Do you have a policy regarding data protection from government interference?

MattShepherd

I'm located in Canada, and in the light of this news story, have grave concerns about the US government and its direct interference with people who have no overt ties to the US but are critical of the current regime.

https://www.cbc.ca/news/world/us-dhs-aclu-lawsuit-canadian-john-doe-9.7187851

Your privacy page (https://www.opalstack.com/privacy.html) states:

Disclosure of personal information to third parties

We may disclose personal information to:

third party service providers for the purpose of enabling them to provide their services to us, including (without limitation) IT service providers, data storage, hosting and server providers, analytics, error loggers, debt collectors, maintenance or problem-solving providers, marketing or advertising providers, professional advisors and payment systems operators;
our employees, contractors and/or related entities;
courts, tribunals, regulatory authorities and law enforcement officers, as required by law, in connection with any actual or prospective legal proceedings, or in order to establish, exercise or defend our legal rights.

I'd like a little more clarity around what happens with data stored on your German servers, and what would happen if, say, the Department of Homeland Security called tomorrow and demanded you give them all my stuff: web content, emails, etc.

I love Opalstack. I'm a huge fan, your support is amazing, your services are great. But the current US regime is one that I really have no faith in, and if there aren't any safeguards in place against that kind of action, I might have to poke around for other solutions.

sean

MattShepherd I'd like a little more clarity around what happens with data stored on your German servers, and what would happen if, say, the Department of Homeland Security called tomorrow and demanded you give them all my stuff: web content, emails, etc.

First, we would verify the validity of the request, ie anything weaker than a judicial subpoena/warrant would be immediately challenged.

If the request is valid, then we'll begin an internal review to determine if releasing the data would violate German law or more generally the GDPR. If so, then depending on the circumstances we would likely attempt to either seek a protective order from a US court to prevent the release of the data or direct the agency to work with German/EU authorities to obtain the data.

If the data is not protected by the GDPR or if neither of those courses of action are viable, then as a US company we would likely be forced to comply with the request.

MattShepherd

Thanks, Sean!