Huh, news to me. Apparently FISA can apply to data hosted overseas by a US company. FISA orders also come with a gag order so the company cannot say they have received it.

“2018 Clarifying Lawful Overseas Use of Data Act, or CLOUD Act, which requires US companies to share data hosted on their servers, regardless of location, when subpoenaed, and the Foreign Intelligence Surveillance Act (FISA), which allows US intelligence agencies to request user data with little oversight or refusal.”