Como Posted March 22, 2023 Posted March 22, 2023 Hi, Does IPS use 'limited cloud' EU-based service centre for EU hosted communities? Or does IPS use an outside support centre to access the EU-based hosting? Thanks.
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 If you choose the EU as your hosting location, the service is deployed within the AWS data centers. IPS does not own/operate their own physical data centers. Instead they leverage existing public cloud offerings from Amazon within the appropriate region selected (US or EU).
Como Posted March 23, 2023 Author Posted March 23, 2023 Hi. What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance. Thanks.
Marc Posted March 23, 2023 Posted March 23, 2023 Are you referring to who would work on your community here?
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 4 minutes ago, Como said: Hi. What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance. Thanks. IPS does not make use of third parties in servicing the account. Meaning they don't outsource the support of the service. So it's not going to be IPS hiring Randy's Consulting Company to service you or enable the services they provide. That is done by IPS employees only. Now with that said, IPS has employees in both the EU and the US. GDPR does not apply to a company that has offices in multiple locations saying that only EU-based staff for that company can provide support. 🙂
Como Posted March 23, 2023 Author Posted March 23, 2023 (edited) Hi @Randy Calvert I am not sure I follow. I refer to data transfer occurring as part of servicing accounts hosted in the EU. It seems that such serving (if any PII information is access/transferred), this would contravene GDPR (re: Schrems II). I am just trying to clarify the situation. https://www.njordlaw.com/privacy-shield-scheme-declared-invalid ('Consequences' section, towards the bottom of the page). But maybe I've misunderstood the point, or it is a poor legal opinion. 16 minutes ago, Marc Stridgen said: Are you referring to who would work on your community here? 'Here'? Hopefully, my prior comment has clarified what I mean. Thanks. Edited March 23, 2023 by Como
Marc Posted March 23, 2023 Posted March 23, 2023 I have tagged someone to give a better answer than I would be able to provide you with here. Please bear with us
Management Charles Posted March 23, 2023 Management Posted March 23, 2023 43 minutes ago, Como said: Hi. What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance. Thanks. If you choose our EU option, all of your data is in the AWS Paris region. It is possible one of our employees outside the EU can access the data if you submit a support ticket or something like that. But then that is no different than if you were traveling outside the EU and logged into your own AdminCP. Even in that scenario, the data is still housed in the EU. Someone viewing your site from anywhere in the world (that's literally what the Internet is for 😀) has nothing to do with GDPR. Matt and G17 Media 2
Como Posted March 23, 2023 Author Posted March 23, 2023 21 minutes ago, Charles said: If you choose our EU option, all of your data is in the AWS Paris region. It is possible one of our employees outside the EU can access the data if you submit a support ticket or something like that. But then that is no different than if you were traveling outside the EU and logged into your own AdminCP. Even in that scenario, the data is still housed in the EU. Someone viewing your site from anywhere in the world (that's literally what the Internet is for 😀) has nothing to do with GDPR. Viewing the front end: of course that would be no problem. What I mean is, in the furtherance of servicing the website, data is inevitably transferred. It depends upon what data is being accessed. For example, if there was corruption data or setting with tables in the database which store usernames, email addresses, etc., this might involve the transfer of PII out of the EU to the US. I think the linked article (if I understand it correctly) explains the potential problem. In any case, reading between the lines, Invision servicing of EU-hosted Communities is performed from the US. Which is all I wished to know. Thanks.
Management Solution Matt Posted March 23, 2023 Management Solution Posted March 23, 2023 To be clear, data is not transferred from EU to US servers to troubleshoot issues on your community. People geographically located in the US may troubleshoot issues via the AdminCP, but we do not move data from EU to US servers to do this. I can't think of a reason we'd need to transfer PII out of EU and into US servers, even if we need to repair data or tables, etc. The article is a little confusing when it says: “Support access for persons in a third country to data in data centres in the EU also constitutes a third country transfer.” I think this means that someone in the US who needs to copy the data to a local data centre to work on it would fall foul of GDPR, but we do not operate like that. Como, G17 Media and Randy Calvert 2 1
Como Posted March 23, 2023 Author Posted March 23, 2023 Thank you for the explanation, Matt. Good to hear. Matt 1
Management Charles Posted March 23, 2023 Management Posted March 23, 2023 US or EU either way we're not randomly downloading your data to our laptops and wandering around 😀 Anything we do need to do stays inside AWS systems. Jim M, Matt and G17 Media 1 2
Ocean West Posted March 23, 2023 Posted March 23, 2023 If for some reason the database or physical drive on your server was not accessible there is a chance the data could be recovered by using a Data Recovery service ( a clean room ) - if you couldn't find one in the EU that could recover the data in a timly manner the lesser evil might need to send the drive to the US. Where they likely have the same ISO certifications and chain of custody requirements, to be compliant. If I remember GDPR also requires availability too so there is that.
