[yibg]

But this isn't just cloud infra / platform like AWS etc right, but also various SaaS products. e.g. Office 365, gsuite, github etc. Are there even equivalent (enough) versions of all those that are not only hosted but owned by EU companies?

[rsynnott]

Those are also less _critical_/replaceable, though. Up until recently, most companies didn't use cloud-y office things, they used, typically, Microsoft Office 2xxx (ie the non-cloud version). Microsoft's cloud-y Office solution is only 7 years old; while Google's is older, it wasn't taken particularly seriously for a long time. Many companies (actually I would suspect _most_ companies) _still_ use on-prem Office/Sharepoint Server/Exchange Server setups, and Microsoft still sells this stuff (Office 2024 LTSC is the latest one for enterprise, Office 2024 for consumers).

As for Github, self-hosted or vendor-hosted GitLab would be the obvious solution (self-hosted Github _is_ a thing, but only for large enterprises IIRC); other GitHub-like things are available.

I also suspect that Github in particular, and maybe MS, could, if desired, rework their services such that they didn't actually touch personal data in a form that they could disclose to the US government (which is the core issue here). This could be managed via using a third-party auth service (which typically these sort of services already support for enterprise integrations) and, for the Office-y apps, end-to-end encryption.

Replacing AWS and Azure and friends would in many ways be the big problem, especially if all this were to happen quickly (in practice, there'd almost inevitably be a significant grace period if things broke down). There's a big capacity problem there; all of these sorts of services operate basically at capacity, because economically it makes no sense to do anything else. That said, in the doomsday scenario, Amazon et al would presumably end up selling off a lot of data centres in Europe (restricted to only non-personal-data applications, they'd need fewer).

[yibg]

I agree each thing is not difficult to replace, but replace all SaaS products that are used might be more challenging. Some data out there from a quick google is saying companies use on average 300+ SaaS products. Not all of them are going to be from US companies, but probably a large amount is, so we're looking at probably over a hundred or 2 of products that need to be replaced with local or EU ones across all companies in Europe. That seems like a lot of work and disruption.

[rsynnott]

Oh, yeah, it’d be a complete nightmare for everyone involved. But it’s likely doable; in particular providers would be _strongly_ incentivised to provide compliant solutions (again, many SaaS providers could manage this by avoiding directly touching PII).