Hi Margaret:
We don't have a white paper on the topic at this time. Below is guidance that I received from our legal department at Ariba. Please note that it should not be construed as legal advice. For that, you will want to consult your company's legal counsel for further information on the U.S. Patriot Act.
"Because Ariba, Inc. is a U.S. company, it is subject to U.S. laws and regulations and U.S. law enforcement jurisdiction. Accordingly, no matter where our data centers are located, U.S. law enforcement would have the ability to subpoena records in our possession with good cause and in compliance with applicable law. This is not a unique issue for the U.S. All nations retain the right to enforce their own criminal laws by, among other things, requiring those entities and individuals under their jurisdiction to produce records relevant to a criminal investigation. As compared to other countries, U.S. law enforcement probably has a better track record than most in the appropriate exercise of investigative discretion. Moreover, so long as customers are not using the Ariba application to engage in criminal activities, the possibility that their records may become the subject of a law enforcement subpoena is exceedingly remote."
Debbie Curtis-Magley
Ariba Exchange Community Manager