It should be “No US company, period” because the Cloud Act empowers the US government to compel, say Amazon Web Services to disclose information they hold on a server hosted in Germany even if this violates EU law.