An EU-incorporated company invoices in euros and quotes GDPR on its website — yet if the corporate mailbox still lives in a US-headquartered cloud suite, two facts stack on top of each other. First: where the bytes sit on disk. Second: which legal system can compel access to those bytes. Those are not the same sentence.
Sales decks say “your data is in a European region.” Ops picks a region and sees a green pin on a map. CLOUD Act and Schrems II ask a different question: which jurisdiction binds the provider, which court path applies to compulsory disclosure, and whether you hold SCCs plus a transfer impact file. This is not legal advice; it separates two axes procurement and IT often merge.
Where it sits ≠ who can access
Residency: bodies, attachments, indexes and backups in a country. Legal access: the law binding the provider, government disclosure orders, admin access and support staff. A mailbox can sit in an “EU region” while the vendor is a US-group company — then “disk not in Sofia but law in New York,” or “disk in Frankfurt but order chain in the US,” both land on the table.
Conversely: mailboxes in Sofia, provider under an EU member-state law, no US parent — residency and legal access point the same way. EuroVDC corporate email uses MX securemail.eurovdc.eu with data in Bulgaria — details: corporate email data in Bulgaria.
CLOUD Act and Schrems in one paragraph
The CLOUD Act frames how US authorities may, under conditions, seek data held abroad from US companies (and certain affiliates). After Schrems II, Privacy Shield fell; SCCs remained, with transfer impact assessments and supplementary measures still debated. “Region = EU” alone does not close that file. Broader checklist: GDPR hosting — EU datacenter Sofia.
Practical read: open the DPA for subprocessors, support access and third-country transfer lines. A marketing map is not evidence.
Decision matrix for an EU company
- Who invoices you: EU legal entity or US parent?
- Mailbox location: production and backups documented in the same country?
- MX and clients: traffic to a clear host like
securemail.eurovdc.eu, or multi-region routing? - DNS control: zone on
ns1.eurovdc.eu/ns2.eurovdc.eu, or a separate DNS product? - Questionnaire answer: can you write one paragraph on CLOUD Act exposure?
Sofia EU business mail overview: business email on EU servers in Sofia. Product: corporate email.
Three sentences that confuse audits
- “We have TLS, so data is in the EU” — TLS protects transit, not disk location.
- “Staff connect from Europe” — client geography does not change provider jurisdiction.
- “Backup in EU, primary in US is fine” — if the contract does not say which copy a warrant can reach, risk remains.
Bottom line: EU company + US mail is not only latency or UI preference. Write residency and legal access on separate lines; a Sofia-hosted mailbox under an EU-law provider keeps questionnaires from splitting one answer into two conflicts.
FAQ
Does picking an EU region close CLOUD Act risk?
No. Region is a residency claim; the provider’s governing law and disclosure paths are assessed separately.
Is this legal advice?
No. Concept split for procurement/IT. Use counsel for transfers and risk.
What does Sofia hosting simplify?
EEA residency plus an EU provider shortens many third-country files; you still need a DPA.
Is pointing MX to securemail.eurovdc.eu enough?
It is required for delivery; legal-access analysis also needs DPA, ownership and backup location.
Can the site be in Sofia and mail in the US?
Technically yes; questionnaires then need two residency/legal-access answers. Many teams unify both.
