GDPR compliant when hosting applications to European users

[Jonass]

Hi,

I wonder how I can be GDPR compliant when hosting applications to European users using Fly.io.

I have a use case hosting HTTP servers along with storage (database VMs and binary files in volumes). I’m hosting Fly VM’s in European countries.

Questions:

1. Is routing related data encrypted to and from Fly VMs?
2. Is routing related data sent outside Europe?
3. Is Fly volumes encrypted?
4. Is Fly volume data sent outside Europe?
5. Is Fly volume backups encrypted?
6. Is Fly volume backup data sent outside Europe?
7. Is Fly secrets encrypted?
8. Is Fly secrets stored outside of Europe?
9. Do Fly.io have access to the encryption keys to the encrypted data in step 1-8?
10. Can Fly.io ensure I’m the only person who can access Fly volumes?
11. Can Fly.io ensure I’m the only person who can access Fly volume backups?
12. Can Fly.io ensure I’m the only person who can access the Fly VM’s?
13. Does Fly.io have any plans on implementing a Bring Your Own Keys (BYOK) solution for encrypted data?

I know there is a DPA agreement I can sign with Fly.io but it not enough:
GDPR and DPAs - we can help

Related topics:

GDPR and Fly Postgres

I’m starting to look at GDPR requirements for my app. I thought hosting my DB in the EU would be enough to comply but apparently because Fly is a US company this is not enough. I’ve read in the docs that volumes are encrypted by default. Does Fly have access to the encryption keys? Can Fly access the PG data in any way? Are volume backups encrypted? Thanks Fly team. Any information you can provide will help me navigate this massive headache.

EU / US Isolation for GDPR and HIPAA

Hey, We have customers in the EU that require us to only use EU based servers and DBs. It is possible to ensure that only EU based users go through EU based regions. On the flip side. We have been asked about HIPAA and can data only flow through US based regions and DBs. Is it possible to enforce this kind of isolation on Fly?

[pier]

I’m not a lawyer so take this with a grain of salt but AFAIK it really depends on the type of personal data you’re storing.

The GDPR makes a distinction between personal data (email, name, etc) and sensitive data (healthcare data, biometric data, etc).

Unless you’re storing sensitive data you don’t need to worry about having the upmost level of encryption and security throughout your infrastructure. If you’re just storing user emails nobody is going to check whether your storage is encrypted etc.

[Jonass]

Thanks for answearing.

Im not very into this area neither, but have read something about not sending data to USA, if its only healthcare related data or personal data in general im not sure.

And I have read that me owning the encryption keys is crucial.

[pier]

The data transfers between US-EU were forbidden because the US was not considered an adequeate country to safeguard personal data. This changed last year:

On 10 July the European Commission adopted its adequacy decision for the EU-US Data Privacy Framework. On the basis of the adequacy decision, personal data can flow freely from the EU to companies in the United States that participate in the Data Privacy Framework.

EU-US data transfers