# GDPR or HIPPA compliance **URL:** \ **Category:** Product Discussions\ **Created:** [May 22, 2020, 12:46pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050 "2020-05-22T12:46:41Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Knowledge](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/knowledge/32/10681_2.png) [@Knowledge](https://forum.storj.io/u/Knowledge)\ **Post date:** [March 10, 2023, 8:03pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/21 "2023-03-10T20:03:39Z")
I store Terrabytes of data that I pay for out of my own pocket on the Storj network. It has been very reliable for me. Assuming you are in the United States, the IRS can ask for records as far back as ten years. I would feel secure having a copy on the Storj network, but not the only copy. I would feel this way with any online service provider no matter how large they are. One local, and at least one in the cloud. ---
**Author:** ![BrightSilence](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/brightsilence/32/6048_2.png) [@BrightSilence](https://forum.storj.io/u/BrightSilence)\ **Post date:** [March 10, 2023, 8:20pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/22 "2023-03-10T20:20:43Z")
Storj employees don’t have access to data. All of it is encrypted and only you have the key. However, if you use the web client or S3 gateway, encryption happens server side. The encryption keys are wiped after that is done, but in theory that’s where they could “listen in”. This is just theoretical. Storj has implemented lots of measures to ensure data won’t be accessible. The only reason I mention it is because these implementations aren’t entirely zero trust. If you want to avoid that though, you can use uplink to transfer the data or run your own S3 gateway. In those scenarios, all encryption happens locally and there is no possible way anyone but you can access the data. ---
**Author:** ![thereverendd](https://storj.bcdn.literatehosting.com/letter_avatar/thereverendd/32/6_22734026db12803ebb3e059622ac3534.png) [@thereverendd](https://forum.storj.io/u/thereverendd)\ **Post date:** [March 10, 2023, 8:33pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/23 "2023-03-10T20:33:54Z")
So using FileZilla PRO does it do the Encryption on my side 1st? Seems to use a LOT of processing power when sending over the data to storj ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [March 11, 2023, 4:00am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/24 "2023-03-11T04:00:49Z")
> [@BrightSilence](#): > > If you want to avoid that though, you can use uplink to transfer the data or run your own S3 gateway. Or encrypt the data with a software of your own choice before uploading it. Just an example, I don’t know how far they are with this and if it works with Storj DCS: > **[S3 object storage](https://community.cryptomator.org/t/s3-object-storage/7828)** > > @sToRmInG strikes again 😍 Later this day we’ll publish the first beta of v1.5.18 which introduces S3 object storage like e.g. Scaleway Object-Storage, Amazon S3, … to Cryptomator for Android. Thank you for this huge contribution 🙏! ---
**Author:** ![Alexey](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/alexey/32/41_2.png) [@Alexey](https://forum.storj.io/u/Alexey)\ **Post date:** [March 11, 2023, 5:25am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/25 "2023-03-11T05:25:49Z")
Depends on the used integration. If you [used a native integration](https://docs.storj.io/dcs/how-tos/filezilla-pro-integration-guide#CuJVS) (with access grant or API Key and encryption phrase), then it’s encrypted locally. If you [used an S3 integration](https://docs.storj.io/dcs/how-tos/filezilla-pro-integration-guide#LYdEU) with [Storj-hosted S3-Compatible Gateway](https://docs.storj.io/dcs/api-reference/s3-compatible-gateway), then you opted-in for server-side encryption. However, if you used an S3-integration with your own [Self-hosted S3-Compatible Gateway](https://docs.storj.io/dcs/api-reference/s3-gateway), it will use a client-side encryption. ---
**Author:** ![litecactus](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/litecactus/32/1135_2.png) [@litecactus](https://forum.storj.io/u/litecactus)\ **Post date:** [March 18, 2023, 8:29am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/26 "2023-03-18T08:29:20Z")
I think storj would be very wise to enlist the help of some legal professional to either figure out definitively how we can make it compliant (specifically talking about GDPR here because that’s relevant to me) or reaching out to the EU to get the regulation updated. Someone needs to get down in detail and work with the devs to make this work because (as a business owner) you can’t take storj seriously and that is a real shame. Every business needs to backup to the cloud somewhere and storj is the perfect place for that imo but without the GDPR stamp it’s discarded as an option. Invest in making GDPR work, find a way to give us immutability controls and you’ve got yourself a massive market. A crowd funded campaign could work here? ---
