Where does Datasight run, and under whose law?

Ask a supplier where your data will live, and the answer usually comes as a city: Frankfurt, Paris, Singapore. It is a reassuring answer to the wrong question. The city tells you where the servers are. A ministry, a bank or a hospital needs to know something else: who can be ordered to hand the data over, by which court, and whether anyone has to ask them first.

An address is not a jurisdiction

A jurisdiction is the reach of a country’s courts and laws. American law draws its line very clearly. Since 2018, a law called the CLOUD Act has required American providers to disclose the data in their “possession, custody, or control”, “regardless of whether such communication, record, or other information is located within or outside of the United States”. A server in your own country, run by a company bound by that law, has a local address. It does not give a local answer.

This is not a theoretical worry. On 10 June 2025, at a French Senate inquiry, the director of public and legal affairs of Microsoft France was asked, under oath, whether he could guarantee that French citizens’ data would never be handed over on an American order without the explicit agreement of the French authorities. “No, I cannot guarantee it,” he replied, adding that it had never yet happened. We believe him on both counts. That is exactly the difficulty: the guarantee no longer depends on the client, but on a court in another country.

Europe has answered, on paper. The GDPR says that a foreign court’s order to hand over personal data “may only be recognised or enforceable” in the Union if it rests on an international agreement. Since September 2025, the Data Act has asked cloud providers to take “all adequate technical, organisational and legal measures” against such access to other kinds of data. These are real protections, and a provider can rely on them to contest an order. But they do not cancel the order in the country that issued it. A company bound by both laws is caught between the two, which is exactly what the answer given to the Senate describes.

Three questions, not one

The confusion clears once the single question becomes three.

Where does the data sit? That is residency, and many suppliers now offer servers in the client’s own country.

Whose law can order it handed over? That is jurisdiction. The law of the country where the data sits applies. So does the law of the country the provider answers to, wherever its servers are.

Who holds the keys to the data and to the logs? That decides who can actually open them, whatever the contract says.

A provider from your own country answers the first two questions well. The third often still points to the provider. A platform installed in your own data centre, with your own administrators holding the keys, gives the same answer to all three: you. In the figure below, change who runs the server and watch the three answers.

Figure 1

Who runs the server?

Interactive

Your data, on a server in your country

1 of 3 answers are yours

• Where the data sits

  In your country

• Whose law can order it handed over

  Your country’s law, and US law through the CLOUD Act

• Who holds the keys

  The provider

Try itChange who runs the server and watch the three answers.

Run by An American provider A provider from your country You, in your own building

The server is in your country, yet a US court can also order the data handed over, and the provider holds the keys.

Where Datasight runs

The platform is set up in your data centre, next to the systems whose data it reads, and it does not depend on any outside cloud. What it reads, the links it finds and the alerts it raises are stored on your own machines, under your law and your security rules. The keys belong to your administrators.

We think this is what sovereignty should mean for a public body or a regulated company: not a flag on a data centre, but the plain fact that the platform answers to you.

How to check it

1. Ask every supplier, in writing, which laws could force it to hand over your data, including the laws of other countries.
2. Ask who holds the keys to the data and to the logs, and who could open them without you.
3. Read which law governs the contract, and which courts would settle a dispute about your data.

Next on the record · #2How does a deployment start?

Sources

1. 18 U.S. Code § 2713, “Required preservation and disclosure of communications and records”, added by the CLOUD Act, Pub. L. 115-141, div. V, 23 March 2018. Cornell Law School
2. Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation): Article 48. EUR-Lex
3. Regulation (EU) 2023/2854 of 13 December 2023 (Data Act): Article 32, applicable from 12 September 2025. EUR-Lex
4. French Senate, commission of inquiry on public procurement, hearing of Anton Carniaux and Pierre Lagarde (Microsoft France), 10 June 2025, record in French, our translation. Sénat