sota.io
2026-04-27·11 min read·sota.io team

Is Northflank Really EU? UK Jurisdiction, CLOUD Act Exposure, and GDPR Compliance Explained

Northflank markets itself as a European PaaS provider. Their website lists EU infrastructure regions. Their blog post "Best European PaaS Providers 2026" positions them alongside French and German providers.

What that post does not mention: Northflank is incorporated in England and Wales. The United Kingdom left the European Union on 31 January 2020. Since Brexit, UK incorporation is not EU legal jurisdiction — and for GDPR Art.44, NIS2 Art.21(2)(d), and DORA outsourcing compliance, that distinction is not a formality. It determines which legal framework governs your data, which authorities can compel disclosure, and which courts have jurisdiction over your provider.

This guide breaks down exactly what UK jurisdiction means for developers and CTOs using or evaluating Northflank — and what to look for in a genuinely EU-native alternative.

The Legal Status of Northflank

Northflank Limited is a private company incorporated in England and Wales (Companies House). Its registered office and operational headquarters are in London.

Key legal consequences:

The Transfer Mechanism Problem

When you use Northflank as an EU-based business or developer processing EU personal data, your data flows to a UK entity. That transfer requires one of:

  1. UK adequacy decision (Commission Decision 2021/1772)
  2. Standard Contractual Clauses (SCCs, Module 2 or 3)
  3. Binding Corporate Rules (not applicable for a provider of this size)

The Adequacy Decision Risk

The UK adequacy decision — adopted in June 2021 — is currently valid but contains a built-in expiry mechanism. It must be reviewed every four years and can be revoked if UK data protection law diverges materially from EU standards.

The UK adequacy decision is set to expire in June 2027.

The renewal is not guaranteed. The EDPB has previously flagged two specific risks:

  1. UK Investigatory Powers Act 2016 (IPA): Grants UK intelligence services broad bulk data collection powers without judicial pre-authorisation, which EDPB considers potentially incompatible with GDPR Art.52(1) necessity and proportionality requirements.
  2. UK reforms to UK GDPR: The UK government's Data (Use and Access) Act 2025 introduced some divergences from EU GDPR — including broader research exceptions and modified consent requirements — that the EDPB is monitoring.

If the adequacy decision is not renewed in June 2027, UK transfers revert to SCCs. If the IPA issue is not resolved, the EDPB could take a restrictive position on UK SCCs (similar to the original Schrems II position on US SCCs). This creates a forward compliance risk that does not exist with EU-incorporated providers.

The Investigatory Powers Act: UK's Equivalent of FISA 702

The US CLOUD Act (18 U.S.C. § 2703) gets significant attention for enabling US government access to data held by US companies globally. UK law contains a comparable mechanism.

The UK Investigatory Powers Act 2016 (IPA) allows:

For a UK-incorporated PaaS provider like Northflank:

The practical risk profile is different from CLOUD Act (UK intelligence focus vs US law enforcement + intelligence), but the structural mechanism is the same: physical data location does not determine legal exposure when the corporate entity is subject to UK law.

ICO vs EU DPA: Enforcement Divergence

Since Brexit, ICO and EU DPAs operate independently:

DimensionICO (UK)EU DPAs (Germany, France, etc.)
Legal basisUK GDPR + DPA 2018EU GDPR (2016/679)
FinesUp to £17.5M or 4% global turnoverUp to €20M or 4% global turnover
Cross-border coordinationNot GDPR Art.60-76 one-stop-shopFull EDPB cooperation mechanism
AI Act jurisdictionNot applicable (UK not in AI Act scope)Full AI Act scope (Art.2)
NIS2 reportingNCSC / NCA under UK NIS Regs 2018National CAs under NIS2 (Directive 2022/2555)

This has practical implications:

NIS2 Art.21(2)(d): Supply Chain Security

NIS2 Directive Art.21(2)(d) requires essential and important entities to implement measures covering "supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers."

For cloud infrastructure specifically, this means assessing:

  1. Jurisdiction of the provider: Is the provider subject to legal systems that could compel data disclosure?
  2. Physical data location: Are data centres in EU territory?
  3. Legal transfer mechanisms: What SCCs or adequacy instruments apply?
  4. Enforcement accountability: Which DPA has jurisdiction over the provider?

UK-incorporated providers like Northflank require a Transfer Impact Assessment (TIA) as part of your NIS2 supply chain assessment. EU-incorporated providers (Germany, France, Netherlands, etc.) do not require a TIA — they are subject to the same legal framework as your organisation.

NIS2 first compliance audits are expected from 30 June 2026 (63 days from now). NCAs in Germany (BSI), France (ANSSI), and the Netherlands (NCSC-NL) are developing audit frameworks that specifically assess cloud supply chain risk under Art.21(2)(d).

DORA Art.28: ICT Third-Party Risk

For financial services firms subject to DORA (Regulation 2022/2554), outsourcing to UK providers adds documentation requirements under Art.28 (ICT third-party risk management):

ESA technical standards under DORA Art.28 are pending. Early guidance from EBA and ECB suggests that jurisdictional risk should be explicitly addressed in ICT third-party assessments. UK providers are likely to require a higher documentation burden than EU-incorporated equivalents.

