I've thought about this a lot, especially when picking up 3rd party services for my EU-based SaaS [1].

Ultimately I chose (then) Safe Harbor compliant US services, not out of convenience, but because most of them exhibited better security practices (e.g. 2FA) or deliverability (e.g. Mandrill) compared to their European counterparts.

I'm concerned about 2 things mainly:

- being forced to rely on less advanced 3rd parties, potentially less secure, which would not be a win for my users

- later down the road, seeing a backfire from the US telling that I cannot store US customers data in the EU

I have started a discussion over here [2].

[1] https://www.wisecashhq.com [2] http://discuss.bootstrapped.fm/t/concrete-ramifications-of-s...