###### Abstract  
A popular bumper sticker states: \"There is no cloud. It's just someone else's computer.\" Despite the loss of control that comes with its use, critical records are increasingly being entrusted to the cloud, generating ever-growing concern about the privacy and security of those records. Ultimately, privacy and security constitute an attempt to balance competing needs: privacy balances the need to use information against the need to protect personal data, while security balances the need to provide access to records against the need to stop unauthorized access. The importance of these issues has led to a multitude of legal and regulatory efforts to find a balance and, ultimately, to ensure trust in both digital records and their storage in the cloud. Adding a particular challenge is the fact that distinct jurisdictions approach privacy differently and an in-depth understanding of what a jurisdiction's laws may be, or even under what jurisdiction particular data might be, requires a Herculean effort. And yet, in order to protect privacy and enhance security, this effort is required. This article examines two legal tools for ensuring the privacy and security of records in the cloud, data protection laws, and data localization laws, through the framework of \"trust\" as understood in archival science. This framework of trust provides new directions for algorithmic research, identifying those areas of digital record creation and preservation most in need of novel solutions. archival science; cloud services; trustworthy records; reliability; authenticity; accuracy; privacy; data protection; data localization +
Footnote †: journal:  
* [FOOTNOknow what we want to access and retrieve--essentially the same things we put in--but often we do not know what technology is used by the CSPs to manage, store, or process our information\" [2]. This lack of scrutiny of the trustworthiness of cloud services is deeply troubling; in 2016 alone, data breaches and hacks affected banks [3], the U.S. National Security Administration [4], and even, allegedly, the U.S. election [5]. As [PERSON] and [PERSON] state, \"[e]ven as we have ever greater access to untold stores of information, our right to know comes at a rising cost to our privacy and anonymity, due to a complex web of data collection and surveillance, benign and not. These stores of information, furthermore, are accumulated and extracted from sources we often cannot know or evaluate\" [6]. Even in the absence of malice, cloud-based recordkeeping poses a number of unanswered questions. The challenges identified by [PERSON] and [PERSON] [7]--including managing trans-jurisdictional data flows, attributing liability for and resolving data breaches, and establishing the chain of custody when a cloud service provider goes dark--remain unresolved. Given the potential risks, why individuals and organizations continue to store records in cloud environments? Is it because of a \"blind trust\" that the commercial providers will do right by us [7]? Is it hope that they will do so? Or is it a sense of desperation leading us to cross the metaphorical Mediterranean on a dinghy not because of trust in cloud providers but because of a perception that there is no better option in the face of an Internet-driven world? There is, of course, constant technological innovation that tries hard to keep pace with both malicious and innocent challenges and ensure the trustworthiness of records in the cloud. What we know is that technical approaches alone cannot address them and solve the problems that arise from them; there is no technical solution to determined human misfeasance. Instead, technological tools must be supported by legal, social, and business structures that set the bar for minimum expectations for CSPs, ensuring that cloud recordkeeping will not endanger the preservation of our recorded memory and the continual functioning of society.