Where should you host your business software: AWS in the UAE or in Europe?

This guide is not legal advice. It summarises public texts and information available in October 2026: have your situation checked by your legal adviser.

The hosting question often comes late in a project. Yet it mixes three separate issues: where the data is stored, which law the provider is subject to, and how you will be able to leave one day. Here is C-Esium’s position first, then the facts that help you decide.

Where is the software C-Esium delivers hosted?

By default, the hosting account is opened and paid for by C-Esium, then re-invoiced to the client; it can be opened in or transferred to your name at any time, on request.

Whatever the host, the software remains yours. The client owns its software: C-Esium assigns to it by contract all rights to the project code — including the building blocks we reuse from one project to the next — together with the database and the documentation. The code is placed in a Git repository (GitHub or GitLab) in the client’s name, at the latest on delivery. It uses standard, widely used web technologies — TypeScript, React, Node.js, PostgreSQL: any web developer can take over the code.

Which AWS Region is in the UAE?

AWS documentation lists two Middle East Regions, and only one of them is in the UAE (AWS Regions, accessed 6 October 2026). Here they are, with the European Regions available on request:

According to the same page, a Region introduced after 20 March 2019 must be enabled before it can be used. So a “Middle East” Region is not always in the UAE, and a “European” Region is not always in the European Union: London and Zurich are not. If in-country storage is a requirement, have the exact Region written into the contract, with C-Esium as with any provider.

What does the US CLOUD Act change?

The CLOUD Act, passed in March 2018, provides that a provider of electronic communication or remote computing services must preserve or disclose data in its possession, custody or control, “regardless of whether such communication, record, or other information is located within or outside of the United States” (18 U.S.C. § 2713, accessed 5 October 2026).

In a white paper of April 2019, the US Department of Justice explains (DOJ, published on its CLOUD Act Resources page, both accessed 5 October 2026):

• that the rule applies to providers “subject to U.S. jurisdiction” and requires a valid legal order, such as a warrant;
• that the law did not extend US jurisdiction: for a foreign company, everything depends on its links with the United States;
• that indiscriminate or bulk collection is not permitted.

AWS says it will challenge requests that conflict with the law, are overbroad or otherwise inappropriate. It also states that there have been no data requests that resulted in disclosure of enterprise or government content stored outside the United States to the US government since it started reporting this statistic, in 2020 (AWS, accessed 6 October 2026).

In practice, a Region of a US provider, in the UAE or in Europe, settles where the data is stored, not the law the provider is subject to. It is a risk to weigh against the sensitivity of your data and your customers’ requirements, neither to dramatise nor to ignore.

And for health data?

Health data is subject to specific rules, which depend on your activity and on where you operate. At C-Esium, the hosting arrangement for health data is defined at scoping, in line with the applicable health-data rules. By default, AI assistants connected to the software only access data that is not health data.

One question is worth asking any host, health data or not: which foreign laws could require it, or one of its subcontractors, to give access to your data? Have the answer written into the contract.

How do you choose your hosting?

Six criteria, in this order:

1. How sensitive the data is: health, trade secrets, demanding customers. The more sensitive it is, the more the law the provider is subject to matters.
2. Your obligations: the law, but also your contracts, when a customer imposes a location or a type of host. Check with your legal adviser which rules apply to you.
3. The total cost: hosting is a recurring cost, separate from the build. Compare it over several years.
4. Reversibility: ask which host-specific services the software uses. The more there are, the more work a move requires. The code itself relies on standard technologies.
5. Backups: tested regularly, and stored in a place that meets the same location requirements as the data.
6. The contract: the name of the host, the country, the Region and the subcontractors that receive data, in black and white.

When the default choice is not the right one

• You handle health data: the hosting arrangement is defined at scoping, in line with the applicable health-data rules.
• Your group, your customers or your management require Europe: a European Region is possible on request.
• The CLOUD Act risk is unacceptable for your data: say so on the first call, so that the hosting question is settled before the quote.
• Your IT policy already imposes a host: tell us on the first call, for the same reason.

For maintenance and backups after delivery, read custom software maintenance. For AI and data, see the 12 questions a board should ask and the custom internal software offer.

Sources

• AWS, “AWS Regions”, accessed 6 October 2026.
• 18 U.S.C. § 2713, Legal Information Institute (Cornell Law School), accessed 5 October 2026.
• US Department of Justice, CLOUD Act white paper (April 2019) and CLOUD Act Resources, accessed 5 October 2026.
• AWS, “CLOUD Act”, accessed 6 October 2026.