The CLOUD Act follows the vendor, not the server
Enacted in March 2018, the CLOUD Act lets US authorities compel a provider subject to US law to hand over data it controls, wherever it is stored. A server in Frankfurt or Dublin therefore does not protect files entrusted to a US company.