One detail you might have overlooked: even if you're an American company - if you offer your services in Europe (through the web or otherwise), you're subject to European laws and regulations, including the GDPR.