1

I noticed many privacy focused apps make a point of selecting which country their servers and data is stored in. Why is this and is their reasoning valid? For example this article compares the cloud storage providers IceDrive and pCloud:

Icedrive offers a single storage location — the UK — while pCloud lets you choose between the U.S. and Luxembourg. While there are many examples of the U.S. being terrible in this regard, whether it’s PRISM or the Patriot Act, the UK isn’t much better since the passage of the Investigatory Powers Act in 2016.

However, pCloud’s alternative location, Luxembourg, is far better. Being located in the EU means your data is protected by GDPR regardless of your nationality, and Luxembourg has solid privacy protections in general. That said, Icedrive also complies with GDPR, even if they might not be legally obliged to do so in the future.

Also in this review the Trust.Zone VPN Service claims

If we receive any type of DMCA requests or Copyright Infringement Notices – we ignore them. Trust.Zone is under offshore jurisdiction, out of 14 Eyes Surveillance Alliance. There is no data retention law in Seychelles

Does the legal jurisdiction of the servers or data storage of an online service affect the security or privacy of the service in anyway?

TL;DR does it make sense that an app that has servers in the US and stores my data in the US is less secure than if it stored in a country like Switzerland?

Improve this question
13
  • I only see points re privacy in your quotations, not security. Do you understand the difference? What makes you think that they imply your data is "less secure" in the US?
    – Greendrake
    Aug 24, 2021 at 9:38
  • Also,are you seeking security from the company voluntarily disclosing information or where they are subject to a court order?
    – Dale M ♦
    Aug 24, 2021 at 10:28
  • 1
    @Greendrake perhaps not so much security in those quotes. But for example if a country that suddenly seized servers with data on them, that would be a security concern. theregister.com/2016/07/13/…
    – user14343
    Aug 24, 2021 at 10:29
  • 1
    @JBentley That's still just a privacy issue. There is no sense talking about security if the threat model is the government: you are not supposed to be secure from your government by the definition of it.
    – Greendrake
    Aug 24, 2021 at 14:09
  • 1
    @Greendrake Well, we can agree to disagree, but I'm not sure the semantic difference is too relevant to the OP's question anyway. Whether we call it privacy or security, what OP is really asking is whether the service provider's jurisdiction offers any legal protection against [privacy/security] threats from governments. By "data being less secure in the US" (from your first comment) my understanding is that OP is implying that for a US server the government will be able to take legal measures to acquire his data that may not be possible for offshore servers.
    – JBentley
    Aug 24, 2021 at 15:38

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .