The Schrems II judgement might be applicable. I know that in the EU-based company I work for we have strict requirement for all cloud providers to comply with Schrems II, and not send/store any personal data to outside EU.

https://www.gdprsummary.com/schrems-ii/

i was asking specifically about "US based employees should not have access to manage", which isn't necessarily the same thing as "not send/store any personal data outside the EU". You could have data stored inside the EU, but then saying no US-based employees can have access to it seems like another further requirement? Although it may be one under GDPR? But that's what I meant asking for more info about, sorry!