GDPR, Encryption & Backups: Securing User Data in Our Apps

Handling personal data responsibly is not optional in the EU - it's mandated by law. We design our systems around key GDPR principles, especially focusing on technical safeguards like encryption and disaster recovery. In this article, we detail the measures we take to ensure compliance and data security.

Encryption at Rest and In Transit

The General Data Protection Regulation explicitly calls for appropriate safeguards such as encryption. We adopt encryption extensively:

• Data at Rest: All customer data stored in databases or on disk is encrypted. On our Linux servers, we use LUKS full-disk encryption, so even if hardware is stolen or snapshots are accessed, the raw data is unreadable. Our managed PostgreSQL (on EU VPS) also has built-in encryption on the storage layer. For file uploads, we store them in an encrypted object store or filesystem (e.g. an encrypted Ceph bucket).
• Data in Transit: Every connection is TLS-secured. All database connections explicitly use SSL/TLS (we set ?sslmode=require on Postgres URLs). The DanubeData GDPR guide we follow states "All database connections must use TLS/SSL.". Similarly, all API endpoints are HTTPS-only, and we disable any insecure (HTTP) fallback. We use modern TLS versions (1.2+), disable old ciphers, and use HSTS on web frontends.

By encrypting at both layers, we address a core GDPR requirement: protecting against "unauthorized or unlawful processing, accidental loss, destruction or damage". Breaches of encrypted data (with proper key management) are generally considered much lower risk.

Secure Access Controls

Aside from encryption, we enforce strict access controls:

• Least Privilege: Database users have minimal rights. For example, the frontend app connects with a role that can only read user data it needs, not all tables. Administrative accounts (for DB migrations) require VPN and MFA to access.
• Network Restrictions: Our VPS network allows only whitelisted IPs for SSH and DB port. We use ufw/firewalld to close unused ports.
• Audit Logging: We enable PostgreSQL's pgaudit extension to log all access. This means if GDPR auditors ask what happened around an incident, we have a detailed log. Logs themselves are stored securely and rotated regularly.

These measures ensure that even within our systems, only the right processes see the data. When a developer needs to debug in prod, we require them to use a bastion host with an expiring login, and all actions are logged.

Backups and Disaster Recovery

GDPR also mandates the ability to restore data and ensure availability. We implement robust backups:

• 3-2-1 Strategy: As detailed in Post 3, we keep 3 copies (live DB, on-site backup, off-site backup), on 2 media types, with at least 1 off-site. The off-site copy is stored in a separate EU region.
• Automation and Testing: Backups are fully automated and encrypted. We use pg_dump plus WAL archiving. Off-site backups are immediately encrypted with a separate GPG key. We test restores monthly to verify integrity.
• Retention Policies: We retain backups for up to 90 days, which covers any need to revert to previous data versions. Audit logs are kept for 3+ years to meet GDPR record-keeping.

With this setup, even if a catastrophic failure occurred (e.g. a total data corruption or server loss), we can restore services within hours. We align with GDPR Article 32(1)(c) which requires "the ability to restore availability and access to personal data in a timely manner".

Data Protection Impact

Putting it all together, our design aims to turn GDPR from a legal headache into an engineering discipline. Storing data in EU data centers, using end-to-end encryption, and having tested backups means we minimize risk. As GDPR advisor Adrian Silaghi puts it: EU hosting means no transfer outside EU, and no exposure to US surveillance laws. It also simplifies our compliance: we rely on the "One Standard Contractual Clauses" (SCCs) internally without worrying about foreign jurisdictions.

We never claim "100% GDPR compliant" (legal status is complex), but we do practice GDPR-aligned engineering. Our customers benefit from knowing their data is treated with EU-level care. We document our processes and update them as laws evolve. In practice, this has prevented any data incidents so far - our team has greater confidence backing our platform, and our audits have been clean.

Finally, if you're building apps, don't overlook these infrastructure details. Encrypt your databases, keep backups in Europe, and test your recovery. These steps not only check the GDPR box, but also protect you and your users from data loss or theft.