That's true but the EU still has a - mostly - functioning legal system. See 'Schrems' and other lawsuits that came out as they should have.

True, I think the calculus is more about who you think is more trustworthy than what tools they have to damage you.

I am almost positive things are not the way they were and requests for data access especially if the subjects background is "suspect" are more highly scrutinized.

And as the Americans are choosing to interfere in European domestic politics and trample their own laws and constitution the more scrutiny their requests will get.

Especially if European companies have an office and significant share of customers in the US.

The point of control is Congress, until we stop electing corpratist politicians, we will continue to get bad legislation.

Which wouldn't matter where the data is located, so I don't think that this is the reason Fastmail is doing it, because a savvy enough company would know that the problem is that the company is US based.

Something like 99% of email is now done over TLS.

Requiring that you believe those companies that they won’t hand the keys over to the US at the first ask.

Like, the critical problem with the AWS sovereign pitch is that you must believe that they won’t give the keys to the US, and they also won’t give the source code that’s hosted in the US to the government either for them to find vulnerabilities in. I don’t know if that’s good enough unless you just need the data to stay in the EU and you don’t care if another country sees it.

I know they probably did some work on it (what if primary AWS goes rogue and the EU entity must work without it) but I don’t know if they explained how they’re safe to the public.

You can strike at least four of those.

> AWS, Azure, GCP, Oracle

What? Those are US companies, they will have to give out your data under the Cloud Act. Only Schwarz and SAP are free from that by being German companies.

I hope Airbus is large enough for you?

https://thenextweb.com/news/airbus-scaleway-aws-sovereign-cl...

And many others besides, pretty much every company I've looked at in the last year is either acutely aware of the problem or they are already executing on it. With Trump and his merry band of criminals repeatedly stating they're going to take Greenland by force you can't blame them either, that would effectively put the EU on a war footing with the United States (I still can't believe I'm writing this sort of thing and it is not entirely fiction), the end result of that would be that there would be an absolute run on EU hosted capacity. They're just trying to beat the rush and hope they'll never be proven to be right.

HN Search: airbus critical apps scaleway - https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

Gov.uk has replaced Stripe with Dutch provider Adyen - https://news.ycombinator.com/item?id=48415217 - June 2026 (235 comments)

Netherlands reaches deal with European cloud company to decrease U.S. tech reliance - https://nltimes.nl/2026/04/24/netherlands-reaches-deal-europ... - April 24th, 2026

Wary of US Big Tech, the EU looks to build its “EuroStack” - https://sherwood.news/world/wary-of-us-big-tech-the-eu-looks... - March 18th, 2026

Why European Companies Are Leaving US Cloud Providers in 2026 — And Where They're Going - https://massivegrid.com/blog/european-companies-leaving-us-c... - March 12th, 2026

Europe gets serious about cutting digital umbilical cord with Uncle Sam's big tech - https://www.theregister.com/off-prem/2025/12/22/europe-gets-... - December 22nd, 2025

Schleswig-Holstein waves auf Wiedersehen to Microsoft stack - https://www.theregister.com/software/2025/10/15/schleswig-ho... - October 15th, 2025

EU Banks Launch Wero Payments to Dislodge Visa, Mastercard - https://news.ycombinator.com/item?id=41666833 - September 2024 (88 comments)

https://european-alternatives.eu/

https://euro-stack.com/

> Take Hetzner as an example.

Similar happened already with OVH Canada vs France.

> In an affidavit, Xavier Barriere, corporate counsel at OVH in Paris, describes the dramatic situation: If the important proponent of European data sovereignty were to comply with the Canadian order, those responsible in France would be committing a criminal offense. They face up to six months in prison and fines of up to 90,000 euros per violation. However, if OVH ignores the Canadian court, it faces contempt of court proceedings in Ontario, which can also lead to severe sanctions.

https://www.heise.de/en/news/Canadian-Court-OVHcloud-from-Fr...

And one comment here: https://news.ycombinator.com/item?id=46060903

Well, for sure they can pressure them but I highly doubt Hetzner would break the law in Europe to satisfy the US government, they are a lot more to lose here than there. I realize that that is not proof.

Australia and the US entered into a bilateral agreement in 2024 which made Australian companies subject to the US CLOUD Act.

https://www.justice.gov/criminal/criminal-oia/cloud-act-agre...

As a FastMail customer who spends a portion of the year in the US, I am happy to pay to move my data to the EU region, even if they cannot yet fully guarantee all my data will remain outside of US access at this time. Defense and mitigations in depth, over time. We must always start somewhere, and perfect is never the target (as it does not exist).

But whose cloud infrastructure do they use? (I don't know, but it might likely be AWS, GCP, or Azure.)

Why would apple care? Eu is what a quarter of their business? And where exactly will those people move? They're locked into the Apple infra.

And hosted on US infrastructure, satisfying the "or" clause in their post

Not only is that not true, but in fact FastMail predates AWS by some years.

Source: I founded FastMail.

Fastmail has never used AWS, and this article is pretty clear about how they have always used their own hardware and traditional colocation.

Fastmail used to be based in Melbourne only, but after the Pobox merger it ended up with an office in Philadelphia too. No idea how the balance of things is between the offices now.

But how is it actually "a start" or improves anything at all? It doesnt matter where the "physical location" of the data is. It matters who has access to it.

Fastmail runs on its own infra.

For me this is already a better value proposition, as less value add happens in the US. With the US being a perpetrator in trade war against the EU, even this matters. Everything counts, in large amounts...

I think they just know what they can and can't guarantee.

they also said in the article it is dependent on them standing up a second EU region. this is simply an announcement of their first.

Your reply is dishonest. I obviously couldn't replicate the entire article, but I'm assuming everyone that reads my comment also has read the article. And so you know very well what I meant.

If you advertise foolproof safes, but they end up not in fact being exactly that very thing you advertised then I'm sure you will have a great reason as to why actually your 'foolproof' safe can not be foolproof and you never guaranteed such a thing in your tos.

But at the end of the day, you promised foolproof safes, and you did not deliver.

Your argument is "well if you leave the lock open then...". And the reply to that argument is that "yes, we all know". The fact that I the user can make a mistake, does not excuse the company from saying "well, anyway, he would have made a mistake anyway so why bother"

At the moment all your data is still replicated in the US (they say it will change in the future, sure) and all the logs are also stored there, with no plans to change it or more details into what they contain.

As of now there's no guarantee of... anything, really.

Obviously if you decide to send an email to the US you're choosing to send your data there, that's a strawman.

Its not about the people you send emails to, its about who has access to your entire mailbox.

In the moment that would be the Trump Administration for example.

> The CLOUD Act authorizes bilateral agreements between the United States and trusted foreign partners that will make both nations’ citizens safer, while at the same time ensuring a high level of protection of those citizens’ rights.

I think the keywords are "trusted" and "citizens' rights". US burned a lot of trust in the last few years, and what's happening with ICE doesn't really scream "citizens' rights" either. I can see why many "trusted foreign partners" would now think twice rather than help out the US compared to just 5 years ago.

As a EU person, I'd really like to not have ties with US when possible, and I'd really like to foster the economy of non-US alternatives.

the company is based in Australia, which is part of FVEY

Is fastmail not australian?

No, but there are nine eyes and fourteen eyes with EU countries.

they offer services in the EU

Splendid, thank you. the european-alternatives.eu is exactly what helped! Appreciate it!

Thank you. Sure. In Europe the "euro stack" approach becomes more and more relevant. So, the issue is more a compliance topic in the way of making use of service provides, who are best-case "eu-headquartered", but at least with a guarantee that processing on my side stays within the european realm. Doesn't mean very little in a technical understanding of security, I agree.

Proton is leaving Switzerland because of surveillance and privacy issues.

> Because of legal uncertainty around Swiss government proposals to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland.

https://proton.me/blog/lumo-ai

They are moving to Germany, but will quickly find that they are going to face the same surveillance and privacy issues since the EU is in the process of negotiating a data sharing agreement under the US Cloud Act.

https://www.justice.gov/archives/opa/pr/justice-department-a...

Even at cloud prices, 50GB of storage is ~$1/month. Offering an additional tier with pathetic storage to save $0.80 or whatever is muddling the offering.

I guess they could offer a 0GB storage option that only operated as a relay?

How is that possible if the OS/drive/vault is backdoored? Could you elaborate?

I think "resilient" just means "backup copy" and I do think (IANAL) it is illegal to destroy emails when asked for them in the US.

Or was your comment ironic? Sorry, German, irony impaired.