r/PrivacyToolbox • u/EnthusiasmRoutine • 16d ago

Discussion Choosing an EU server region means absolutely nothing if you don't hold the keys

Half the people I talk to think they solved data sovereignty because they clicked "Frankfurt" in their AWS console.

It is a complete joke. Physical location of the drives does not equal legal sovereignty. If you use an American cloud provider and they manage your encryption keys, a judge can force them to hand over those keys. End of story. Encryption at rest just stops rogue admins from snooping. A court order easily bypasses it.

If you want actual sovereignty, you have to run your own external key management. Keep the metadata locally too.

ETA: yes this is a massive headache to configure, but what is the alternative?

• Upvotes

88% Upvoted

3 comments sorted by

•

u/detelamu 15d ago

Build EU capacity within EU jurisdiction. In the meantime hybrid solutions risk based and accept that the EU is paying for their lazyness

•

u/Siegen1986 13d ago

Simple solution: ditch all cloud-based services that have any presence at all in the US of A:
Euro-Office runs like a Ferrari while M365 runs like a scooter. It's your own fault.
As the Germans say: Hau weg den Scheiß!