70% of your data in the American cloud?
European companies innovate using American software. According to the French Senate, nearly 70% of their data is hosted on US cloud infrastructure.
Thursday October 01, 2026
Every day, companies in Europe use American software to organize their projects, prepare new products, share studies, or plan their development work. Each task may seem harmless. Yet, taken together, this information can reveal an innovation strategy several months before it reaches the market.
A roadmap, a prototype, a budget, or the name of a future partner is not just routine business information. These are parts of a company's industrial assets. The question is therefore no longer simply, “Which tool is the most practical?” We must also ask, “Where does our data go, and who can access it?”
Your software knows about your innovations
Project management software can contain far more than a list of things to do. By examining its cards, documents, and activity history, it may be possible to understand what a company is preparing, who is involved, and when it is expected.
- future product roadmaps;
- studies, plans, mock-ups, and prototypes;
- the names of customers, partners, and suppliers;
- budgets, costs, and internal decisions;
- test results, incidents, and technical difficulties;
- responsibilities, decisions, and working methods.
💡 Innovation is not found only in a patent
It can also be seen in a schedule, a series of tasks, an attached document, or a project name. Even without access to the complete file, combining these pieces of information may reveal an industrial strategy.
Nearly 70% of data is hosted on US clouds
The finding is now official. In its 2026 report on the impact of artificial intelligence on businesses, the French Senate states that nearly 70% of French companies' data is hosted on American cloud infrastructure.
This figure concerns all business data, not only information held in project management software. However, these applications naturally form part of the SaaS ecosystem used to create, share, and retain professional information.
One important distinction must be made: American infrastructure does not necessarily mean that the server is physically located in the United States. It may be installed in European country while belonging to a group subject to US law. Technical location and legal control are two different matters.
How can industrial information leak?
| Risk | What can happen | Consequence for innovation |
|---|---|---|
| 🛡️ Cyberespionage | An attacker targets accounts, infrastructure, or digital service providers | Theft of documents, methods, research results, or technical data |
| ⚠️ Misconfiguration | A board, file, or sharing link becomes publicly accessible | Unintentional exposure of projects, credentials, or internal information |
| ⚖️ Extraterritorial law | A foreign provider may receive a request based on the laws of its home country | Loss of legal control over certain hosted information |
| 🔒 Vendor dependency | Migration becomes complex, expensive, or technically difficult | The company no longer has complete control over project continuity |
Data leaks from collaborative tools have already happened
The risk is not theoretical. In 2021, Kaspersky reported the exposure of information from public Trello boards belonging to hundreds of large companies and thousands of smaller organizations. This was not necessarily a breach of the platform itself, but was often caused by poorly managed privacy settings.
This example shows that software can be technically robust while still exposing sensitive data because of an incorrect setting, overly broad sharing, or human error. A board named “Confidential Project 2027” does not become secret simply because its name sounds very serious.
For its part, the ANSSI 2025 Cyber Threat Landscape notes that cyberespionage attacks target organizations including the defense industrial and technological base, the aerospace sector, critical infrastructure, and digital service providers.
✅ Using American software does not automatically cause a data leak
However, entrusting strategic data to a tool without checking its hosting, legal framework, access controls, and export options means accepting a risk that the company has not properly assessed.
The Cloud Act adds a legal dimension
The French Senate highlights the potential effects of the Cloud Act. This legislation allows US authorities to require a provider subject to US law to disclose data under its control, including when that data is stored in another country.
This does not mean that US authorities can freely browse every project run by European companies. Requests involving businesses remain regulated and appear to be rare. However, for information related to research, industry, defense, or strategic innovation, the existence of this risk should be considered when choosing software.
Six checks before entrusting a project
- identify the country in which the software provider is legally established;
- determine where the data and its backups are stored;
- check the sharing rules and access rights management;
- review encryption, access controls, and technical safeguards;
- ensure that the data can be exported and recovered;
- assess the dependency created by formats and automations.
Digital sovereignty is therefore not simply a matter of replacing a checkbox with a European flag. It combines technical, legal, and operational control over information.
Innovating in Europe with european software
Otilus is an alternative to Trello, Asana, and American project management software. It enables European companies to organize their projects in an environment developed and hosted in France.
This approach is explained on the page dedicated to Otilus and digital sovereignty. Data is hosted by Celeonet on infrastructure operated by an ISO 27001-certified hosting provider, and each organization's information is kept separate.
Otilus combines HTTPS connections, passwords hashed with bcrypt, protected session cookies, access filtering, a firewall, anti-DDoS protection, and daily remote backups retained for a rolling 20-day period. These measures are detailed on the cybersecurity and data protection page.
Security directly supports the platform's project management features:
- organize projects using a Kanban board structured around phases;
- automate recurring processes with scenarios;
- archive projects and their activity history without losing their records.
Protecting projects means protecting innovation
Choosing project management software is no longer a purely functional decision. When a platform contains studies, files, priorities, and decisions, it becomes part of the company's information system and intangible assets.
Developing an innovation in Europe while entrusting its entire organization to foreign infrastructure therefore deserves careful consideration. A European solution cannot guarantee zero risk, but it brings the software provider, hosting, applicable law, and the company's economic interests closer together.
To explore this issue further, read Project Management and Digital Sovereignty and our article about the kill switch and technological dependency.