Safe Cloud Storage Act

Cloud vendors face rules and protections

This bill would set up an approved vendor program for cloud companies that store child‑exploitation evidence for law enforcement. Vendors would have to tell the Justice Department within 30 days after a qualifying contract, and report major breaches, payment failures, or improper terminations within 30 days. Stored images would stay in the United States unless the agency expressly agrees to a foreign transfer for an investigation. Vendors would need to follow current NIST cybersecurity standards, use end‑to‑end encryption, limit and track employee access, and complete an independent audit each year and fix problems. Evidence would be kept under FBI CJIS or other applicable rules, or at least through the statute of limitations or the sentence (including post‑conviction review), and vendors would preserve integrity until lawful transfer. Compliant vendors would get limited legal protection, but not for intentional wrongdoing, reckless acts, or actions outside the contract.