Moving virtual machines, object storage, Kubernetes and Postgres to one of the European cloud providers below is routine work. The cost sits in the managed services you've wired your app into, and in the people who'll run a less-managed stack afterwards. The legal case for leaving is narrower than most vendor pages suggest. CLOUD Act exposure depends on who owns the provider, not on which country holds the servers.
What the CLOUD Act actually changes for a GDPR-bound startup
Running on AWS in Frankfurt doesn't break GDPR by itself, but the reason is more specific than "the data stays in the EU". The US CLOUD Act reaches data through 18 U.S.C. 2713, which requires a provider subject to US jurisdiction to disclose data in its possession, custody or control "regardless of whether such communication, record, or other information is located within or outside of the United States" (the statute text, via Cornell's Legal Information Institute). The EDPB and EDPS say the same in their joint response to the European Parliament's LIBE committee on the Act. Server location doesn't take a US-owned provider out of reach.
GDPR Article 48 points the other way. Per the EDPB-EDPS annex, a foreign court or authority order is enforceable in the EU only through an international agreement such as a mutual legal assistance treaty. A provider under both regimes can end up holding two incompatible obligations. The annex also notes that a provider's route out is narrow: it can move to quash a request only where compliance would violate the law of a country with an executive agreement with the US, and where the request concerns non-US persons.
Now the counterweight. The European Commission adopted its adequacy decision for the EU-US Data Privacy Framework on 10 July 2023, and says personal data can flow freely to participating US companies. For most startups, US hyperscalers stay lawful. Our read: the live risk is a conflict-of-law question and a customer-trust question, not a prohibition.
The annex also leaves open whether the Act reaches EU operators that have some presence in the US, and how "control" applies to affiliates of US companies. Neither point is settled. Don't tell anyone a European provider is "CLOUD Act-free". The defensible statement is narrower: the Act reaches providers subject to US jurisdiction, so a provider with no US parent sits outside that wording as a general rule. Whether a specific provider's corporate structure gets it there is a question for counsel. For the transfer mechanics that apply to people rather than platforms, see our comparison of IDTA vs EU SCCs.
What moves easily and what does not
None of what follows comes from measured migration data. It's judgment from how these dependencies behave, and effort will vary with your codebase.
The easy to moderate end:
- Virtual machines and containers. They run anywhere that offers compute.
- Object storage, as long as the target speaks the S3 API and you test your SDK calls against it.
- Managed Postgres. The dump-and-restore path is well understood, and the work is mostly planning the cutover window.
- Kubernetes. Manifests move, but load balancers, storage classes and ingress annotations usually need rework.
The rewrite end:
- Serverless functions. Lambda handlers tied to AWS event sources don't port, and you'll rebuild the triggers even if the code survives.
- Proprietary NoSQL. DynamoDB has no drop-in equivalent, so your data model and access patterns get redone.
- IAM policies and event buses. These encode your permission model and your service wiring in AWS-specific form.
- Managed AI services. Rebuilding on a different model host is a design task, not a configuration change.
The pattern is simple. The more of your architecture is a provider's proprietary API, the more a move is a rewrite. If you want cost math for the labor side, our cloud migration cost guide covers it.
European cloud providers at a glance
The list below follows European Alternatives, an independent directory of European cloud providers. The directory labels each provider's country, not explicitly its headquarters. The Fit column is our judgment and not a rating, since pricing, regions and certifications would each need the provider's own pages.
| Provider | Country | Fit |
|---|---|---|
| OVHcloud | France | A French provider; check its managed Postgres and Kubernetes against your stack |
| Scaleway | France | A French provider; check its container offering against your stack |
| STACKIT | Germany | A German provider; start here if German buyers are your main audience |
| IONOS | Germany | A German provider; compare its managed catalogue before assuming parity with AWS |
| Exoscale | Switzerland | Swiss, so EFTA and not EU; confirm the data processing wording covers that |
| UpCloud | Finland | A Finnish provider; check its managed-service list against your stack |
| Elastx | Sweden | A Swedish provider; shortlist it if you want a Nordic option |
| Cyso Cloud | Netherlands | A Dutch provider; check whether its service list covers your managed dependencies |
| Aruba | Italy | An Italian provider; verify managed services against your needs |
| gridscale | Germany | A German provider; test your Kubernetes setup in a trial before committing |
The directory lists others too (Seeweb in Italy and T Cloud in Germany, for example). Whichever you pick, test your own workload on a small account first. A table can't tell you whether your Terraform modules and your Postgres extensions work there.
