Agent Wranglers

INF-89Recommended

Record which governments can demand each provider's data

For each provider that holds personal or confidential data, record its parent company's country and the laws that can force it to hand data over. Choose a provider under another law when a customer contract or a transfer assessment rules that law out.

By Agent Wranglers. Updated .

How to do it

A data centre in the EU does not settle who can reach the data. A provider owned by a US company can be ordered under the US CLOUD Act to hand over data it controls, wherever it is stored. Many EU customers and public bodies ask about this in procurement. Note for each provider its parent's country, the region of the data and who holds the encryption keys. Keys you hold yourself, outside the provider, limit what an order can reveal, as Keep encryption keys in a key service explains. The legal side of transfers is in Record a legal basis for every transfer.

How to check

The provider list names, for every provider with personal or confidential data, the parent's country, the data region and the key holder. Every customer contract that limits jurisdictions matches the list.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/hosting-platforms/provider-jurisdiction">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.