palantir is a US company subject to the cloud act. patient data from 123 hospital trusts is now one mlat request away from us law enforcement regardless of where the servers sit.
I believe no, MLAT scope is not limited to servers/stored owned by the target entity.
If it was, MLAT would be routinely defeated by targets hosting on AWS, for example.