sota.io
2026-05-10·15 min read

Salesforce Service Cloud EU Alternative 2026: CLOUD Act, Hyperforce EU Limits, and Einstein AI

Post #969 in the sota.io EU Compliance Series

Salesforce Service Cloud EU Alternative 2026: CLOUD Act and Hyperforce EU Limits

Salesforce is the world's largest CRM platform by revenue, with Service Cloud as its flagship customer service product. Salesforce Service Cloud processes help-desk tickets, live chat conversations, case management workflows, and agent productivity data for enterprise organisations globally. For EU organisations evaluating Service Cloud, two claims frequently appear in procurement discussions: "Salesforce has a Hyperforce EU option" and "we store data in EU data centres."

Both statements can be accurate. Neither resolves the core legal problem.

Salesforce, Inc. is incorporated in Delaware and headquartered at 415 Mission Street (Salesforce Tower), San Francisco, California. Under the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 18 U.S.C. § 2713), Salesforce is a US person obligated to disclose customer data to US law enforcement upon a valid legal order — regardless of where that data is stored physically. The CLOUD Act's reach is determined by corporate control, not server location.

Hyperforce EU data residency ensures that data-at-rest and certain processing operations occur on EU-located infrastructure. It does not create a separate legal entity outside US jurisdiction. Salesforce, Inc. — the US Delaware corporation — remains the controller of the platform. A CLOUD Act order compels Salesforce to disclose data it controls, regardless of which data centre region stores it.

Who Salesforce Is — Corporate and Legal Structure

Salesforce, Inc. is incorporated in Delaware and headquartered at 415 Mission Street, San Francisco, California 94105.

Key corporate facts:

Salesforce operates a standard US SaaS corporate structure for EU markets: an Irish entity (Salesforce.com EMEA Limited) handles the commercial relationship, and EU customers sign contracts and data processing agreements with this Irish subsidiary. The platform itself — infrastructure, codebase, operational control — is owned and operated by Salesforce, Inc. (Delaware).

Under 18 U.S.C. § 2713, the CLOUD Act extends to any entity controlled by a US person. A legal order served on Salesforce, Inc. in San Francisco compels disclosure of data accessible through entities it controls — including the Irish EMEA subsidiary and any EU data centre operations.

Marc Benioff and Salesforce's "Values" Narrative

Salesforce prominently markets its commitment to trust, privacy, and ethical AI. Marc Benioff has publicly advocated for GDPR-style regulation in the US and has positioned Salesforce as a privacy-forward technology company.

The legal analysis is independent of executive advocacy positions. Salesforce's CLOUD Act exposure is not a matter of corporate values — it is a matter of US federal law. Regardless of Benioff's public stance on privacy, Salesforce, Inc. is a US person that must comply with lawfully issued US government data disclosure orders. Corporate values cannot override statutory obligations.

Hyperforce EU: What It Does and What It Does Not Do

In 2020, Salesforce introduced Hyperforce — a rebuilt infrastructure architecture designed to run Salesforce products on public cloud infrastructure (AWS, Azure, Google Cloud) and enable geographic data residency. The EU Operating Zone is the regional option for EU customers seeking data residency within the European Economic Area.

What Hyperforce EU Provides

What Hyperforce EU Does Not Provide

CLOUD Act protection. The CLOUD Act's reach is not limited by data location. When US law enforcement serves a valid legal order on Salesforce, Inc., Salesforce must disclose data the company controls — the standard is control, not storage location. Hyperforce EU does not create a separate legal entity outside the scope of US corporate control. The data stored on EU servers remains subject to compelled US government disclosure.

This is the same limitation that applies to Microsoft's EU Data Boundary (as documented extensively in EU DPA decisions regarding Microsoft 365) and Amazon Web Services' EU data centre commitments: physical location of servers does not determine legal jurisdiction over the corporation operating those servers.

EU DPA enforcement record on data-residency products:

Multiple EU data protection authorities have issued guidance or decisions noting that infrastructure-level EU data residency does not resolve CLOUD Act or equivalent extraterritorial access issues. The Austrian DSB, French CNIL, and German IMY decisions regarding US cloud services consistently distinguish between storage location (which can be EU-localised) and legal access (which follows the corporation's home jurisdiction). Salesforce Hyperforce EU addresses the former, not the latter.

Hyperforce EU Operating Zone Limitations in Practice

Beyond the CLOUD Act structural limitation, Hyperforce EU has several practical constraints:

  1. Feature availability gap: Not all Salesforce products and features are available in the EU Operating Zone. Customers migrating to Hyperforce EU must verify that the specific Service Cloud capabilities they use are supported. As of 2026, some Einstein AI features and third-party AppExchange integrations have delayed or limited availability in the EU Operating Zone.

  2. Subprocessor chain: Salesforce's subprocessor list includes multiple US-based entities for specific functionality. Customers must review the current subprocessor disclosure and assess CLOUD Act exposure at each subprocessor.

  3. Support access: EU Data Residency does not prevent Salesforce support staff from accessing customer data for troubleshooting. EU Operating Zone includes access controls, but support-initiated data access creates a potential vector for data leaving the EU context.

