--- title: Zitadel and the US CLOUD Act description: Learn how Zitadel addresses data sovereignty and the US CLOUD Act through self-hosted deployment options and regional contracting entities. --- [Skip to content](https://help.zitadel.com/zitadel-us-cloud-act-data-sovereignty#main-content) [![zitadel-logo\_text-dark (1)](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark%20(1).png?width=210&height=60&name=zitadel-logo_text-dark%20(1).png)](https://help.zitadel.com/?hsLang=en) Open main navigation Close main navigation - [Documentation](https://zitadel.com/docs) [Documentation](https://zitadel.com/docs) How can we help you? - There are no suggestions because the search field is empty. 1. [ZITADEL Knowledge Base](https://help.zitadel.com/?hsLang=en) 2. [Security & Compliance](https://help.zitadel.com/security-compliance?hsLang=en) September 29, 2026 # Zitadel and the US CLOUD Act ## How Zitadel Self-Hosted and flexible contracting entities protect your data from foreign jurisdiction exposure ### **Overview** Understanding how international data privacy laws and cross-border regulatory frameworks apply to identity and access management (IAM) is critical for organizations seeking full data sovereignty. This article explains the impact of the US CLOUD Act on Zitadel services, references our corporate structure and contracting entities, and highlights how deploying Zitadel Self-Hosted completely removes exposure to the US CLOUD Act. ### **What is the US CLOUD Act?** The **Clarifying Lawful Overseas Use of Data (CLOUD) Act** is a US federal law enacted in 2018. It allows US law enforcement authorities to compel US-based technology companies to provide requested data stored on their servers, regardless of whether that data is located within the United States or abroad. For European and international organizations bound by strict data protection regulations (such as the GDPR or Swiss FADP), the extraterritorial reach of foreign disclosure requests creates potential compliance and legal challenges when using cloud services hosted or operated by US entities or their subsidiaries. ### **Corporate Setup and Contracting Entities** For organizations opting for Zitadel Cloud or commercial agreements, Zitadel offers flexible structuring through distinct regional legal entities (such as Zitadel AG in Europe versus Zitadel Inc. in the US). Depending on your governance and regulatory needs, you can review our documentation on [contracting entities](https://help.zitadel.com/corporate-structure-contracting-entities?hsLang=en) to engage with the appropriate corporate entity, ensuring your commercial agreements align fully with local compliance frameworks, data protection standards, and regional jurisdiction. ### **Eliminating US CLOUD Act Risk with Zitadel Self-Hosted** For organizations with stringent data sovereignty, air-gapped, or zero-trust regulatory mandates, **Zitadel Self-Hosted** provides a complete solution. **Key Risk Elimination Factors** 1. **No Third-Party Processors or Vendors:** When running Zitadel Self-Hosted, the software is deployed directly inside your own infrastructure—whether on-premises, in a private cloud, or in your designated public cloud tenancy (e.g., AWS, GCP, Azure). 2. **Zero Access to Data or Infrastructure:** Zitadel (neither ZITADEL Inc. nor CAOS AG) has any operational access, backdoors, administrative privileges, or visibility into your host environments, databases, user credentials, or security logs. 3. **Complete Removal of Vendor Compulsion:** Because no customer data or infrastructure is hosted, managed, or accessed by Zitadel or any third-party sub-processors, neither ZITADEL Inc. nor CAOS AG possesses any data that could be turned over in response to a US CLOUD Act subpoena or foreign government order. 4. **Total Data Sovereignty:** Your organization retains exclusive possession and control of all encryption keys, authentication data, and operational logs, ensuring 100% compliance with local data protection laws. ### **Summary** - **ZITADEL Cloud** offers GDPR and Swiss FADP-compliant identity management, with contracts governed by CAOS AG under Swiss law for non-US users (see [Corporate Structure & Contracting Entities](https://help.zitadel.com/corporate-structure-contracting-entities?hsLang=en)). - **Zitadel Self-Hosted** fully eliminates US CLOUD Act risks by ensuring that no third-party processors or vendors have access to your data or infrastructure, giving you full control and data sovereignty. - [Getting Started](https://help.zitadel.com/getting-started?hsLang=en) - [User Management](https://help.zitadel.com/user-management?hsLang=en) - [Authentication & Login](https://help.zitadel.com/authentication-login?hsLang=en) - [Security & Compliance](https://help.zitadel.com/security-compliance?hsLang=en) - [Troubleshooting](https://help.zitadel.com/troubleshooting?hsLang=en) - [Account & Subscription](https://help.zitadel.com/account-subscription?hsLang=en#main-content) - [Support](https://help.zitadel.com/account-subscription?hsLang=en#support) - [Billing (Pro)](https://help.zitadel.com/account-subscription?hsLang=en#billing-pro) - [Billing (Enterprise)](https://help.zitadel.com/account-subscription?hsLang=en#billing-enterprise) - [Zitadel Cloud Account](https://help.zitadel.com/account-subscription?hsLang=en#zitadel-cloud-account) - [Service Description](https://help.zitadel.com/account-subscription?hsLang=en#service-description) - [Default Settings](https://help.zitadel.com/default-settings?hsLang=en#main-content) - [Web Keys](https://help.zitadel.com/default-settings?hsLang=en#web-keys) - [Self-Hosting](https://help.zitadel.com/self-hosting?hsLang=en) [![zitadel-logo\_text-dark](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark.png?width=210&height=60&name=zitadel-logo_text-dark.png "zitadel-logo_text-dark")](http://zitadel.com) 1 Embarcadero Center, Suite 1200 San Francisco, CA 94111 Copyright © 2025 All rights reserved.