They can spy on non-us organizations, but they can’t demand anything. You’re better off having your data stored outside of the us by a non-us entity.