Excellent points. One other thing I'd like to see is a commitment to notify customers to the extent permitted by any court orders and to fight for additional notification rights (as Twitter has done).

We have set-up our corporate structure so that each cloud location is managed by a local company and therefore subject only to that jurisdiction (our holding company is Swiss and unlike US holding companies it has no concept of extra-territorial jurisdiction, if that were to change, we'd change holding company, it is that simple).

IANAL, but this seems a very significant point. However, I wonder if the US claims jurisdiction on the parent company if there's a US-based subsidiary?