Translator's Note. — a web analytics service focused on privacy (essentially the opposite of Google Analytics)
As the founder of Simple Analytics, I have always recognized the importance of trust and transparency for our clients. We are responsible for them, so they can sleep soundly. The choice should be optimal in terms of privacy for both visitors and clients. Thus, one of the most important questions for us was the choice of server locations.
In recent months, we have gradually moved our servers to Iceland. I want to explain how it all happened and, most importantly, why. It was not an easy process, and I would like to share our experience. The article contains some technical details that I tried to express in understandable language, but I apologize if they are too technical.
Why move the servers?
It all started when our site was added to . This is a list of domain names for ad blockers. I asked why we were added, since we do not track visitors. We even the 'Do Not Track' setting in the browser.
I wrote to :
[...] So if we continue to block good companies that respect user privacy, what is the point? I think it's wrong to list every company just because it sends requests. [...]
And received from :
Everyone agrees with you, but I don't want my requests to be sent to an American company (in your case, Digital Ocean [...])
At first, I didn't like the response, but in discussions with the community, I was pointed to its validity. The U.S. government can indeed access our users' data. At the time, our servers were indeed hosted by Digital Ocean, they could simply pull our disk and read the data.
There is a technical solution to the problem. You can make it so that a stolen (or otherwise disconnected) disk becomes unusable for others. Full encryption complicates access in the absence of a key (note: the key is only with Simple Analytics). It's still possible to obtain small fragments of data by physically reading the server's RAM. The server cannot operate without RAM, so in this regard, one has to trust the hosting provider.
This made me think about where to relocate our servers.
New location
I started looking in this direction and came across a Wikipedia page with . There is a list of 'internet enemies' from the international non-governmental organization 'Reporters Without Borders', based in Paris and advocating for press freedom. A country is classified as an enemy of the internet when it 'not only censors news and information online but also carries out almost systematic repression against users.'
In addition to this list, there is an alliance called aka FVEY. This is an alliance of Australia, Canada, New Zealand, the United Kingdom, and the United States. In recent years, documents have shown that they intentionally spy on each other's citizens and share collected information to circumvent domestic spying legislation (). Former NSA employee Edward Snowden characterized FVEY as 'a supranational intelligence organization that is not bound by the laws of its member countries.' There are also other countries working with FVEY in various international cooperatives, including Denmark, France, the Netherlands, Norway, Belgium, Germany, Italy, Spain, and Sweden (the so-called 14 Eyes). I could not find evidence that the 14 Eyes alliance has misused the gathered intelligence.
After that, we decided not to host our data in any of the countries on the 'internet enemies' list and definitely to skip the countries of the 14 Eyes alliance. The fact of collective surveillance is enough to refuse to store our clients' data there.
Regarding Iceland, the aforementioned Wikipedia page states the following:
The Constitution of Iceland prohibits censorship, and there is a strong tradition of protecting freedom of expression that extends to the internet. […]
Iceland
When searching for the best country in terms of privacy protection, Iceland kept coming up. Therefore, I decided to study it closely. Please note that I don’t speak Icelandic, which may have caused me to overlook important information. , if you have any information on the topic.
According to the report by Freedom House, Iceland scored 6/100 (the lower the score, the better) on censorship levels, tying with Estonia. This is the best result. Keep in mind that not all countries were assessed.
Iceland is not a member of the European Union, although it is part of the European Economic Area and has agreed to follow consumer protection and commercial law legislation similar to that of other member states. This includes the Electronic Communications Act 81/2003, which introduced data retention requirements.
The law applies to telecommunications service providers and mandates record retention for six months. It also states that companies can provide telecommunications information only in criminal cases or matters of public safety and that such information may be shared only with the police or prosecutors.
While Iceland generally follows the laws of the European Economic Area, it has its approach to privacy protection. For example, Icelandic law encourages the anonymity of user data. Internet providers and hosts are not legally responsible for the content they publish or transmit. According to Icelandic law, the legality of using the .is domain is the responsibility of the domain registrar (). The government imposes no restrictions on anonymous communication and does not require registration when purchasing SIM cards.
