---
title: "Record which governments can demand each · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/hosting-platforms/provider-jurisdiction
id: INF-89
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 806
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Record which governments can demand each provider's data

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-89
- Level: Recommended
- Chapter: [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms.md)
- Rule: For each provider that holds personal or confidential data, record its parent company's country and the laws that can force it to hand data over. Choose a provider under another law when a customer contract or a transfer assessment rules that law out.
- Check: The provider list names, for every provider with personal or confidential data, the parent's country, the data region and the key holder. Every customer contract that limits jurisdictions matches the list.
- How: A data centre in the EU does not settle who can reach the data. A provider owned by a US company can be ordered under the US CLOUD Act to hand over data it controls, wherever it is stored. Many EU customers and public bodies ask about this in procurement. Note for each provider its parent's country, the region of the data and who holds the encryption keys. Keys you hold yourself, outside the provider, limit what an order can reveal, as [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md) explains. The legal side of transfers is in [Record a legal basis for every transfer](https://agentwranglers.se/playbook/compliance/processors-and-transfers/transfer-basis.md).

## Sources

- [US Department of Justice, CLOUD Act resources](https://www.justice.gov/criminal/cloud-act-resources)
- [EDPB Recommendations 01/2020 on supplementary transfer measures](https://www.edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012020-measures-supplement-transfer_en)

## Related rules

- APS-57 [Keep encryption keys in a key service](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/key-management.md) in Application security
- CMP-16 [Record a legal basis for every transfer](https://agentwranglers.se/playbook/compliance/processors-and-transfers/transfer-basis.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/hosting-platforms/provider-jurisdiction">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Choose regions from users and data rules](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/region-choice.md)
- Next: [Price data transfer and per-request charges before launch](https://agentwranglers.se/playbook/infrastructure/hosting-platforms/usage-cost-model.md)
- [Hosting platforms](https://agentwranglers.se/playbook/infrastructure/hosting-platforms.md)