With self-hosting servers can be placed within the EU and data processors, if any, are under better control, making it easier to adhere to GDPR legislation.
General Data Protection Regulation (GDPR) is the EU data protection law. It aims to keep personal data for EU citizens secure and is mandatory for entities (for example businesses and government agencies) or anyone handling data concerning a person such as names and email addresses, but even IP addresses are considered to be personal data to some extent.
| Terms | Description |
|---|---|
| Data controller | Is the company or entity that determines the purposes of any personal data and the means of processing it. They are primarily responsible for ensuring that the data is handled in compliance with GDPR. |
| Data processor | Is the entity that processes personal data on behalf of a data controller. They have less responsibility in regards to GDPR. |
| Data subprocessor | The entities that handle the data for the processors. |
Data transfer restriction
One of the cornerstones of the legislation is the restriction on transferring personal data to countries without adequate data protection laws.
The law itself will not specify which these countries are but it has become very obvious from the penalties that it is data transfers to US that are not considered to be GDPR compliant. Which excludes many excellent and widely used SaaS-services and hosting providers as an option. This even applies to the majority of services from European businesses, as subprocessors are still commonly from US.
By self-hosting, you can ensure that personal data remains within your jurisdiction or in countries with suitable privacy frameworks, reducing the risk of non-compliance with data transfer regulations.
Rule of thumb for European businesses is to keep all personal data within Europe and on services provided by European companies. Most important is to ensure not sending personal data to services such as meta, google and similar. If you serve globally keeping your data on servers outside of EU can be an option, but be mindful of avoiding storing the personal data from European citizens under American jurisdiction.
Hosting location for businesses selling within EU should also be within EU. One of the most popular cloud hosting providers within Europe is Hetzner. Read our guide on how to install our software on a Hetzner server.
GDPR legislation targets services under American jurisdiction but if your company is based in the USA and sells to Europe (which is allowed) one could argue that keeping the customer data in EU would not matter, as the company anyhow is under American jurisdiction.
Self-hosting as the solution
When self-hosting Cradle keeping up and in control with data processors and subprocessors is easy as we keep our dependencies low and no plugins are required to run your site or shop.
- Full control over your data.
- No need to keep up with subprocessor lists
- Enhanced Security
- Transparency and Auditability
- Flexibility and Customization
- Geographical Data Sovereignty