Hacker News new | ask | show | jobs
by JackWritesCode 1616 days ago
Your website visitors Personal Data is processed on US-controlled cloud providers. I've provided evidence that folks reading this need to be careful when choosing analytics software, and I'll leave it at that. I hope to see Plausible move to an EU Isolation approach which doesn't involve US cloud providers.
1 comments
skilled 1615 days ago
You have not provided a single ounce of technical proof that Plausible processes their customer data in the US. Furthermore, you have somehow managed to overlook the fact that Plausible does Cookieless tracking without actually tracking any "Personal Data" signals.

I wonder what Paul thinks of your attempts to fear monger people into thinking your crappy product is superior to an open-source alternative.

But hey man, good luck with Fathom. It will be a great success.

link
toong 1610 days ago
I have no skin in this game, but Jack clearly demonstrated that data is passing through servers that our controlled by US-owned entities - namely Cloudflare and Digital Ocean ... what am I missing ?
link
JackWritesCode 1614 days ago
Just posted this thread to a friend and they said I wasn't being 100% clear, so I apologize. I'll clear things up.

Using EU servers that are owned by a US company (e.g. AWS deployed in the EU, DigitalOcean deployed in the EU) is a violation of the Schrems II ruling. The way you check this is by looking at the IP addresses the analytics software are using, seeing where they're located and who they're owned by. You can then run that IP in ipinfo.io to get information about who controls that IP. If it's a US cloud provider, regardless of server location, it's a GDPR violation.

The English translation of the ruling can be found here. They go into detail within the rulings about the transfer of Personal Data (IP & User Agent) to servers that cannot be protected from US surveillance laws: https://noyb.eu/sites/default/files/2022-01/E-DSB%20-%20Goog...

"This is a very detailed and sound decision. The bottom line is: Companies can't use US cloud services in Europe anymore. It has now been 1.5 years since the Court of Justice confirmed this a second time, so it is more than time that the law is also enforced." - Max Schrems

link
markosaric 1613 days ago
All site data plausible.io stores on behalf of the customers is hosted in Germany on servers owned by Hetzner, a European-owned company. Previously it was hosted by Digital Ocean in Germany but the move to Hetzner was made last year.

For our self-hosted version, you can install it with any cloud provider and in any country you wish. Even in the USA. That's the testing one we had on our site as we're testing the latest release of our self-hosted version on our own website. This has nothing to do with what our customers place on their sites.

link
JackWritesCode 1613 days ago
Yup, just to be clear, I wasn’t talking about site data, I was talking about the processing of Personal Data (IP & User Agent).

You were using Netlify previously, which is a US provider and backed by AWS, and then Cloudflare for the testing.

But yesterday I can see you moved to Bunny (an EU cloud provider), which is great news for your customers, party time!

Provided you’re using Hetzner behind Bunny, that looks like solid Schrems II compliance to me.

link