5/9/14 Eyes and your cloud privacy: the real world map of surveillance (2026)

What are the 5/9/14 Eyes and why do they matter for cloud storage?

The 5/9/14 Eyes are tiered intelligence-sharing alliances. They set which governments can legally demand your cloud data. The 5 Eyes (US, UK, Canada, Australia, New Zealand) share raw signals. The 9 Eyes add France, Denmark, Netherlands, Norway. The 14 Eyes add Germany, Belgium, Italy, Spain, Sweden. In 2026, only 3 of 12 mapped cloud providers sit outside all 14 Eyes, in Switzerland: Proton Drive, Tresorit, pCloud.

The essentials

The signal intelligence (SIGINT) 5 Eyes, 9 Eyes and 14 Eyes alliances are neither a conspiracy myth nor a state secret. Major leaks document them (Snowden 2013, Vault 7 in 2017), and several signatory governments confirm them in official statements. In 2026, their impact on cloud privacy stays large. Not because they enable direct mass surveillance, but because they set which state can legally compel a cloud provider to deliver encrypted data.

So the question for a cloud privacy user is not "do these alliances exist?" (yes). Nor is it "could I be personally spied on?" (statistically no, if you're not a specific target). It is: "if my provider receives a legal request tomorrow, which law applies, and how many states can access it through intelligence sharing?" This is the logic we unfold here, jurisdiction by jurisdiction.

We mapped 12 cloud privacy providers in May 2026. 9 are hosted or registered in 14 Eyes or allied countries. Only 3 - Proton Drive, Tresorit and pCloud (Switzerland) - get real jurisdictional protection outside 14 Eyes. Add to that a few niches: 1984 Hosting (Iceland), Njalla (Nevis), Internxt (Spain, 14 Eyes but decentralized infrastructure).

Where do the 5/9/14 Eyes alliances come from?

The 5 Eyes (FVEY) core dates back to the 1946 UKUSA agreement. The United States and the United Kingdom signed it at the end of WWII, to keep sharing intercepted intelligence against the USSR. Canada joined in 1948, Australia and New Zealand in 1956. These five countries share raw intelligence: phone interceptions, satellite data, direct access to telecom infrastructures.

The 9 Eyes and 14 Eyes extensions (sometimes called SIGINT Seniors Europe) are less privileged outer circles. Members receive filtered and summarized intelligence, but they take an active part in collection. The Snowden documents, published by The Guardian and Der Spiegel in 2013-2014, made the boundaries clear:

• 5 Eyes (FVEY): United States, United Kingdom, Canada, Australia, New Zealand
• 9 Eyes: 5 Eyes + Denmark, France, Netherlands, Norway
• 14 Eyes: 9 Eyes + Germany, Belgium, Italy, Spain, Sweden

Beyond the 14 Eyes, there are linked "Tier B" circles: Japan, South Korea, Singapore, Israel. They share now and then, without belonging to the formal alliance.

What these alliances technically do

Three operational mechanisms:

1. Database sharing: XKeyscore and similar, where each member feeds and queries.
2. Bypassing domestic limits: if the NSA cannot legally spy on a US citizen, British GCHQ can do it and pass the data on. The ACLU has documented and challenged this practice.
3. Mutual requests on cloud providers: a British warrant against a US cloud goes through a fast channel (reinforced MLAT).

For your cloud privacy, mechanism 3 is the key point. If Microsoft, Google or Apple receives a request from a 5 Eyes member, cooperation is almost automatic. If the request comes from a 9 or 14 Eyes member, delay and friction rise, but the outcome stays likely.

How does the CLOUD Act interact with 5/9/14 Eyes alliances in 2026?

Beyond intelligence alliances, three recent legal texts structure cloud access:

CLOUD Act (United States, 2018)

The Clarifying Lawful Overseas Use of Data Act lets US authorities require American companies (or those with a significant US entity) to provide data wherever it is stored worldwide. This covers Microsoft, Google, AWS, Cloudflare and Apple. A US federal warrant forces the parent company to deliver European customer data. The CJEU struck down Privacy Shield in July 2020 (Schrems II ruling), exactly because this CLOUD Act makes GDPR and US-based hosting clash.

The result in 2026: using Microsoft 365, Google Workspace or iCloud for sensitive data breaks your European privacy expectation in practice, whatever the physical datacenter location.

EU Data Act + DSA (European Union, 2023-2024)

The EU Data Act (in force 2024) requires cloud providers based outside the EU to name a European legal representative and to cooperate with national authorities. Together with the Digital Services Act (DSA, 2022) and Digital Markets Act (DMA), it creates a localization duty for "sensitive data". But it does not block the CLOUD Act on US actors.

The result: a cloud actor can be ordered at the same time by the US CLOUD Act and the EU Data Act, with no way to reconcile the two. This is exactly the grey zone in which Microsoft, Google and AWS have worked since 2024.

Swiss Intelligence Act (LRens, 2017, revised 2024)

The LRens lets the Federal Intelligence Service (SRC) request data access, but under three conditions that all apply at once: prior approval by a federal administrative tribunal, proven national interest, and documented proportionality. In 2024, the SRC's public report lists 172 formal requests, of which 43 were partially satisfied. There is no extraterritorial duty.

