services creates dependency. Self-hosting or open source solutions offer independence at the cost of operational complexity.

Workload elasticity

Is your traffic predictable or spiky? The Big Three excel at on-demand elasticity for unpredictable workloads. If your growth is stable, other options are more cost-effective.

Availability

What uptime do you actually need? Hyperscalers sell high-availability guarantees, but they’re expensive. Before paying for a 99.99% SLA, weigh the premium against the actual cost of downtime. Is it a crisis or an inconvenience?

Regional coverage

Where are your users? Performance means being physically close to them. The Big Three have a global footprint, while European providers are well-suited to customer bases primarily in the EU.

Putting these into your own business context is important:

A global hypergrowth startup with unpredictable traffic will benefit from hosting with the Big Three.

An non-tech B2B business with European customers will benefit from hosting with EU-sovereign public clouds.

An established tech business where margins matter might benefit from hosting on bare metal.

An EU enterprise that values elasticity with predictable spend could benefit from running their own open-source cloud.

There is no silver bullet.

Conclusion

At the beginning I asked three questions. Let’s see if we can answer them now.

Is hosting EU services in US clouds still a good idea?

For EU businesses, the answer is increasingly no. The current concentration on the Big Three is creating unfavourable market conditions, and the current political landscape poses a risk to European data security.

What are the options for EU-sovereign hosting?

There are several EU-sovereign public cloud offerings to choose from. These are typically the most direct migration path. But as we have seen, self-hosting with bare metal or even your own cloud is also a possibility.

How should an EU business choose its hosting strategy?

It’s a multivariate problem. You must weigh each option based on its fit to your business context and strategy. I highlighted concrete factors to consider, like short/long-term cost, sovereignty, independence, elasticity, availability and regional coverage needs.

As you will have gathered by now, there is a lot of nuance to the EU-US cloud dependency conundrum. I hope this post has provided you with tools for figuring out what you want to do about it.