US CLOUD Act reach: the corporate facts

For each vendor, the entity its terms name as your counterparty, where that entity is registered, and the ultimate parent the Global LEI Index records. Facts with sources, not a risk rating.

What the CLOUD Act is, and what this page does not say

The US Clarifying Lawful Overseas Use of Data Act of 2018 (18 U.S.C. § 2713) requires a provider of electronic communication or remote computing services to disclose data in its possession, custody or control when served with lawful US process — whether the data is stored in the US or elsewhere. Whether it reaches a given provider turns on that provider being subject to US jurisdiction and on what it controls, which are legal questions about a specific contract.

This page records the facts those questions start from: the entity the vendor's own terms name as your counterparty, where that entity is registered, and the ultimate parent the Global Legal Entity Identifier Foundation records for it. Where GLEIF records no parent, or the entity has no LEI, ownership is left as not determined rather than inferred. EU data residency and the EU-U.S. Data Privacy Framework are separate questions — see data residency and transfers.

The first column is a description of corporate facts, not an assessment of risk, and it is not legal advice. A vendor's US subprocessors are listed on its own page; they are not folded into this column.