US-hosted deal rooms and the CLOUD Act.
The leading deal room platforms — Intralinks, Datasite, Merrill DatasiteOne, Firmex — are US entities. Under the Clarifying Lawful Overseas Use of Data Act (CLOUD Act, 2018), US cloud providers must comply with US law enforcement production orders for data stored on their infrastructure, regardless of where the data physically resides. They are not required to notify the data subject.
For EU-to-EU M&A transactions, or any deal involving EU-regulated entities in banking, insurance, or healthcare, this creates a structural sovereignty gap. A bidder's advisors or a regulator gaining access to your board minutes, valuation models, or employee contracts through a US SaaS operator is not a hypothetical scenario. It is a risk that EU M&A advisors are increasingly being asked to address in legal opinions.
EU/DE hosting with no US corporate chain.
Paramant runs on Hetzner DE. The operating company is incorporated in the Netherlands. There is no US entity in the corporate chain that could receive a CLOUD Act order. Documents are encrypted with ML-KEM-768 + AES-256-GCM end-to-end. The relay holds only ciphertext and cannot read the documents it carries. Burn-on-read delivery for the most sensitive exchanges means the relay's copy is wiped after the recipient's first download.
ML-DSA-65 signed receipts confirm delivery for both sides of the transaction. The CLI allows bulk operations when document volumes are high. A pre-signed GDPR DPA is available for teams that need it.
Document delivery for a deal room.
Why EU hosting matters in M&A.
EU GDPR and the proposed EU Data Act require that personal data of EU nationals be processed under EU law. Board minutes from an EU company may contain personal data. Employment contract annexes do by definition. The moment those documents enter a US-hosted system, they are subject to a legal framework that EU data protection authorities consider inadequate for sensitive commercial transactions.
See also: full jurisdiction analysis and Data Processing Agreement.