What "EU-Native" Actually Means

An EU-native PaaS provider is:

  1. Incorporated in an EU member state (Germany, France, Netherlands, etc.)
  2. Regulated by an EU DPA (BfDI, CNIL, AP, etc.)
  3. Subject to EU law — including EU AI Act, NIS2, GDPR directly
  4. No jurisdictional bridge to non-EU legal systems for compelled disclosure

This is different from:

from dataclasses import dataclass
from enum import Enum
from typing import Optional

class JurisdictionRisk(Enum):
    CLEAN = "CLEAN"        # EU-incorporated, no third-country bridge
    WATCH = "WATCH"        # Adequacy-dependent, monitor renewal
    REVIEW = "REVIEW"      # SCC required, TIA recommended
    HIGH = "HIGH"          # Active legal conflict risk

@dataclass
class PaaSJurisdictionProfile:
    name: str
    incorporation_country: str
    eu_member_state: bool
    dpa: str
    adequacy_or_scc: Optional[str]
    compelled_disclosure_law: Optional[str]
    ai_act_established_in_eu: bool
    nis2_tia_required: bool
    risk: JurisdictionRisk
    note: str

def evaluate_jurisdiction(profile: PaaSJurisdictionProfile) -> dict:
    issues = []
    
    if not profile.eu_member_state:
        issues.append(f"Not EU-incorporated: {profile.incorporation_country}")
    
    if profile.nis2_tia_required:
        issues.append("NIS2 Art.21(2)(d) Transfer Impact Assessment required")
    
    if profile.adequacy_or_scc == "adequacy" and profile.incorporation_country == "UK":
        issues.append("UK adequacy decision expires June 2027 — renewal uncertain")
    
    if profile.compelled_disclosure_law:
        issues.append(f"Compelled disclosure exposure: {profile.compelled_disclosure_law}")
    
    if not profile.ai_act_established_in_eu:
        issues.append("Not 'established in the Union' under AI Act Art.3(7)")
    
    return {
        "provider": profile.name,
        "risk": profile.risk.value,
        "issues": issues,
        "transfer_mechanism": profile.adequacy_or_scc or "None required (EU)",
        "dpa": profile.dpa,
    }

providers = [
    PaaSJurisdictionProfile(
        name="Northflank",
        incorporation_country="England and Wales (UK)",
        eu_member_state=False,
        dpa="ICO (UK) — not EU DPA",
        adequacy_or_scc="adequacy (expires June 2027)",
        compelled_disclosure_law="Investigatory Powers Act 2016",
        ai_act_established_in_eu=False,
        nis2_tia_required=True,
        risk=JurisdictionRisk.WATCH,
        note="UK adequacy expiry 2027 creates forward compliance risk"
    ),
    PaaSJurisdictionProfile(
        name="Clever Cloud",
        incorporation_country="France",
        eu_member_state=True,
        dpa="CNIL (France)",
        adequacy_or_scc=None,
        compelled_disclosure_law=None,
        ai_act_established_in_eu=True,
        nis2_tia_required=False,
        risk=JurisdictionRisk.CLEAN,
        note="EU-incorporated; no transfer mechanism required"
    ),
    PaaSJurisdictionProfile(
        name="sota.io",
        incorporation_country="Germany",
        eu_member_state=True,
        dpa="BfDI / LfDI Baden-Württemberg",
        adequacy_or_scc=None,
        compelled_disclosure_law=None,
        ai_act_established_in_eu=True,
        nis2_tia_required=False,
        risk=JurisdictionRisk.CLEAN,
        note="German GmbH; EU-native infrastructure; no CLOUD Act / IPA exposure"
    ),
    PaaSJurisdictionProfile(
        name="AWS (Frankfurt region)",
        incorporation_country="USA (Delaware)",
        eu_member_state=False,
        dpa="N/A — regulated by FTC / DOJ",
        adequacy_or_scc="SCCs + AWS DPA",
        compelled_disclosure_law="US CLOUD Act (18 U.S.C. §2703) + FISA 702",
        ai_act_established_in_eu=False,
        nis2_tia_required=True,
        risk=JurisdictionRisk.REVIEW,
        note="Physical EU region does not remove US legal jurisdiction"
    ),
]

for provider in providers:
    result = evaluate_jurisdiction(provider)
    print(f"\n{result['provider']} [{result['risk']}]")
    print(f"  DPA: {result['dpa']}")
    print(f"  Transfer mechanism: {result['transfer_mechanism']}")
    for issue in result['issues']:
        print(f"  ⚠ {issue}")

15-Item EU Jurisdiction Checklist

Before selecting a PaaS provider for workloads processing EU personal data:

Incorporation and Legal Framework

GDPR Transfer Compliance

Compelled Disclosure Risk

NIS2 and AI Act Compliance

Documentation and Exit Planning

The June 2027 Adequacy Cliff

If you deploy on Northflank today and the UK adequacy decision lapses in June 2027 without renewal:

Planning a 3-year infrastructure strategy? UK adequacy expiry in June 2027 is a known risk event that EU-native infrastructure eliminates entirely.

Northflank for Non-Personal-Data Workloads

If your workload does not process EU personal data — open-source builds, public static assets, development environments with synthetic data — UK jurisdiction creates no GDPR compliance risk. Northflank's developer experience and pricing may be appropriate for those workloads.

The jurisdictional analysis above applies specifically to workloads where GDPR, NIS2, DORA, or the EU AI Act creates regulatory obligations around the legal framework governing your infrastructure provider.

EU-Native PaaS: What the Alternative Looks Like

An EU-native PaaS provider incorporated in Germany, France, or the Netherlands gives you:

sota.io is a managed PaaS provider incorporated in Germany. EU-native infrastructure, no US or UK parent company, regulated under EU GDPR with BfDI as the competent authority. Managed Docker and PostgreSQL deployments from €9/month — with the jurisdictional clean-slate that EU compliance requires.

Related reading: Best European PaaS Providers 2026: GDPR, DORA, and Real EU Jurisdiction Compared · EU Region vs EU Jurisdiction: Why Railway Frankfurt Still Has CLOUD Act Exposure · NIS2 Compliance with EU-Native PaaS: June 2026 Audit Deadline Checklist