In reality it depends on at least two things:

1. Is their team capable of securing their environment and releasing code that isn't vulnerable to data theft attacks?

2. Do they also store all their customers' information in Germany or is it on some US-based servers?

6wunderkinder seems to use Amazon AWS:

http://aws.amazon.com/solutions/case-studies/6wunderkinder/

Interesting. Amazon AWS in Europe is hosted all over Europe, e. g. Ireland etc. They should comply to EU privacy laws, but not necessarily to Germany's privacy laws. Difficult.

Also, US companies have to comply with the patriot act even for data centers outside of the US.

EC2 in Europe is hosted in Ireland only.

Like any other company operating in Europe, they're subject to punishment if they're violating EU privacy regulations. That US law obliges them to do so is no defence.

Sure, they are between a rock and a hard place in that respect. But that doesn't help you if you want to push your data somewhere out of access from the US. The company in question has to comply to the requests just as they do in the US, fine or not.

Well it's very hard to make it physically impossible for the US to access your data. The most practical thing you can do is store your data somewhere with a solid, well enforced legal system where it would be illegal for anyone to transport it to the US, or for the US to access it.

I mean, it's just as illegal for the US to access private data in Europe if the server it's on is owned by a US company or a European one. So it's not like AWS is especially vulnerable.

> Amazon AWS in Europe is hosted all over Europe, e. g. Ireland etc

No, AWS is only in Ireland. Except for Cloudfront which is in most countries but that isn't really relevant considering the data stored there.

> Things

Cultured Code are in Stuttgart

Cool, I didn't know that