Question about data security/hosting

Hi Mat and welcome to the community.

I cannot speak for Airtable, but I do a fair bit of work (in Airtable) with UK companies that fall under strict security compliance involving healthcare and children at risk, so I believe this security requirement is wholly addressed by Airtable. I defer to @Jason to officially clarify.

Hi @Mat_Scalpello,

Airtable is located in the US and is hosted using US-based AWS servers. We don’t have plans to have any servers outside the US at this time. If you’d like a deeper understanding of how Airtable approaches security, you can read more here.

Also, we are GDPR compliant and you can read more about the specifics of our compliance and what is available to you as an Airtable user using this support article: GDPR at Airtable.

Thanks Bill. I was thinking of using it for some Covid related local track n trace work. From Jason’s comments below, I’m not sure I’ll be able to.

That’s unfortunate. If actual server location is a requirement, you’ll be looking for the right tools for perhaps a long time.

We live in a world of microservices. These are PaaS (platform as a service) foundations that allow underlying services to distribute compute load and provide fast and reliable web services. For example, if you use a machine-learning feature in G-Suite - despite the fact that the servers themselves are in the UK, the underlying GPU computation may be computed in Ireland, Germany, or the US.

Other aspects of modern platforms also use CDNs to render images. For example, a picture stored on a UK server may actually be rendered by a server in the US depending on your Internet connection and the load presently on the route between you the image itself.

Data storage has little to do with data serving, rendering, and computational processing.

The world’s computational and server topography no longer equates to actual geographies and geo-political boundaries. If your government is asserting it does, they have woefully misunderstood the machinery of modern applications.

Bill, there is nothing in your statement I disagree with, especially the last line! Airtable is such a perfect fit for a number of use cases I have…

Thanks! It took me a few passes to get those words to line up. :winking_face:

I think you should attempt to open a dialog between Airtable security experts and your government’s security experts. I believe there is wiggle room given Airtable’s adherence to GDPR and the realization that server location has little to do with security or where computation processes actually occur.

Airtable is the benchmark in terms of usability and features, absolutely. There are a few European alternatives though that may cause less of a regulatory headache.

I came across Zenkit on a project recently and played around with SeaTable a bit. SeaTable actually looks quite like Airtable. But are Germany-based. A Swedish contender is Favro. I don’t know where they store the data.

Hi @Mat_Scalpello, @Bill.French, @RDB

You might also want to look into Ninox database app. They are located in Germany.

It’s a pretty good app.

I hope you find an app that will work for your purposes.

Mary Kay

Didn’t know Ninox. Looks interesting. Thanks for the hint.
I forgot to mention in my previous post: SeaTable offers a self-hosting option. May be relevant for you if …

… is essential.

Sadly there is absolutly no wriggle rom at the moment and Airtable are not GDPR compliant anymore by definition.
Are there no way you could consider extending the service to Hosting in Europe?

Yes indeed, at this moment, any data transferred to or stored in the US, is by definition not GDPR compliant. As far as i know, what would be the ‘best’ solution is an both a watertight DPA and EU only hosted servers/data.

I don’t think it’s that simple. I believe at least two of my clients have achieved GDPR compliance in the UK with Airtable. Has your “definition” factored in all of the possible exceptions and processing policies offered under the GDPR?

This is something that would be absolutely necessary to be able to use Airtable in big european companies. Please consider it seriously!

I agree with several people in the thread @Clement_Cremon, @Christian_Stange @Mat_Scalpello. In order to be GDPR compliant most (all) EU companies need sensitive data to be hosted within EU, so it would be great if you can host in e.g. Ireland. We had the same problem with another US software provider and they are now hosting in Ireland. Hope to hear back… what is the status re. hosting in EU?

I work for a government agency within a EU country and I would love to use airtable. However, I cannot if the servers are not located within the EU. This has been stated by our own lawyers (not Airtable specifically) in regards to other SaaS solutions with cloud storage. It is, simply put, easier for Airtable to put servers in the EU than it is to get government agencies to change their stance on the topic. Frankly, it is a don quijote mission. It really doesn’t matter if you are right. Beaurocracy has won in my case and they will not take time and sit down with airtable and discuss, they have a million other things to do.

It would be great if airtable can have hosting within the EU. Cheers

@Jon_Schaffer @D_B @Mat_Scalpello Did you guys find an alternative software comparable to Airtable with servers in the EU?

Beside excel, unfortunately not. :frowning:

Not exactly, but we had to switch to Monday.com to be compliant

“Microsoft Lists” (part of Office365) might be alternative product and in Office365 admin there is a switch to choose “EU data residency”

I love your product, but we can’t use it for most projects due to the data not being hosted in the EU.

At the end of the day what you say about GDPR, even if you are right, matters not. The discussion ends when the lawyers working for our clients state that sensitive data may not leave the EU. We either comply with this requirement or we don’t have a customer.

So please reconsider setting up hosting in EU!

Does this change your support for GDPR?

Hi Bill,

Thank you for sharing this!
It could have a positive impact, but this article isn’t clear enough about the implications:

• what does that mean for data storage location, is it possible to switch to EU-located servers? what about data processing location?
• does that mean that all EU license contract are with the London entity?

Could you help with this?

Best regards,
Ludo

DISCLAIMER: I am not an expert on GDPR or any other privacy frameworks, policies, or laws.

Not that Airtable has indicated (yet).

That’s a problem. I believe it is mandatory for all data to be “processed” inside EU borders to be able to claim compliance. There are some exceptions, but it is a very complex topography.

As I am told, when the US opted into the Privacy Shield model in 2020, it failed to address the individual privacy rights as required by GDPR. The right to be forgotten as well as the mandatory appointment of data protection officers by processors of large quantities of personal information of EU data subjects are only some of the GDPR compliance requirements the EU-US Privacy Shield does not include.

That’s a question for Airtable; one that I would like addressed. However, I don’t think the presence of a company abates any of the underlying technical requirements to satisfy GDPR. But I do get the sense that Airtable would not likely create any EU presence without also accommodating GDPR compliance.

Hi!
@Airtable would you have an answer to these questions?
Is it in your plans to enable data storage and/or processing in the EU any time soon?

Best,
Ludo

Hi Jason,
Do you have an update on this, please?
Do Airtable still have no plans to work out some kind of a solution to this issue?

Individuals who are exited about Airtable and who want to convince their organisations to use it, do not have the time or resources to argue against the lawyers in their own organisations. We are all still hoping for Airtable to provide us with an answer, so we can start using it.
All the best, Anna