4 ms·

PostHog Cloud EU

22 points by pimterry 4y ago

openplatypus 4y ago
How does this help if you are an US corporation and can be compelled by US surveillance laws?
- speedgoose 4y ago
  Microsoft Azure representatives say every time “data is hosted in Europe this is fine”, while it is obviously not. They get upset and dismissive if you insist. I know some companies fall for these lies, or decide to break the law a little bit because it’s convenient.
  - aliqot 4y ago
    Is there a list of GDPR rulings and precedents that list which companies and consequences have resulted from GDPR?
    - speedgoose 4y ago
      I found this from a quick search: https://www.enforcementtracker.com https://www.enforcementtracker.com
    - mananaysiempre 4y ago
      GDPRHub[1] seems pretty comprehensive. It’s run by the privacy activists from noyb[2], including Schrems of the Schrems decisions fame. [1] https://gdprhub.eu/ https://gdprhub.eu/ [2] https://noyb.eu/ https://noyb.eu/
  - openplatypus 4y ago
    Oh, ok I actually thought they use EU cloud. Instead they are using US cloud with EU servers. We went extra length to make sure we are US cloud free. With few exceptions it wasn't that difficult. https://wideangle.co/blog/saas-business-without-us-cloud https://wideangle.co/blog/saas-business-without-us-cloud
acatton 4y ago
Hosted in Europe, but on AWS which is a US company bound by the patriot act. There are tons of decent european-based cloud providers,… like upcloud, Scaleway, exoscale or OVH to name the ones at the top of my head. I would love to know what motivated this choice outside of "nobody got fired buying IBM/AWS" or résumé-driven development.
- hnbad 4y ago
  Hosted in Europe on AWS which is a US company bound by the patriot act by a US company bound by the patriot act. PostHog seems to be based in NY, US, so the feds wouldn't even have to go through AWS to access the data, they could simply coerce PostHog directly as they can with US hosted data.
  - james_impliu 4y ago
    (Founder) To be blunt, we cannot guarantee not sharing data in the scenario that the US government forces us to transfer data to them from our EU Cloud. We have self hosting for those who want 100% certainty of GDPR compliance, as then we require no access to the instance. The case law[0] as it stands today makes it impossible for US companies to fully comply in practice if providing cloud software like this - in order to comply with a request from a US agency to transfer data out of the EU, a US company would need to breach its obligations under GDPR today (and vice versa). However, recent changes[1] in the US may (or may not) enable legitimate transfers from the EU to US, but a ruling from the European Commission on this isn't expected until 2023. For this reason, we've launched PostHog Cloud EU on AWS in Frankfurt for now (we've had many customers asking for this) as a first step. From here, we can iterate depending on the above or by changing our legal structure if we wind up with a ton of adoption and want to improve this offering. We'll issue a few clarifications to the page and docs to help explain the above properly, as I think we should make the above points more clearly on our website. We didn't expect this to appear on HN front page so fast! [0] https://noyb.eu/en/project/eu-us-transfers https://noyb.eu/en/project/eu-us-transfers [1] https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-eu-law https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-e...
hnbad 4y ago
This feels redundant given that the current interpretation of EU privacy laws is that US companies can not be used under GDPR compliance because the EU-US Privacy Shield agreement has been killed by US courts ruling that federal agencies are allowed to access data stored on overseas servers. This also extends to EU subsidiaries of US companies but it seems that PostHog doesn't even try to make that distinction. If your first thought is that this would render EU companies unable to use common cloud providers like AWS, Google Cloud or Azure, you're not wrong, although most EU companies are likely unaware of this as it's the outcome of a recent court case and not entirely settled. As a EU resident I would advise EU companies to avoid all US service providers and their subsidiaries where possible, regardless of where their servers are located until the US legislature makes explicit guarantees protecting EU servers from being accessed by US law enforcement without going through the apropriate international channels (which would include notifying all affected EU residents of the access). I realize this can't always be avoided but replacing Google Analytics with another US company over GDPR concerns seems a lot of effort for no effect when there are self-hosted and EU-based alternatives available.
dijit 4y ago
> Where are PostHog Cloud EU's servers based? > PostHog Cloud EU is hosted in the AWS eu-central-1 region based in Frankfurt, Germany. So, no real benefit over using AWS? If your argument is that AWS isn't legally bound by the EU, you're mistaken as they're operating in Ireland at the very least.
deleted 4y ago
[deleted]