Another advantage of moving to Iceland is its climate and location. Servers emit a lot of heat, and the annual average temperature in Reykjavik (the capital of Iceland, where most data centers are located) is 4.67 °C, making it an excellent place for cooling servers. For every watt used by servers and networking equipment, only a very small portion of watts is used for cooling, lighting, and other overhead costs. Additionally, Iceland is the largest producer of 'clean' energy per capita in the world, and overall the largest producer of electricity per capita, with approximately 55,000 kWh per person per year. In comparison, the average in the EU is less than 6,000 kWh. Most hosts in Iceland get 100% of their electricity from renewable sources.
If you draw a straight line from San Francisco to Amsterdam, you will cross Iceland. At Simple Analytics, most of our clients are from the US and Europe, so it makes sense to choose this geographic location. Additional benefits of Iceland include privacy laws and an environmental approach.
Moving Servers
First, we needed to find a local hosting provider. There are quite a few, and it was really hard to determine the best one. We didn’t have the resources to test them all, so we wrote a few automated scripts () to set up the server, making it easy to switch to another host if necessary. We settled on a company with the motto 'Protecting privacy and civil rights since 2006.' We liked that motto and asked them a few questions about how they would handle our data. They reassured us, so we continued with the setup of the main server. And they use electricity only from renewable sources.
However, during this process, we encountered several obstacles. This part of the article is quite technical. Feel free to skip to the next section. When you have an encrypted server, it is unlocked using a private key. This key cannot be stored on the server itself; it must be entered remotely when the server boots up. But wait, what happens if the power goes out? It seems that all web page requests to the server will not be executed after a reboot?
That's why we added a primitive auxiliary server in front of the main server. It simply receives page view requests and sends them directly to the main server. If the main server goes down, the auxiliary server will save the requests in its own database and will repeat them until it gets a response. This way, there is no data loss after a power failure.
Let's return to the server boot process. When the encrypted main server boots up, we need to enter a password. However, we don't want to travel to Iceland or ask someone there to enter the server room, for obvious reasons. Remote access to the server typically uses the secure SSH protocol. But this program is only available while the server or computer is running, and we need to connect before the server fully boots up.
This is how we found , a very small SSH client that can be launched from (initramfs). And we can allow external SSH connections. Now, there's no need to fly to Iceland to boot up our server, hooray!
Moving to a new server in Iceland took us a couple of weeks, but we're glad we finally did it.
Store only necessary data
At Simple Analytics, we operate on the principle of "Store only necessary data," collecting the minimal amount.
In web applications, it is common practice to data. This means that data is not actually deleted but simply becomes inaccessible to the end user. We do not do this—if you delete your data, it will vanish from our database. We use hard deletion. Note: They will remain in encrypted backups for a maximum of 90 days. In case of an error, we can restore them.
We do not have a delete_at field 😉
It is important for clients to know which data is stored and which is deleted. When someone deletes their data, . The user and their analytics are removed from the database. We also delete the credit card information and an email from Stripe (the payment provider). We keep the payment history, which is necessary for tax purposes, and store our log files and database backups for 90 days.
Question: if you only store the minimum amount of sensitive data, why all this protection and additional security?
Well, we want to be the best analytics company in the world focused on privacy. We will do everything in our power to provide the best analytics tools without invading your visitors' privacy. Even while protecting vast amounts of anonymized information about visitors, we want to demonstrate that we take privacy very seriously.
What's next?
When we improved privacy, the loading speed of scripts embedded in web pages increased slightly. This makes sense because they used to be hosted on CloudFlare's CDN, a network of servers worldwide that speeds up loading for everyone. Now we are considering deploying a very simple CDN with encrypted servers that will only serve our JavaScript and temporarily store web page requests before sending them to the main server in Iceland.
Source: habr.com