What Service Cloud Data Contains

Salesforce Service Cloud is an enterprise customer service platform — distinct from Salesforce CRM (Sales Cloud) in its data profile. Service Cloud processes customer-facing interactions, support case histories, and contact centre workflows.

Data categories typically processed through Service Cloud:

Standard personal data (GDPR Art. 4):

Special-category data in practice (GDPR Art. 9):

Operational and behavioural data:

The enterprise scale of Service Cloud deployments means that a CLOUD Act order targeting a Salesforce customer's data could expose the support history of thousands or millions of EU data subjects — a material factor in GDPR Article 32 risk assessments.

Service Cloud Voice and Amazon Connect

Service Cloud Voice is Salesforce's telephony integration product, built on Amazon Connect — AWS's cloud contact centre service. Voice calls through Service Cloud Voice are processed by Amazon Web Services, Inc. — a Delaware corporation and another US person subject to the CLOUD Act.

Organisations using Service Cloud Voice have a two-US-entity subprocessor chain for telephony: Salesforce (Delaware) processes the CRM context and case data; AWS (Delaware) processes the voice infrastructure and call recordings. Both entities are independently subject to CLOUD Act compulsion.

Einstein AI: The Subprocessor Layer

Salesforce Einstein is the AI product layer integrated across Salesforce products, including Service Cloud. Einstein functions include:

As of 2026, Salesforce Einstein Copilot and generative AI features are built on a combination of Salesforce's own models and third-party LLMs, which may include OpenAI (Delaware) and Anthropic (Delaware). Salesforce's AI product disclosure documents and subprocessor lists should be consulted for current LLM infrastructure dependencies.

The subprocessor structure for Einstein generative AI features in Service Cloud:

EU Customer Data → EU Organisation → Salesforce, Inc. (Delaware) → LLM Provider (US entity)

When Einstein processes a customer's support ticket to generate a reply recommendation or classify a case, the content of that ticket is transmitted to the LLM inference infrastructure. That infrastructure may be operated by additional US-based entities, each independently subject to CLOUD Act obligations.

Hyperforce EU and Einstein AI: The EU Operating Zone's data residency commitments are explicitly qualified for Einstein AI features. Customers using generative AI capabilities should review Salesforce's current documentation on which Einstein features are available within the EU Operating Zone data residency guarantee and which involve data transfers outside EU boundaries for AI processing.

EU-Native Alternatives for Salesforce Service Cloud

Organisations seeking enterprise customer support platforms without US-person CLOUD Act exposure have several EU-native options. The feature gap versus Salesforce Service Cloud is real — particularly for large contact-centre deployments — but for mid-market and growing enterprises, the EU-native options cover core use cases.

1. Zammad (Berlin, Germany) — EU Open Source Enterprise

Zammad GmbH is a German limited liability company (Gesellschaft mit beschränkter Haftung) incorporated in Berlin, Germany.

GDPR profile: Zammad GmbH is a German entity subject to BDSG and EU GDPR. The self-hosted deployment option eliminates all subprocessor dependencies — EU organisations can operate Zammad entirely within their own EU infrastructure. No US-parent entity exists. No CLOUD Act exposure at the vendor level.

Feature comparison with Service Cloud: Zammad is a mature, feature-rich enterprise helpdesk — but it is a ticketing system, not a full contact-centre platform. Salesforce Service Cloud's native telephony (Voice), field service management (Field Service Lightning), and AI case management (Einstein) do not have direct Zammad equivalents. For organisations whose Service Cloud use is primarily case management, email, and chat — rather than full contact centre operations — Zammad covers the core workflow.

Best for: EU enterprises, government agencies, regulated-sector organisations (healthcare, finance, legal) that need self-hosted ticketing with complete data sovereignty and transparent open-source audit trail.

2. Crisp (Nantes, France) — EU Customer Messaging

Crisp IM S.A.R.L. is a French limited liability company (Société à Responsabilité Limitée) incorporated in Nantes, France.

GDPR profile: Crisp is a French company with no US-person parent entity. CNIL supervision applies. Infrastructure runs on EU providers. No CLOUD Act exposure.

Feature comparison with Service Cloud: Crisp is positioned for SME and mid-market customer support rather than enterprise contact-centre operations. It covers Salesforce Service Cloud's core messaging and ticketing use cases at a fraction of the cost. The AI features (Crisp MagicReply) are built on models hosted within Crisp's own EU infrastructure — a meaningfully different AI risk profile compared to Einstein Copilot.

Best for: EU SaaS companies, e-commerce, and SMEs seeking conversational customer support with full GDPR compliance and lower total cost than Salesforce.

3. LiveAgent (Bratislava, Slovakia) — EU Multi-Channel Support

Quality Unit, s.r.o. (operating as LiveAgent) is a Slovak limited liability company incorporated in Bratislava, Slovakia.

GDPR profile: Quality Unit is a Slovak EU company. Slovak data protection law and EU GDPR apply. No US-person parent entity. No CLOUD Act exposure.

