EU - GDPR vs bubble - legal entity and data location

[fok_ste]

Hi,
i talked to different DPOs and Agencies in Germany and all of them told me the same not to use bubble for a plattform where we provide any personal/sensitive data. The two big issues are the NON-eu located datacenter (which I now can be solved with a dedicated server). But the bigger issue is, that Bubble has no european entity. This means we are the data exporter and would take the full risk for any breaches/anything else that happens outside of the EU.

I’m sure that I’m not the only one in the EU who is using bubble.

Is there anything planned from bubble to have a legal entity in the EU? @emmanuel

[Future]

Same kind (not exactly) of problem in Canada… Been ringing that bell for a long while long, “glad” to see were not the only one with these problems. Our solutioin has been to offload everything from bubble and use it as a front end only… Hosting our data (files but most important : databases) in Canada directly or via entities like Xano has made us compliant. But it ain’t simple, because even the API connector proxies (most of) the data in the USA, so we have to make most calls directly via javascript.

Depending on where your development is at now, you may want to consider different possibilities. We had already invested countless hours in Bubble and had to adapt, just annoyed that Bubble doesn’t use something as simple as kubernetes to popup dedicated instances at an affordable prices like their competitors.

[hoke]

@Future

like their competitors.

Do you know any Bubble alternative that is GDPR compliant? Thanks!

[Kackur]

Use Bubble for front end and Xano as back end.

Xano - The Scalable No-Code Backend

Whit that said, kind of unreal Bubble has had Euro-users from their very first year (as me) and still haven´t been able to prioritize a solution for a global community.

[redvivi]

@Kackur

Use Bubble for front end and Xano as back end.

Nope. Not GDPR compliant.

[hoke]

Why not?

[gerbertdelangen]

We started using Noodl.net for EU our clients because of Bubble’s GDPR issues.

[redvivi]

@hoke

Why not?

How much is a dedicated plan roughly (London)

Data location has nothing to do with GDPR compliancy. GDPR applies to European citizen or residents regardless of their data location.

Best External backend of Bubble

From a communication perspective, it is understandable, however keep it mind it won’t pass the GDPR compliancy requirements. Moreover and given the data type you are processing, you have to know Xano is a US legal entity, therefore falling right under the Patriot Act which allows under certains conditions data access by some US government services (the ones with the big ears). In this scenario it will fail compliancy as well, unless the data can be encrypted/decrypted by a EU legal entity with…