Hyperscaler sovereign options
You can stay with a US vendor and still change the ownership question. AWS describes its European Sovereign Cloud as "a new, independent cloud for Europe" and links an announcement of its launch. AWS's page doesn't name a location, an operator or a service list.
Our view: independent operation may reduce the parent-company problem, but it doesn't remove it on its own. Whether a US parent changes the CLOUD Act analysis for a given setup is a question for counsel, and it's one to ask before you budget a move or a stay.
The law now helps you leave
The EU Data Act has applied since 12 September 2025. The European Commission's Data Act page says providers may charge switching fees, egress included, until 12 January 2027. After that date, switching charges are removed entirely.
If egress cost is the thing keeping you on your current provider, that date is your planning anchor. This is judgment: a move timed after January 2027 costs less on the exit side than one done today, though it won't help with the rewrite work above. The Commission page I used doesn't confirm maximum notice periods or transition times, so check those in your contract.
Who runs it: skills for a less-managed stack
Fewer managed services means more platform work lands on your team. On AWS, someone else operates a lot of it. On a smaller European provider, you'll likely run more yourself: Kubernetes upgrades, Terraform modules, Postgres backups and failover, observability, and an on-call rota.
That's a hiring decision as much as a hosting one. A seed to Series A team often has one person who "does infra" on the side, and that works while a managed service absorbs the pain. It stops working when you own the pager. Budget for an engineer who has run production Kubernetes and Postgres before, in-house or contracted, before you commit to the move.
What to tell customers' security questionnaires
Enterprise and public-sector buyers will ask three things: where is the data hosted, who owns the provider, and who are your sub-processors. A move to a European provider changes the answers to all three, which is the point of doing it for those buyers.
Answer plainly. Name the provider and country, state its ownership as you've confirmed it with counsel, and list sub-processors as they are today. Don't promise "immune to foreign law", because you can't back it up. If you're building the answer set, answering contractor security questions shows the format buyers expect.
What this means for your hosting decision
You have three real options: stay on a US hyperscaler, move only regulated or customer-sensitive data stores, or move everything. Decide by customer demand, not ideology. If EU public-sector or regulated buyers are blocking deals on hosting questions, a partial move of the data stores is the cheapest way to answer them. If nobody's asking, the legal position doesn't force you out. The Data Privacy Framework keeps transfers to participating US providers lawful; confirm your provider's DPF listing. The CLOUD Act and Article 48 still leave a conflict-of-law risk.
If egress fees are your blocker, wait for 12 January 2027. If you can't staff the platform work, that's the real reason to stay. These are our recommendations, not legal advice. The next step is lining up who will run the stack: start with how to hire cloud engineers before you sign a contract with a new provider. For the wider compliance picture, see our hub on EU engineering hiring compliance: contracts, IP and GDPR.
Hiring platform engineers
If the platform work is the gap, HighCircl matches vetted DevOps engineers in 72 hours.
FAQ
What is the European equivalent of AWS?
No single provider matches AWS's catalogue. The European Alternatives directory lists OVHcloud, Scaleway, STACKIT, IONOS, Exoscale, UpCloud, Elastx, Cyso Cloud, Aruba and gridscale among its European cloud providers. Which one fits depends on the managed services you depend on today.
Does the CLOUD Act apply to data stored in the EU?
It can. The Act's text covers data in a provider's possession, custody or control regardless of whether it's located inside or outside the United States, and the obligation attaches to providers subject to US jurisdiction. Where that leaves a specific provider is a question for counsel.
Is using AWS in an EU region GDPR-compliant?
For most startups it can be. The Commission's Data Privacy Framework adequacy decision of 10 July 2023 lets personal data flow freely to participating US companies. The CLOUD Act conflict with GDPR Article 48 remains a risk to assess, and customers may still ask about it.
Can I move to a European cloud without rewriting my app?
Partly. Virtual machines, containers, object storage and Postgres usually move with modest changes. Serverless functions, DynamoDB-style databases and AWS-specific IAM or event wiring usually need rewriting. That's judgment, not measured data.
When do cloud switching fees disappear in the EU?
On 12 January 2027. Under the EU Data Act, providers may charge switching fees, including egress, until that date, and switching charges are removed entirely after it.
Sources
- EDPB and EDPS: Joint response to the LIBE Committee on the US CLOUD Act, annex
- Cornell Legal Information Institute: 18 U.S.C. 2713
- European Commission: EU-US data transfers and the Data Privacy Framework
- European Commission: Data Act explained
- AWS: Digital sovereignty in Europe
- European Alternatives: Cloud computing platforms