Home › Data protection › CLOUD Act index

Quarterly report · Q3 2026 · published 15 July 2026

CLOUD Act index Q3 2026

Where do Swedish businesses' data end up when they choose digital tools? Every quarter we review all tools in our catalogue (currently 183) for vendor jurisdiction, data storage and certifications. The figures are free to cite (terms).

1. Roughly one in three tools is controlled from outside the EU

74 of 183 reviewed tools (40 %) have a vendor based outside the EU/EEA, in most cases the USA. They can therefore be covered by the US CLOUD Act, which allows US authorities to request data from US companies regardless of where the data is stored. 47 tools (26 %) are Swedish and 62 (34 %) are from the rest of the EU/EEA.

2. The Enterprise gap: EU protection only for those who pay most

12 tools (7 %) offer EU data storage only on Enterprise or Business plans. A small business on a free or standard plan will have its data stored outside the EU, a caveat that rarely appears in marketing. In total 114 tools (62 %) offer EU data storage broadly, while 57 (31 %) lack it entirely.

3. Less than half are ISO 27001 certified

82 of 183 tools (45 %) have a documented ISO 27001 certification. 109 (60 %) have at least one security certification (ISO 27001/27701/42001, SOC 2, BSI C5). For the remaining roughly one third no documented certifications exist.

4. If the EU-US agreement falls: 17 % are unprotected

Should the Data Privacy Framework be struck down (Schrems III scenario), 101 tools (55 %) would be unaffected: Swedish/EU vendor with EU storage. 44 (24 %) would need review and 38 (21 %) depend directly on US transfers.

Method

The data is aivalet.nu's catalogue of 183 AI and digital tools for businesses. Each tool has been reviewed in at least two independent research rounds (web sources: vendor legal documentation, trust centers, company registers) regarding vendor legal residence, EU data storage by plan level and documented certifications. The selection consists of tools relevant to Swedish small businesses and the public sector; it is not a random sample of the whole market. Full methodology: How we review. Per-tool data: CLOUD Act status.

For journalists and researchers