This gap is large: a factor of 30 to 50 between US and Swiss cooperation on request volumes. It explains why Proton and Tresorit have spoken so much about their Swiss jurisdiction since 2018.

The 2026 world map: where can your cloud really be?

This table looks only at the law that applies to storage. The law that applies to the owning legal entity of the provider matters just as much. Proton is Swiss (✅). Tresorit is Swiss but was bought in 2021 by Swiss Post (✅, neutral state, outside 14 Eyes). pCloud is Swiss (✅). MEGA is based in New Zealand (❌, 5 Eyes). Internxt is Spanish (14 Eyes, but its decentralized infrastructure makes legal enforcement harder).

Common myths to discard

Myth 1: "If I'm honest, I have nothing to hide"

This is a false argument that mixes up privacy with illegality. Your talks with your doctor, lawyer or tax advisor are legal. But if a third party sees them (employer, ex, insurer, foreign state actor), it can harm you in real ways. Privacy is not criminal secrecy. It is control over who gets to share your data.

Myth 2: "Germany is safe because GDPR"

Germany is a 14 Eyes member. The BND-Gesetz, revised in 2021, lets the German agency intercept traffic passing through Frankfurt and Berlin datacenters with no individual warrant. GDPR protects your data against abusive commercial use, not against intelligence access. That is a key difference.

Myth 3: "With a VPN, I'm untraceable"

A VPN hides your IP from the site you visit. But your cloud provider still sees your uploads, their volume and their timing. If the cloud is not zero-knowledge (see E2E vs zero-knowledge cloud storage), it also sees the content. VPN + non-zero-knowledge cloud = problem moved, not solved.

Myth 4: "Iceland is necessarily safe because IMMI"

IMMI is a forward-looking legal framework. But Iceland is a NATO member and cooperates informally with 5 Eyes through that channel. For journalist or whistleblower use, Iceland is still better than Sweden or France. Yet it ranks below Switzerland on how well its institutions are kept apart.

2026 practical strategy: jurisdiction × threat matching

Jurisdiction choice depends on your threat model:

• Competitive/commercial threat (basic industrial espionage): Germany, France or Netherlands are enough. Their legal framework makes unauthorized access harder.
• Foreign state surveillance threat (US citizen who fears the NSA, French citizen who fears the DGSE): Switzerland is a must, Iceland is acceptable.
• Domestic state surveillance threat (activist, journalist or whistleblower facing their own state): Switzerland + zero-knowledge service + native clients + Tor access.
• Post-quantum threat (long-term, encryption that may be broken tomorrow): pick a provider that uses hybrid PQC (Proton Mail has done so since 2024 with Kyber-768 + X25519). Jurisdiction matters less here, and the cryptographic model matters more.

The Priviy methodology applies this matching to each provider we test. We score jurisdiction, cryptographic model, independent audit and operational resilience on their own. No provider maxes out all 4 dimensions, so you must prioritize based on your threat.

Our 2026 verdict

For the majority of cloud privacy users in 2026, the winning combination is:

• Swiss provider (Proton Drive by default, pCloud Crypto if you want lifetime)
• Zero-knowledge client encryption verified by independent audit
• Native desktop/mobile client rather than web app
• Paper recovery key stored offline

For high-risk profiles, add:

• Access via Tor or multi-hop VPN
• Strict separation between public identity and protected identity
• Redundant backups across two different non-14-Eyes jurisdictions

The real value of understanding 5/9/14 Eyes alliances is not getting paranoid. It is knowing how to read a provider's marketing. When pCloud writes "swiss-based servers", that is a jurisdictional claim you can check. When Dropbox writes "your data is secure", that is a contract promise with no jurisdictional backing. This difference is exactly what sets reliable cloud privacy apart from marketing cloud privacy.

For quick definitions of the key terms used in this article - jurisdiction, CLOUD Act, GDPR, Five Eyes, Swiss LPD, data residency - see our encrypted cloud and privacy glossary.

Read next

• Best encrypted cloud storage services 2026 - full ranking of Swiss and non-14-Eyes providers - which providers score best on jurisdiction + zero-knowledge combined
• E2E vs zero-knowledge cloud storage - the cryptographic counterpart of this article
• Encrypted cloud comparison quiz - find your ideal provider in 60 seconds - jurisdiction, zero-knowledge, budget: 5 questions, 1 personalised recommendation
• pCloud review 2026 - Swiss provider, 8-month lifetime + Crypto test
• Priviy methodology - how we score jurisdiction × crypto × audit
• Priviy Wikidata Q140050544
• Academic reference: EFF Surveillance Self-Defense (https://ssd.eff.org/)
• Primary sources: The Guardian Snowden archives 2013-2014; Swiss SRC report 2024; CJEU Schrems II ruling (C-311/18)

Article published June 4, 2026. Methodology: review of primary legal texts (declassified 1946 UKUSA, 2018 CLOUD Act, 2024 EU Data Act, 2017 Swiss LRens), cross-referenced with 2023-2024 transparency reports from Proton, Tresorit, pCloud, MEGA, Mailfence; SIGINT status verification via archived Snowden documents (The Guardian, Der Spiegel). No claim of own classified sources. Logs and notes archived internally.

Related guides

To dig deeper, see whether iCloud is secure, whether OneDrive is secure and what data sovereignty means.