The Most Honest Thing a Hyperscaler Ever Said

On June 10, 2025, in a French Senate committee room, a lawyer did something the entire cloud industry had spent a decade paying communications departments to avoid. He answered a question directly.

The setting was a Senate inquiry into public procurement, the witness was Anton Carniaux, director of public and legal affairs at Microsoft France, and the question was precise: could he guarantee, under oath, that the data of French citizens held by Microsoft would never be transmitted to US authorities without the agreement of French authorities?

My claim about this moment is the one in the title, and it's meant without irony. This was the most honest thing a hyperscaler has said in public about sovereignty, it told informed observers nothing they didn't know, and it still changed the weather in Brussels, because there's a difference in kind between a fact everyone knows and a fact someone has sworn to.

What was actually said, fairly

Testimony deserves its context, and Carniaux's context matters. He didn't confess to a backdoor. He described a company that contests requests it considers unfounded, that has procedures for pushing back, and, by his account, hadn't seen the feared scenario actually occur with French public-sector data. The admission was narrower and more important than a scandal: when a legally valid US order arrives, Microsoft complies, because it's a US company and that's what the law we examined in an earlier post requires, "regardless of whether" the data sits in Paris or Virginia.

Notice also what he refused to do. He was invited, under oath, to say the comfortable thing, and the comfortable thing was technically available; guarantee-shaped sentences are a legal specialty. He declined. Whatever else you think about Microsoft, that refusal was professional integrity of a kind the sovereignty debate had been starved of, and punishing it would teach every future witness the wrong lesson.

Why it wasn't news, and why it was

Nobody who'd read the CLOUD Act learned anything that afternoon. The statute's reach over US providers' overseas data was its explicit design, litigated publicly since a Microsoft warrant case made it necessary, and every serious procurement lawyer in Europe had written the same memo about it. In that sense, June 10 was a Tuesday.

And yet. For years, the operating currency of cloud sovereignty marketing had been the artful non-answer: data residency brochures, trust-center pages, carefully scoped assurances that evaporate under a precise question. That ecosystem depended on nobody with authority asking the precise question in a forum where vagueness carries penalties. A Senate oath is such a forum. Five words converted an open secret into a citable fact, and citable facts are what procurement rules, court filings, and legislative impact assessments are built from. White papers argue. Testimony gets footnoted.

The asymmetry is worth naming: an admission like this is the cheapest possible evidence precisely because it's against interest. When a vendor says "trust us," it's noise. When a vendor's own counsel says "I cannot guarantee that," it's data.

What it set in motion

Draw the line from that committee room forward and it's unusually straight. The French inquiry fed a hardening consensus that contractual assurances from US providers can't, by themselves, satisfy sovereignty requirements for sensitive workloads; the providers answered with structure instead of prose, most visibly the AWS European Sovereign Cloud that launched the following January with German entities and EU-only operators, an architecture that concedes the testimony's premise. You don't spend billions building a legal moat against a question you consider settled.

Brussels moved too. By June 2026, the Commission had tabled the Cloud and AI Development Act, with a four-level sovereignty framework for public-sector and critical workloads that reads like the Senate hearing translated into regulatory architecture: stop asking vendors for promises, start classifying them by verifiable structure. That proposal gets its own post next; the point here is genealogy. Tier frameworks exist because promises stopped clearing, and promises stopped clearing in no small part on June 10, 2025.

Could one hearing really carry that weight? No, and claiming so would be tidy history. The pressure had been building through Schrems litigation, GAIA-X disappointments, and years of parliamentary questions. But movements need moments the way arguments need citations, and this became the citation. Ask anyone who wrote a sovereignty impact assessment in the following year which quote sits in their first paragraph.

The steelman: honesty shouldn't be a trap

The best argument against making a landmark of this moment: it punishes exactly the behavior we want. Microsoft's counsel told the truth; competitors whose lawyers stayed home kept their comfortable ambiguity, and the market lesson risks being "never testify precisely." There's also a symmetry defense: France has its own intelligence access laws, every state compels its companies somehow, and singling out the US reach while ignoring domestic equivalents is politics wearing a legal costume. Both points have force, and the second one is under-discussed everywhere sovereignty is sold.

But the asymmetry the testimony exposed isn't about which states have surveillance laws; all of them do. It's about dependency: European public institutions run on infrastructure whose operators answer to another jurisdiction's courts, and the reverse is not meaningfully true. Symmetry in law, asymmetry in exposure. And the honesty-trap worry, real as it is, argues for extending oaths to everyone rather than resenting the one who answered under one. The fix for asymmetric candor is more candor, compelled if necessary.

What we take from all this, building a small European cloud company in the shadow of these giants, is modest: design so that the precise question has a boring answer. Whose courts can reach us is a real question with an uncomfortable dimension for everyone, us included; what a customer can do about it, leave, with their workloads and data, on their own schedule, is the part a vendor actually controls, and it's the part we build for. The most honest thing a hyperscaler ever said took five words. What would your vendors say under oath, and have you ever asked the question precisely?

Related: AWS European Sovereign Cloud, Six Months In, the industry's structural answer to that testimony. More about what we're building at light-cloud.com.