Workers are getting regional tools! (Improves GPDR & "Digital Services Act" compliance)

[thomas4]

This is huge news! I can’t wait to tell our most GDPR wary customers about this

“To that end, this week we’re announcing the Cloudflare Data Localization Suite. It provides our customers with a powerful set of tools to ensure they have control over how and where their data is processed in order to help comply with increasingly complex local data processing requirements. This includes enhancements to Workers, our edge computing and storage platform, to help modern applications get built such that users’ data never leaves their own country or region.”

Welcome to Privacy & Compliance Week: Reflecting Values at Cloudflare’s Core

@tallyfy

UPDATE: For Enterprise plans only.

[tallyfy]

@thomas4 per this thread - does the digital services act actually mean data must be stored in a physical location?

Durable Objects - Create and Auto-migrate within a specific country or region

I hope they consider it! This would make it much more powerful, and instead of just being storage, there would a level of geographical control that no other solution appears to have, in the face of compliance and data privacy laws popping up everywhere. I believe “privacy and compliance” was one of the key business drivers for creating workers, etc. so ensuring that storage-at-rest, and later - compute as well (Workers) is guaranteed to be in a certain locale is a very strong reason to adopt th…

In your opinion, if one could guarantee processing and storage in a single country, how would that affect a DPA - or the need for one, between say - a SaaS company like us and our end customers?

[thomas4]

My interpretation (not a lawyer) is that since the data is guaranteed to be local, the privacy laws of that country would apply to the stored data. However, the DPA is still a contract between you and Cloudflare about the legal promises they make about following GDPR procedures of handling data. They might consider a custom DPA if you’re a large enough customer, which probably entails locking you to the EU region for all (compatible) Cloudflare services.

About the digital services act, I haven’t read it yet but I’d assume it’s about storage within the EU only.

[michael]

from our earliest days we’ve used the _cfduid cookie to help with some of our security functions. … this week we’re announcing its deprecation.

Wow!

[sdayman]

Pingdom is going to be SO HAPPY! (except for still not realizing that Brotli is a compressor).

[tallyfy]

Great, thanks for the opinion! Yes, this helps a lot.

Unfortunately, our RDS (Postgres database) is still land-locked to a single origin, and I suspect most serious apps cannot use this unless their core database is also in a given region, like the EU.

The next, huge challenge for the Cloudflare team is to have a localized, fully-managed, replicated, cloud-based Postgres service Like Google Cloud Spanner, but better! If that happened, Cloudflare would eat everyone’s cake and explode - AWS, Google Cloud, Azure, etc.

If that happens - all my AWS spend on EC2 and RDS would be happy to move to Cloudflare.