They can spy on non-us organizations, but they can't demand anything. You're better off having your data stored outside of the us _by a non-us entity_.