Stuart Silvester Posted March 23, 2023 Posted March 23, 2023 I can assure you that we do not have physical drives or servers. Ocean West 1
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 (edited) 12 minutes ago, Ocean West said: If for some reason the database or physical drive on your server was not accessible there is a chance the data could be recovered by using a Data Recovery service ( a clean room ) That would be true if IPS was using a physical drives and servers, etc. IPS uses clustered services and does not rely on a single database, etc. There are multiple read/write clusters that exist. Also in the event of a disaster, there are multiple types of backups of the data (ones designed to be retrieved quickly, and others that are designed for "OMG THE WORLD IS ENDING" scenarios). There's not much of a chance of needing to resort to a data recovery service. 🙂 Edited March 23, 2023 by Randy Calvert Ocean West 1
Como Posted March 23, 2023 Author Posted March 23, 2023 1 hour ago, Charles said: US or EU either way we're not randomly downloading your data to our laptops and wandering around 😀 Anything we do need to do stays inside AWS systems. Hmm. That's not the point. No one - and certainly not me - was implying that you are or would 'randomly download data to your laptops'. It is to do with data being 'stored' in the US. The mere act of accessing data will create copies locally. This creates issues with regard to the GDPR because the European Court of Justice has declared that there are inadequate safeguards in the US relating governmental agencies accessing personal data. I am not suggesting that there is an imminent legal threat against anyone using IPS Cloud services in the US, let alone the EU. But the problems raised by Schrems II are unresolved. And when I read the article I linked earlier, it suggested that having service centres outside of the EU accessing data hosted in the EU could be problematic. I am just trying to better understand the lay of the land, that's all.
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 (edited) 6 minutes ago, Como said: The mere act of accessing data will create copies locally. How so? Anything that would display PII via the UI is marked as no-cache/no-store. So the local browser and/or the CDN would not cache it. (It would not make sense to cache pages anyway.) In fact if you are logged in even as a user, the base pages themselves are not cached. Me as a regular user: And separately from the ACP of one of my own IPB instances: So anything you happen to be browsing that would contain PII would be cached in the browser. You would have to make an intentional decision to take data with you such as downloading logs or exporting the database, etc. Edited March 23, 2023 by Randy Calvert G17 Media and Como 1 1
Ocean West Posted March 23, 2023 Posted March 23, 2023 for this very reason there is a whole industry of species known as Attornys, Lawyers, Barristers, and tangentially General Liability Insurance companies.
Como Posted March 23, 2023 Author Posted March 23, 2023 5 minutes ago, Randy Calvert said: How so? Anything that would display PII via the UI is marked as no-cache/no-store. So the local browser and/or the CDN would not cache it. (It would not make sense to cache pages anyway.) You don't "accidentally" download a copy of the database, etc. You would have to intentionally take that data with you. I am not database administrator or developer. So, if you tell me there is no situation where IPS service centre personal will need to access the database of a Community hosted in the EU (or no copy of data access/viewed is stored/copied locally), I will take that at face value. As I have written several times already, I am asking the question because of the article I read and linked in my opening post.
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 They use the same methods you do for accessing the data. So in reality, you can check it for yourself. As you're accessing the ACP, or viewing PII, you can check the browser cache for that PII data. In looking through my own, I only see non-PII data (images, stylesheets, etc). I also see MY own session cookies in my local browser cache, but that is my own data... not anything that would relate to any other user's session data, etc. Como 1
Ocean West Posted March 23, 2023 Posted March 23, 2023 (edited) I'd be more concerned about sending webhooks to a US-based company there is a lot of PII in there including all profile info if they provided such as email, gender, birthday, full name, and all profile fields even if we disallow showing them publicly their profile. Edited March 23, 2023 by Ocean West G17 Media and Como 1 1
Randy Calvert Posted March 23, 2023 Posted March 23, 2023 That would absolutely be a concern! Anytime you engage a third party, you should evaluate what data is required to share, where they'll handle that data, and ensure they have the appropriate controls to safeguard the it. As it stands today, the only way a web hook would be leveraged is if the owner made a conscience decision to share/send that data. It is not done out of the box by IPS, so it would not be in scope typically when making a decision if using the cloud hosted solution complies with EU GDPR requirements. Como 1
Recommended Posts