This doesn't seem right. The location of processing is irrelevant. As long as the servers are owned by a US based company, they can theoretically be forced to spy on the users without being able to disclose that they are. Isn't that the main argument?