Feature comparison with Service Cloud: LiveAgent provides a remarkably comprehensive feature set for its price point — native call centre functionality, a universal inbox across 11+ channel types, built-in SLA management, and an agent gamification layer. It does not match Salesforce's enterprise scale, AI features, or ecosystem integration depth, but for organisations running mid-market customer operations, LiveAgent is a capable EU-native alternative.

Best for: EU mid-market businesses seeking a multi-channel helpdesk including telephony, without the enterprise cost and US-jurisdiction risk of Salesforce Service Cloud.

4. LiveChat (Wrocław, Poland) — EU-Listed Enterprise Chat

LiveChat Software S.A. is a Polish joint-stock company (Spółka Akcyjna) incorporated in Wrocław, Poland, and listed on the Warsaw Stock Exchange (WSE: LVC).

GDPR profile: LiveChat Software S.A. is a publicly traded Polish company. Warsaw Stock Exchange listing provides regulatory transparency under Polish securities law. No controlling US entity. No CLOUD Act exposure at the parent level.

Note: A US entity (LiveChat, Inc.) exists for North American market operations. EU organisations should contract with LiveChat Software S.A. (Poland) and verify the DPA references the Polish entity as data processor.

Feature comparison with Service Cloud: The LiveChat group products cover core Service Cloud functionality through a modular suite. LiveChat handles real-time chat, HelpDesk handles ticket management, ChatBot handles automation. The product ecosystem lacks Service Cloud's native telephony depth and AI case analysis, but covers the majority of SME and mid-market support workflows.

Best for: EU businesses seeking an established, EU-exchange-listed customer support vendor with strong live chat capabilities and a growing multi-product ecosystem.

Salesforce Service Cloud Risk Summary

Risk CategoryAssessment
CLOUD Act ExposureHIGH — Delaware C-Corp, NYSE-listed, full US person status
Hyperforce EU MitigationPARTIAL — data residency only, CLOUD Act exposure unchanged
Einstein AI Subprocessor RiskHIGH — LLM inference via US-based providers
Service Cloud Voice RiskHIGH — Amazon Connect (Delaware) processes call recordings
GDPR Article 28 DPAAvailable; SCCs and BCRs provided
Schrems II RiskHIGH for regulated-sector organisations
Marc Benioff Privacy AdvocacyNot legally relevant

Migration Considerations

Migrating from Salesforce Service Cloud to an EU-native alternative is a materially larger project than migrating from simpler SaaS tools, due to Salesforce's deep customisation capabilities.

Typical migration workstreams:

  1. Case and ticket history — Salesforce exports to CSV; most EU alternatives support CSV-based historical import
  2. Contact and account records — Standard CRM export; GDPR-compliant data minimisation can reduce migration scope
  3. Custom objects and fields — Salesforce custom data models require mapping to the target platform's schema; this is often the most labour-intensive step
  4. Workflow automation and flows — Salesforce Flow and Process Builder automations must be recreated in the target platform's automation engine
  5. Integrations and AppExchange — Salesforce's 7,000+ AppExchange apps mean custom integrations are likely; each must be re-evaluated against the target platform's API
  6. Einstein AI models — Custom Einstein classifiers trained on Salesforce data cannot be exported; retraining on the new platform is required
  7. Telephony (if Service Cloud Voice) — Full contact-centre migration; the most complex workstream for organisations with significant voice volume

For large enterprise deployments, a phased migration — running Salesforce Service Cloud alongside an EU-native alternative for a transition period — is typically lower risk than a big-bang cutover.

Conclusion

Salesforce Service Cloud is operated by Salesforce, Inc. — a Delaware corporation headquartered in San Francisco, NYSE-listed, and fully subject to the CLOUD Act. Hyperforce EU data residency ensures that data is stored on EU-located infrastructure; it does not limit Salesforce's statutory obligation to comply with US government disclosure orders when compelled.

Einstein AI introduces a further layer of US subprocessor risk: generative AI features route customer support data through LLM providers that may include OpenAI or Anthropic — both Delaware-incorporated US persons with their own CLOUD Act obligations. Service Cloud Voice compounds this with an explicit Amazon Connect (AWS Delaware) subprocessor dependency for telephony.

For EU organisations in regulated industries — healthcare, financial services, legal, insurance — the layered US-person exposure in Salesforce Service Cloud represents a material GDPR compliance risk. The most capable EU-native alternatives are Zammad (Germany, for self-hosted enterprise ticketing), LiveAgent (Slovakia, for multi-channel support including telephony), and LiveChat Software (Poland, Warsaw Stock Exchange listed, for enterprise live chat and helpdesk).

This article is part of the EU Customer Support Software Series. Previous posts: Zendesk EU Alternative | Freshdesk EU Alternative | Intercom EU Alternative.

EU-Native Hosting

Ready to move to EU-sovereign infrastructure?

sota.io is a German-hosted PaaS — no CLOUD Act exposure, no US jurisdiction, full GDPR compliance by design. Deploy your first app in minutes.

Start free — no credit cardView pricing