"But our data is stored in Europe." We hear this sentence a lot when companies talk about Microsoft 365, OneDrive or Copilot. Usually it is even true – and yet it helps less than you might think. What matters is not only where the server is located, but who owns it.
In this article we explain, clearly and without scaremongering, what the CLOUD Act is about, how a personal subscription differs from a business subscription and where your data is stored when you work with 1Tool.
Patriot Act, CLOUD Act, FISA – which actually applies?
When it comes to US access, many people still think of the Patriot Act of 2001. Today, two other laws are more important:
- CLOUD Act (2018): US companies must hand over data when ordered to by US authorities – regardless of the country in which the data centre is located. A server in Frankfurt, Vienna or Zurich changes nothing as long as the provider is a US company.
- FISA Section 702: allows US intelligence services to monitor non-US citizens via US communication and cloud providers. This very provision was the reason the European Court of Justice struck down two earlier data agreements between the EU and the US ("Safe Harbor" in 2015 and "Privacy Shield" in 2020).
Microsoft itself openly admitted this before the French Senate in 2025: asked whether the company could guarantee that French customers' data would never be passed to US authorities without consent, the answer was essentially: no, it cannot guarantee that. According to Microsoft, it reviews such requests and pushes back wherever possible – but the legal obligation remains.
"But isn't there a data protection agreement?"
Yes. The EU-US Data Privacy Framework has applied since 2023, and its Swiss counterpart since 2024. Microsoft is certified under it. This makes transferring data to the US legally permissible.
There are two things you should know about it:
- The agreement governs whether data may be transferred – it does not prevent US authorities from accessing it.
- It is the third agreement of its kind. The European Court of Justice overturned both predecessors. Whether the current one holds also depends on the political situation in the US.
Personal or business subscription: a big difference
A common situation in smaller businesses: company documents end up in the OneDrive of a personal Microsoft account – for example with Microsoft 365 Personal, Family or Premium. That is convenient, but it is the wrong place for company data:
- No commitment on storage location. At Microsoft, the "EU Data Boundary" and data residency in Switzerland only apply to Business and Enterprise contracts. With personal subscriptions, data may also be stored or processed in the US.
- No data processing agreement under the GDPR. If you store customer data in a personal account, you lack the contractual basis you need as a company towards your customers.
- AI features. What you enter into Copilot may be processed outside Europe. Confidential quotes, HR data or health data do not belong there.
- Where you are does not matter. Whether you work from Graz, Munich or Zurich makes no difference – what counts is where the account is held.
Even with a business contract and European data residency, the CLOUD Act still applies. A business contract improves the situation considerably, but does not resolve the fundamental question.
Where is your data stored in 1Tool?
1Tool is developed and operated by Körbler GmbH in Austria. Your customer data, quotes, invoices, projects and documents are stored on our servers in a data centre in Wels (Upper Austria). It is operated by ITandTEL, a company of the Austrian eww Group.
- Austrian operator, Austrian law – no US company that can be compelled to hand over data
- ISO/IEC 27001 certified operations at the data centre operator
- 100% green electricity, largely from regional hydropower
- Redundant power supply with two UPS systems and an emergency generator
- Data protection under the GDPR – we are happy to discuss the details of data processing with you in person
To be honest: where there are exceptions
We don't want to promise you anything that isn't true. There are features where data deliberately reaches another provider – but only if you switch them on yourself:
- Connecting a Microsoft 365 mailbox: if you connect your Outlook mailbox to 1Tool, emails naturally go through Microsoft – exactly as if you were writing them directly in Outlook. This is how the connection works.
- AI features: the AI in 1Tool runs with your company's own key at an AI provider. Without this key, the AI is switched off and nothing leaves the data centre.
So you decide which data goes where – and the default is: your data stays in Austria.
And what about Office documents?
If you mainly use Microsoft for Word, Excel and PowerPoint, you can work directly with EuroOffice in 1Tool: open, edit and share documents – without a Microsoft licence and without the files leaving the 1Tool servers. More about the EuroOffice integration.
Checklist: how well is your company data protected?
✅ Is customer data stored only in business accounts – not in personal cloud subscriptions?
✅ Do you have a data processing agreement with every cloud provider?
✅ Do you know in which country the provider has its registered office – not just its data centre?
✅ Are there rules on which data may be entered into AI tools?
✅ Are particularly sensitive files additionally encrypted before they go into a US cloud?
If you hesitate on any point, it is worth taking a closer look.
Conclusion
A European data centre is good; a European provider is better. For private photos and documents, Microsoft 365 is a solid choice. For your company's customer data, quotes and invoices, you should know who can ultimately access them.
With 1Tool, your business data is held by an Austrian provider in an Austrian data centre – and you have CRM, quotes, invoices, projects, tickets and documents in one solution.
👉 Would you like to see what this looks like in your company? Book a demo now.
Note: this article provides a general overview and is not legal advice.
More articles:
Microsoft 365 in 1Tool: connect your mailbox – with instructions for your IT1Tool replaces Microsoft OfficeVibe coding with 1Tool: the platform beneath your AI app