-1

I have a multi-tenant website. It has been hosted in the USA for many years with no problem.

In recent years my customers in Australia, Canada and the EU have shared concerns as their countries privacy laws conflict with the USA's privacy laws.

So the question is what are some ways around this? I understand there is not a "one-size-fits-all" solution but has anyone faced similar obstacles and what have you done to combat it?

Do I set-up servers in Australia, Canada, EU, etc and host multiple versions of the same code, but storing the data in the country?

I guess if an Australia customer knows their data is hosted in Australia, they would have peace of mind...

Or are there better options? I'd be interested to hear anyone's thoughts

Thanks in advance!

Ben

7
  • Out of curiosity, how does separating them prevent the NSA or any other agency or entity from accessing them? The same risk exists whether they're separate or not. Also, how does finding another HOST country ameliorate or eliminate the potential legal issues regarding the HOSTED country?
    – joeqwerty
    Mar 6, 2014 at 1:25
  • 1
    It depends on what your site is for, what data is stored on your site, and what the regulatory bodies of said country/countries are expecting. If you're looking for a simple answer, you won't find one. Security is a complex problem with no "one-size fits all" solution. Unless you want to move all your servers to an Eastern European or South-East Asian country where there are basically no rules, but that's got it's own issues.
    – CIA
    Mar 6, 2014 at 3:32
  • @CIA Thanks, that makes sense. I'm a global company in over 13 countries so I know there isn't a simple answer. My questions is merely to see if anyone else has had similar issues and what they've done to combat it. Mar 6, 2014 at 7:10
  • @joeqwerty Now idea and that's not the REAL problem. The problem is the customers perception of it all. Nothing on the internet is really SAFE is it? I guess when a client asks where their data is hosted, they have peace of mind. Mar 6, 2014 at 7:15
  • 1
    @BenSinclair You shouldn't gauge your security practices on what other big companies are doing (big companies are just as bad at security practices as small companies). You should gauge your security practices based on the country you're serving the data out of and the country/countries you're serving the data to. If EU requires you to encrypt your data in transmission, then you need to serve your data over HTTPS/SSL; if the US requires you to not use SSN as IDs, then you need a new method for it; etc... etc...
    – CIA
    Mar 7, 2014 at 14:03

1 Answer 1

1

I don't think there are any hard and fast rules here other than do what makes your customers and their regulatory authorities happy.

1
  • Yes but what my question asks is what other global companies have done to combat this... Mar 7, 2014 at 0:40

Not the answer you're looking for? Browse other questions tagged .