Your data is not safe just because it is stored in Europe.

American companies must hand over data wherever it is stored. The physical location of the server is irrelevant under US law.

"A provider of electronic communication service or remote computing service shall comply with the obligations of this chapter to preserve, backup, or disclose … regardless of whether such communication, record, or other information is located within or outside of the United States."

— CLOUD Act, 18 U.S.C. § 2713 (2018)

Data only needs to be considered 'relevant and material' to an ongoing investigation. Once a US judge approves the order, your provider must comply.

"The standard for issuing an order … is whether the contents of the communication or records sought are relevant and material to an ongoing criminal investigation."

— Department of Justice, CLOUD Act Guidance (2019)

Gag orders prevent your provider from informing you that your client data has been accessed. You can violate your professional confidentiality obligations without ever knowing it.

"The court shall enter such an order prohibiting notification if the court determines that there is reason to believe that notification … will result in … destruction of or tampering with evidence, intimidation of potential witnesses, or otherwise seriously jeopardizing an investigation."

— 18 U.S.C. § 2705(b)