In the case of office365, they enforce it via Microsoft. In other cases, the hosting provider. Avoiding US based companies hosting anything at scale is surprisingly difficult.

I have had good expierience with Hetzner (germany-based), but all you get is cloud vps boxes and storage.