Your host is in the EU. Your CDN, DNS and email aren't.

Short answer: Renting a server in Frankfurt or Helsinki is the easy part. The pieces wired around it — your CDN (serves your site from servers near each visitor), DNS (looks up your site’s address by its name), email, web fonts, sometimes your forms — are very often run by US companies, and US law can reach a US company’s data no matter where the servers physically sit. “Hosted in the EU” and “outside US reach” are not the same sentence. Here’s the difference, how to check your own stack (the set of services your site runs on), and what’s worth moving.

We run EU-based managed hosting and get asked “is my data in the EU?” a lot — so here’s the honest, practical version, not a legal lecture.

Residency is where the bytes sit. Sovereignty is whose law can reach them.

Two different questions, constantly confused:

Data residency — where your data is physically stored. Frankfurt, Helsinki, Dublin.
Data sovereignty — which legal system can compel access to it.

A server in Frankfurt gives you residency. It does not, on its own, give you sovereignty — because if the company operating it answers to US law, the location of the disk isn’t the deciding factor. As Cloudflare itself puts it, residency tells you where the bits are; it doesn’t tell you which government can ask for them.

Why US ownership matters, briefly

Two US laws are the reason this comes up:

The CLOUD Act (2018) lets US authorities compel a US-based provider to hand over data in its “possession, custody, or control” — regardless of whether that data is stored in the US or abroad. A US company storing your data in Frankfurt is still a US company under a US warrant.
FISA Section 702 lets US intelligence compel US electronic-communication providers to assist in targeting non-US persons located outside the US.

This isn’t “the US is reading your email.” It’s narrower and more boring than that: a US-headquartered provider can be legally obliged to produce data, and an EU location alone doesn’t switch that off. It’s exposure, not a conspiracy — and it’s exactly why the EU spent 2025 trying to cut the cord (the EuroStack push, Microsoft’s EU Data Boundary, AWS’s European Sovereign Cloud, the European Commission’s new “sovereignty ladder” for public-sector cloud contracts).

The US is hiding in your “EU” site

Here’s the part that surprises people. You can host in Germany and still send your visitors’ data to the US on every page load, through services you forgot were there:

CDN — Cloudflare, Fastly, AWS CloudFront. US companies. Your traffic flows through them.
DNS — Cloudflare DNS, Route 53. Every lookup of your domain.
Email — Google Workspace, Microsoft 365. The big one. Your actual business correspondence.
Fonts — Google Fonts loaded from Google’s CDN. (See below — this one already cost a German site money.)
Forms / spam / maps / video — reCAPTCHA, Google Maps, YouTube embeds, US form widgets.

Add those up and a site “hosted in the EU” can touch US infrastructure a dozen times before the page finishes loading.

A concrete example: the €100 font

This isn’t hypothetical. In January 2022 the Regional Court of Munich I (case 3 O 17493/20) ordered a website operator to pay €100 in damages to a single visitor — because the site loaded Google Fonts from Google’s servers, which passed that visitor’s IP address to Google in the US without consent. The court pointed out the obvious fix: host the font yourself. One forgotten <link> to a US CDN, real liability. Most “EU-hosted” sites still do exactly this.

How to check your own stack in ten minutes

You don’t need a lawyer for the first pass:

Domain & DNS: run a WHOIS (a public lookup of who runs a domain) and look at your nameservers (the servers responsible for your domain). Cloudflare or AWS in there? That’s US-run.
Email: look up your domain’s MX records (where the domain routes its mail). google.com or outlook.com means your mail lives at a US provider.
CDN: check the response headers (or just ask your host). cf-ray, x-amz-…, x-served-by: …fastly give it away.
The page itself: open your browser’s network tab and watch what loads. Anything from fonts.googleapis.com, google-analytics.com, gstatic.com or recaptcha is a call to the US.

The honest part

None of this means US services are illegal, or that you must purge every one tomorrow. For a lot of small businesses, a US CDN is a reasonable trade-off they’ve made on purpose. The problem is when it isn’t a choice — when you believe you’re “fully in the EU” and you’re not, and you can’t answer a client or an auditor who asks. Sovereignty is a dial, not a switch. The point is to know where yours is set.

Where we come in

We default the dial toward the EU, because for our clients it’s the easier answer to defend: servers at Hetzner in Germany and Finland, EU-based DNS, email on your own domain hosted in the EU (not handed to Google), self-hosted fonts (no fonts.googleapis.com, no €100 surprise), and EU-hosted, cookieless analytics instead of a US tracker. It’s the same site — just one that can actually answer “where does my data live?” with a single country. If you want to see what an EU-only stack looks like, or compare real EU hosts, start with our honest comparison of EU hosting providers.