PostHog Cloud EU

22 points by pimterry 4y ago

openplatypus 4y ago

How does this help if you are an US corporation and can be compelled by US surveillance laws?

speedgoose 4y ago
Microsoft Azure representatives say every time “data is hosted in Europe this is fine”, while it is obviously not. They get upset and dismissive if you insist. I know some companies fall for these lies, or decide to break the law a little bit because it’s convenient.
- aliqot 4y ago
  Is there a list of GDPR rulings and precedents that list which companies and consequences have resulted from GDPR?
  - speedgoose 4y ago
    I found this from a quick search: https://www.enforcementtracker.com https://www.enforcementtracker.com
  - mananaysiempre 4y ago
    GDPRHub[1] seems pretty comprehensive. It’s run by the privacy activists from noyb[2], including Schrems of the Schrems decisions fame. [1] https://gdprhub.eu/ https://gdprhub.eu/ [2] https://noyb.eu/ https://noyb.eu/
- openplatypus 4y ago
  Oh, ok I actually thought they use EU cloud. Instead they are using US cloud with EU servers. We went extra length to make sure we are US cloud free. With few exceptions it wasn't that difficult. https://wideangle.co/blog/saas-business-without-us-cloud https://wideangle.co/blog/saas-business-without-us-cloud

acatton 4y ago

Hosted in Europe, but on AWS which is a US company bound by the patriot act. There are tons of decent european-based cloud providers,… like upcloud, Scaleway, exoscale or OVH to name the ones at the top of my head. I would love to know what motivated this choice outside of "nobody got fired buying IBM/AWS" or résumé-driven development.

hnbad 4y ago
Hosted in Europe on AWS which is a US company bound by the patriot act by a US company bound by the patriot act. PostHog seems to be based in NY, US, so the feds wouldn't even have to go through AWS to access the data, they could simply coerce PostHog directly as they can with US hosted data.
- james_impliu 4y ago
  (Founder) To be blunt, we cannot guarantee not sharing data in the scenario that the US government forces us to transfer data to them from our EU Cloud. We have self hosting for those who want 100% certainty of GDPR compliance, as then we require no access to the instance. The case law[0] as it stands today makes it impossible for US companies to fully comply in practice if providing cloud software like this - in order to comply with a request from a US agency to transfer data out of the EU, a US company would need to breach its obligations under GDPR today (and vice versa). However, recent changes[1] in the US may (or may not) enable legitimate transfers from the EU to US, but a ruling from the European Commission on this isn't expected until 2023. For this reason, we've launched PostHog Cloud EU on AWS in Frankfurt for now (we've had many customers asking for this) as a first step. From here, we can iterate depending on the above or by changing our legal structure if we wind up with a ton of adoption and want to improve this offering. We'll issue a few clarifications to the page and docs to help explain the above properly, as I think we should make the above points more clearly on our website. We didn't expect this to appear on HN front page so fast! [0] https://noyb.eu/en/project/eu-us-transfers https://noyb.eu/en/project/eu-us-transfers [1] https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-eu-law https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-e...

hnbad 4y ago

This feels redundant given that the current interpretation of EU privacy laws is that US companies can not be used under GDPR compliance because the EU-US Privacy Shield agreement has been killed by US courts ruling that federal agencies are allowed to access data stored on overseas servers. This also extends to EU subsidiaries of US companies but it seems that PostHog doesn't even try to make that distinction. If your first thought is that this would render EU companies unable to use common cloud providers like AWS, Google Cloud or Azure, you're not wrong, although most EU companies are likely unaware of this as it's the outcome of a recent court case and not entirely settled. As a EU resident I would advise EU companies to avoid all US service providers and their subsidiaries where possible, regardless of where their servers are located until the US legislature makes explicit guarantees protecting EU servers from being accessed by US law enforcement without going through the apropriate international channels (which would include notifying all affected EU residents of the access). I realize this can't always be avoided but replacing Google Analytics with another US company over GDPR concerns seems a lot of effort for no effect when there are self-hosted and EU-based alternatives available.

dijit 4y ago

> Where are PostHog Cloud EU's servers based? > PostHog Cloud EU is hosted in the AWS eu-central-1 region based in Frankfurt, Germany. So, no real benefit over using AWS? If your argument is that AWS isn't legally bound by the EU, you're mistaken as they're operating in Ireland at the very least.

deleted 4y ago

[deleted]