Hacker News

points by griffiths 1 day ago | 0 comments

Can you give more information on "illegal for most European companies" part? Asking for a EU company using Jira :)

This person is just posting absolutely baseless claims, as if Atlassian, a company that basically exists purely on the back of B2B SaaS sales, has not considered EU data residency requirements in their core product offering: https://www.atlassian.com/software/data-residency

[–] dijit 23 hours ago

FWIW nearly every SaaS or IaaS is making bold claims about supporting data sovereignty, but unless it has been challenged in court I wouldn’t put much stock into it.

The fact that Jira/Confluence are being processed by their LLMs puts them in direct legal conflict with several statutes in the EU, its a matter of time for them to get hit by this and I’m betting that they think the fine will be lower than the revenue they acquire for doing it- and they’re hoping they don’t get hit at all.

This seems to be the common case for a lot of the non-EU tech companies, and it seems to be working.

Oracle is currently the market leader in “sovereign” compute for EU governments for example, as ironic as that is.

[–] egeozcan 1 day ago

> This person is just posting absolutely baseless claims

You don't need to be so hostile. I know about the EU requirements but many EU companies have sensitive data on hosted JIRA / Confluence that simply cannot be in the possession of a non-European company. I know because I'm working for one. I cannot even remote-work from outside Europe. Some stuff cannot even leave the VPN. There's also the CLOUD act.

[–] jamesfinlayson 1 day ago

Yeah I thought Jira at least was all built on AWS these days. I've never set up a Jira Cloud instance but I'd be surprised if you don't chose where your data lives.

[–] kenniskrag 1 day ago

In short gdpr compliant means you can configure it but it must not be compliant by default and also there is no guarantee.

They are constantly changing their software and settings. More than once they believed that something is legal but can be risky for the atlassian customer.

For example training AI on metadata which they believe are anonymized but are maybe not enough changed.

Training data or metadata permisson can not be configured on all subscriptions. But as a data processor they must follow the contract otherwise they become data controller.

Also there are risks associated with privacy data framework, cloud act etc. to be non compliant just by data transfers to other countries.