No matter what you do with a US cloud, you cannot give a 100% guarantee that US authorities will not enforce access to data.
No matter how much the Danish company SupWiz risk analysed, deleted, encrypted, segregated, logged and anonymised data and made TIA reports there were still customers who said: “data should be stored with a cloud service operated and owned by a company based in the EU”. So SupWiz co-founder and CEO, algorithm professor Stephen Alstrup decided to look for an alternative to the US cloud service the company could offer its customers.
“There has been so much talk and writing about Schrems II, so some companies and organisations have a very strong wish using EU based and owned cloud solutions only” says Stephen Alstrup, who saw Schrems II halting companies and organizations from buying new cloud-based solutions and looking for moving existing solutions. Others are simply waiting (hoping) for EU and US on high political level will find a solution together.
The political solution hasn’t arrived yet. Well, Ursula von der Leyen, the EU Commission president, said in March that the EU and US have agreed in principle on a solution for a new Privacy Shield. The EU Court of Justice ruled in 2020 that the Privacy Shield as a basis for data transfers is illegal, thus Schrems II – just as Schrems I stopped the previous basis, Safe Harbor. Companies can still use so-called standard contractual clauses, for which the Danish Data Protection Authority has written guidance, which also is part of SupWiz standard solution.
But the legal status is still unclear and still it don’t give full guarantee that US authorities cannot access the data, when it is stored by a US company with legal headquarters in the US. In the EU as well as Denmark, expert groups have been settled to investigate the situation further to come with recommendations.
Yet, many companies and organisations cannot wait, so SupWiz took action.
“We took DataEthics’ cloud guide and went through the alternatives one by one. Some are extremely expensive. Others are severely limiting in functionality and even in data security,” says Stephen Alstrup.
The company ended up with France’s Scaleway, and not only is it slightly more expensive than the big US solutions, it also doesn’t support as broadly as several of the big US services. For example, Scaleway doesn’t support encryption of data once it’s on disk, Alstrup says:
“They can store your data, but you need to make the encryption yourself. So we had to develop that ourselves. Its not trivial – so I’m happy we are very strong algorithm/AI company.”
In terms of handling a lot of data, choosing a service like Scaleway is not a problem – even if it was a large Danish public service, says the algorithm professor.
Other companies are moving to a Eurpean-based cloud service. According to Prosabladet, the Danish company KeepFocus, working with energy solutions, management and optimisation, was looking for a cloud-service and also opted for the French Scaleway. They are pleased with the fact that they now don’t have to deal with all the challengens of using a US cloud service, they tell Prosabladet, where you can also read an interview with Max Schrems, saying that it is very likely that there will be a SchremsIII (in Danish).
SupWiz sells chatbot solutions and automated solutions to streamline case processing for both public and private customers. The company, which has 35 employees, currently offers its customers to store data with both Microsoft and Scaleway.
” I´m happy we now can offer both solutions to our customers” says Alstrup, whose price on Scaleway is a little higher than if the customer chooses Microsoft.
“We have to, because it’s simply more expensive, especially in our own staff resources, but it wasn’t a difficult choice. We are targeting large enterprises with high demands and just have to deliver”.
