Isn't the reason that even if it is hosted physically in the EU, if it is an american company the data is still not safe from american spy agencies?