Hacker News new | past | comments | ask | show | jobs | submit login

> From a GDPR perspective it's not even clear if this is even lawful

It is pretty clear it is




No it's not, you can check e.g. the EDPB's recommendation [1] on this. At the very least you'd need to use data mapping and ensure EU citizens data stays within the EU, the author's service advertises "200 edge locations around the world" so I'm skeptical whether data won't leave the EU.

Not many companies care about this and there's little enforcement so far, I think it's fair to think about this though if you're running a privacy-focused web service from Germany.

[1] https://edpb.europa.eu/sites/edpb/files/consultation/edpb_re...


It's pretty clear that using AWS is lawful. What you're questioning is if AWS is being used in a compliant manner, which is an entirely different thing. It is possible to do so, so there's nothing odd with choosing AWS.


Personally I find it odd to choose AWS (and Cloudflare) for running a privacy-focused service out of Germany. But again, that's just my personal opinion, I guess most people here are fine with this setup. And I'm also at least a bit doubtful that a one-person startup can get all compliance aspects of running services in a global AWS and Cloudflare-based setup right, so I'd recommend using infrastructure that by default will be hosted in the EU so you don't have to worry about this.


Edge locations refer to the CDN which his static assets are served from, i.e. HTML, JS, CSS, images.

Not customers data.


Data is passed through -unencrypted- those edge locations though.


What data exactly?

They serve HTML, CSS, JS, and images. The actual data is transmitted using AJAX requests towards an HTTPS API in EU.


Ah, so they're not using CF on those. Got it, that's fine then. It's rare with Cloudflare to see them used purely for static assets.


You don't have to obey the GDPR for users outside the EU, so as long as the central storage is located in the EU (and only replicated across EU countries, which is easily configurable), the author is most likely absolutely fine.

By the edge locations, I'd assume he's serving cached static files, such as his blog or tracking scripts from there using CloudFlare. Assuming CloudFlare is not falsely advertising their GDPR compliance, the author is also fine.


As a EU company you have to obey GDPR for all of your users, regardless whether they're EU citizens or not.


> Ensure EU citizens data stays within the EU

As far as I'm aware, there's no requirement imposed by GDPR requiring that data stay within the EU as long as you have DPA's with Cloudflare, AWS, and any other data processors.

DPAs are very easy to sign with AWS and Cloudflare.

I also don't understand your complaint about "200 edge locations". Are you expecting him not to use a CDN?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: