I wonder if this is compliant with EU laws around data sovereignty and similar?

If that’s the right question? :-) Not my area!