Jump to content

GDPR & EU Hosting - Third Country IPS Support


Go to solution Solved by Matt,

Recommended Posts

Hi.

What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance.

Thanks.

Link to comment
Share on other sites

4 minutes ago, Como said:

Hi.

What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance.

Thanks.

IPS does not make use of third parties in servicing the account.  Meaning they don't outsource the support of the service.  So it's not going to be IPS hiring Randy's Consulting Company to service you or enable the services they provide.  That is done by IPS employees only.  Now with that said, IPS has employees in both the EU and the US.   

GDPR does not apply to a company that has offices in multiple locations saying that only EU-based staff for that company can provide support.  🙂 

Link to comment
Share on other sites

Hi @Randy Calvert

I am not sure I follow. I refer to data transfer occurring as part of servicing accounts hosted in the EU. It seems that such serving (if any PII information is access/transferred), this would contravene GDPR (re: Schrems II).

I am just trying to clarify the situation.

https://www.njordlaw.com/privacy-shield-scheme-declared-invalid

('Consequences' section, towards the bottom of the page). But maybe I've misunderstood the point, or it is a poor legal opinion.

16 minutes ago, Marc Stridgen said:

Are you referring to who would work on your community here? 

'Here'? Hopefully, my prior comment has clarified what I mean. Thanks.

Edited by Como
Link to comment
Share on other sites

  • Management
43 minutes ago, Como said:

Hi.

What I am trying to clarify is does Invision use an EU service centre for EU hosted communities? Or, does Invision service the EU-hosted communities from abroad (the US, presumably)? My inquiry relates to GDPR compliance.

Thanks.

If you choose our EU option, all of your data is in the AWS Paris region.

It is possible one of our employees outside the EU can access the data if you submit a support ticket or something like that. But then that is no different than if you were traveling outside the EU and logged into your own AdminCP.

Even in that scenario, the data is still housed in the EU. Someone viewing your site from anywhere in the world (that's literally what the Internet is for 😀) has nothing to do with GDPR.

Link to comment
Share on other sites

21 minutes ago, Charles said:

If you choose our EU option, all of your data is in the AWS Paris region.

It is possible one of our employees outside the EU can access the data if you submit a support ticket or something like that. But then that is no different than if you were traveling outside the EU and logged into your own AdminCP.

Even in that scenario, the data is still housed in the EU. Someone viewing your site from anywhere in the world (that's literally what the Internet is for 😀) has nothing to do with GDPR.

Viewing the front end: of course that would be no problem. What I mean is, in the furtherance of servicing the website, data is inevitably transferred. It depends upon what data is being accessed. For example, if there was corruption data or setting with tables in the database which store usernames, email addresses, etc., this might involve the transfer of PII out of the EU to the US. I think the linked article (if I understand it correctly) explains the potential problem.

In any case, reading between the lines, Invision servicing of EU-hosted Communities is performed from the US. Which is all I wished to know.

Thanks.

Link to comment
Share on other sites

  • Management
  • Solution

To be clear, data is not transferred from EU to US servers to troubleshoot issues on your community.

People geographically located in the US may troubleshoot issues via the AdminCP, but we do not move data from EU to US servers to do this.

I can't think of a reason we'd need to transfer PII out of EU and into US servers, even if we need to repair data or tables, etc.

The article is a little confusing when it says: “Support access for persons in a third country to data in data centres in the EU also constitutes a third country transfer.”

I think this means that someone in the US who needs to copy the data to a local data centre to work on it would fall foul of GDPR, but we do not operate like that.

Link to comment
Share on other sites

If for some reason the database or physical drive on your server was not accessible there is a chance the data could be recovered by using a Data Recovery service ( a clean room ) -  if you couldn't find one in the EU that could recover the data in a timly manner the lesser evil might need to send the drive to the US. Where they likely have the same ISO certifications and chain of custody requirements, to be compliant. If I remember GDPR also requires availability too so there is that. 

Link to comment
Share on other sites

12 minutes ago, Ocean West said:

If for some reason the database or physical drive on your server was not accessible there is a chance the data could be recovered by using a Data Recovery service ( a clean room )

That would be true if IPS was using a physical drives and servers, etc.  IPS uses clustered services and does not rely on a single database, etc.  There are multiple read/write clusters that exist.  Also in the event of a disaster, there are multiple types of backups of the data (ones designed to be retrieved quickly, and others that are designed for "OMG THE WORLD IS ENDING" scenarios).

There's not much of a chance of needing to resort to a data recovery service.  🙂 

Edited by Randy Calvert
Link to comment
Share on other sites

1 hour ago, Charles said:

US or EU either way we're not randomly downloading your data to our laptops and wandering around 😀

Anything we do need to do stays inside AWS systems.

Hmm. That's not the point. No one - and certainly not me - was implying that you are or would 'randomly download data to your laptops'. It is to do with data being 'stored' in the US. The mere act of accessing data will create copies locally. This creates issues with regard to the GDPR because the European Court of Justice has declared that there are inadequate safeguards in the US relating governmental agencies accessing personal data.

I am not suggesting that there is an imminent legal threat against anyone using IPS Cloud services in the US, let alone the EU. But the problems raised by Schrems II are unresolved. And when I read the article I linked earlier, it suggested that having service centres outside of the EU accessing data hosted in the EU could be problematic.

I am just trying to better understand the lay of the land, that's all.

Link to comment
Share on other sites

6 minutes ago, Como said:

The mere act of accessing data will create copies locally.

How so?  Anything that would display PII via the UI is marked as no-cache/no-store.  So the local browser and/or the CDN would not cache it.  (It would not make sense to cache pages anyway.)

In fact if you are logged in even as a user, the base pages themselves are not cached.  Me as a regular user:

Could contain: Page, Text, File, Webpage

And separately from the ACP of one of my own IPB instances:

Could contain: Page, Text, File, Webpage

So anything you happen to be browsing that would contain PII would be cached in the browser.  You would have to make an intentional decision to take data with you such as downloading logs or exporting the database, etc.  

Edited by Randy Calvert
Link to comment
Share on other sites

5 minutes ago, Randy Calvert said:

How so?  Anything that would display PII via the UI is marked as no-cache/no-store.  So the local browser and/or the CDN would not cache it.  (It would not make sense to cache pages anyway.)

You don't "accidentally" download a copy of the database, etc.  You would have to intentionally take that data with you.  

I am not database administrator or developer. So, if you tell me there is no situation where IPS service centre personal will need to access the database of a Community hosted in the EU (or no copy of data access/viewed is stored/copied locally), I will take that at face value. As I have written several times already, I am asking the question because of the article I read and linked in my opening post.

Link to comment
Share on other sites

They use the same methods you do for accessing the data.  So in reality, you can check it for yourself.  As you're accessing the ACP, or viewing PII, you can check the browser cache for that PII data.  In looking through my own, I only see non-PII data (images, stylesheets, etc).  

I also see MY own session cookies in my local browser cache, but that is my own data...  not anything that would relate to any other user's session data, etc.  

Link to comment
Share on other sites

That would absolutely be a concern!  Anytime you engage a third party, you should evaluate what data is required to share, where they'll handle that data, and ensure they have the appropriate controls to safeguard the it.  

As it stands today, the only way a web hook would be leveraged is if the owner made a conscience decision to share/send that data.  It is not done out of the box by IPS, so it would not be in scope typically when making a decision if using the cloud hosted solution complies with EU GDPR requirements.  

Link to comment
Share on other sites

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...