Who can be ordered to hand over your authentication data

What the CLOUD Act says

The Clarifying Lawful Overseas Use of Data Act of 2018 added one sentence to US law that matters here: a provider must preserve or disclose records in its “possession, custody, or control, regardless of whether such communication, record, or other information is located within or outside of the United States”. Reach follows control of the data and US jurisdiction over the company, not the location of the server. The US Department of Justice states that an EU subsidiary of a US company is not automatically out of scope.

The EU data protection authorities took a position in 2019: unless an international agreement makes such an order enforceable, a service provider subject to EU law cannot lawfully base a disclosure on it. The EU has no such agreement with the United States. A US provider with EU customers can therefore be ordered to do something that EU law tells it not to do. Asked under oath by a French Senate committee in June 2025 whether it could guarantee that French public-sector data would never be handed to US authorities without French consent, Microsoft France’s legal director answered: “Non, je ne peux pas le garantir.”

What it does not do

The CLOUD Act creates no new kind of warrant and permits no bulk collection. Content still requires a warrant from a judge on probable cause of a specific crime, and the act is explicitly neutral on encryption: it adds no power to compel decryption. Microsoft told the same hearing that no European enterprise or public-sector customer had been affected since it began publishing transparency reports.

So the realistic risk is legal rather than operational. The concern is not that someone routinely reads your authentication logs. The question a regulator, an auditor or a NIS2 risk assessment asks is narrower: who can be compelled, under which law, and can your supplier give you a guarantee. For a US cloud service the honest answer to the last part is no.

Most MFA is a US cloud service

This is not a complaint about the vendors; it is what their own documentation says. Cisco Duo is a cloud service hosted on Amazon Web Services, with EU regions available, and its on-premise Authentication Proxy relays requests to that cloud. Its privacy data sheet lists usernames, phone numbers, device identifiers, end-user IP addresses and authentication logs as data held in the service. Okta is cloud only; its EU cell stores customer data in Germany and Ireland, while its sub-processor list names US-based providers for SMS and e-mail delivery. Microsoft’s EU Data Boundary documentation states that Authenticator push and phone-based sign-ins may be processed outside the boundary, and that IP addresses linked to fraud are published globally.

A European vendor on a US hyperscaler has a similar exposure one layer down, because the hyperscaler controls the infrastructure. That includes us when you choose our cloud, so we say so below.

On-premise Notakey: nothing we could be ordered to produce

The Notakey appliance is a virtual machine you run on your own infrastructure. The authentication server, its connection to your Active Directory, LDAP or RADIUS, the enrolled device certificates and every approval record live there. Notakey has no access to the appliance unless you grant it for a support case, so there is nothing in our possession, custody or control to hand over. An order for that data would have to be directed at you, under whatever law applies to you.

Each user’s private key is generated inside the phone’s secure hardware and never leaves it, so no copy exists anywhere else, including on the appliance. The one external touchpoint in an approval is the push notification. It carries the same readable text as the approval card, for example the service name, the account and the source address, in a template your administrators control, and nothing else: no keys and no way to approve. Apple’s and Google’s push services relay that text. Tapping the notification opens the app, which fetches the request from your appliance over HTTPS, checks that it matches the notification and only then signs the approval.

Notakey cloud: the honest version

Notakey Latvia, SIA is a Latvian company under Latvian law, with no US parent. Our cloud service, notakey.cloud, runs on Oracle Cloud Infrastructure in the Frankfurt region. Oracle is a US company, so you should assume the hosting layer of our cloud is within reach of US legal process, as with any European service on AWS, Azure or Google Cloud. We do not call the cloud offer sovereign, because it is not.

What a cloud instance holds: usernames or identifiers you choose, the public keys and certificates of enrolled devices, push tokens, and the signed approval records. Never the private keys, and passwords only where you create local users in the dashboard instead of connecting your own directory. If the hosting-layer exposure matters to you, the on-premise appliance is the same product with the same mobile app, and it costs less per user.

Three questions to ask any vendor

The word “sovereign” is being attached to a lot of products. The questions that cut through it are the same for us and for everyone else.

• ▪Under which law does the company that holds the data operate, and does it have a parent company elsewhere?
• ▪Who operates the servers, and under which law does that company operate?
• ▪What crosses to Apple and Google when a phone is involved, and does it include the content of the request?