**Author:** ![heunland](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/heunland/32/6076_2.png) [@heunland](https://forum.storj.io/u/heunland)\ **Post date:** [March 18, 2023, 3:49pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/27 "2023-03-18T15:49:14Z")
> [@Update Proposal for Storage Node Operators](https://forum.storj.io/t/update-proposal-for-storage-node-operators/21749/640): > > This has already been addressed in the Twitter Spaces, see summary post: For those that don´t want to read all the 30 pages of legalese: The article specifically states on P30: Use Case 1: Data storage for backup and other purposes that do not require access to data in the clear 84. A data exporter uses a hosting service provider in a third country to store personal data, e.g. for backup purposes. If 1. the personal data is processed using strong encryption before transmission, and the ident… TL;DR: Storj is already working on this, and yes we do have legal council advising on these matters. We are confident that GDPR compliance is achievable. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [March 19, 2023, 2:44am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/28 "2023-03-19T02:44:09Z")
> [@heunland](#): > > We are confident that GDPR compliance is achievable. Yes with that assessment from the EDP this seems achievable. But what about the others? I hope you are looking into them as well. HIPPA means healthcare and clinical data like from MRIs. CJIS means all the data from bodycams from policeofficers to cctvs in prisons and legal data like court and investigation data. FERPA is all data around schools and students and MPA could help with all movie and cinema related content. Those sectors are huge too. ---
**Author:** ![heunland](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/heunland/32/6076_2.png) [@heunland](https://forum.storj.io/u/heunland)\ **Post date:** [March 19, 2023, 3:23pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/29 "2023-03-19T15:23:21Z")
Regarding HIPPA and other standards, please refer to the statement from the Twitter Spaces by @Bryanm which I quoted in the post above yours. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [March 21, 2023, 3:50am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/30 "2023-03-21T03:50:23Z")
> [@heunland](#): > > please refer to the statement from the Twitter Spaces by @Bryanm which I quoted in the post above yours. > [@Updates and Live Q&A Twitter Space March 15, 2023 @ UPDATED START TIME 2:00pm ET](https://forum.storj.io/t/updates-and-live-q-a-twitter-space-march-15-2023-updated-start-time-2-00pm-et/21787/53): > > We are working on our SOC2 certification and are more mature in terms of the less complex frameworks such as HIPAA and GDPR How is that an answer? It’s typically vague. It does not mention CJIS or FERPA or MPA nor does it state a time frame or current status or problems and solutions. I mean, [you have attended the HPA Tech Retreat 2023](https://hpaonline.com/event/2023-hpa-tech-retreat/?tab=participants) wouldn’t therefore a MPA certification be a great boost when talking to potential customers? ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [May 31, 2023, 5:45am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/31 "2023-05-31T05:45:21Z")
Here is some from the work in progress: > > > This blueprint o how we can 'certify' specific nodes so that we can select those… nodes for specific uploads similar to geo-fencing but not based on country. > > Blueprint in progress: https://review.dev.storj.io/c/storj/storj/+/9978/2/docs/blueprints/certified-nodes.md#49 ---
**Author:** ![Eioz](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/eioz/32/62_2.png) [@Eioz](https://forum.storj.io/u/Eioz)\ **Post date:** [June 4, 2023, 12:58pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/33 "2023-06-04T12:58:38Z")
I think the only need for this is to form possible verified regions of datas, if customer choose to host data into a verified region to be GDPR or others compliant. By default it could be GDPR compliant, now if customer choose to be located only into a given region it is possible by satelittes subdivisions on entire world, and it could require for exemple a strong identification rule to proove nodes localization arround entire world as i have example of method as the addition of strong identification rules, a dongle or other hardware stuff to ensure localization and node scrawling node host IP configuration in real time and processes… maybe running a new Storj node model, a custom OS iso like ubuntu or debian or others OS with the ability to migrate from now to new custom Storj OS with with a incoming access on system by Storj itself in order to be sure of node localization… I think storj could use geolocalization tracking system at least as dongle (could work in USB for virtual machines also) for Storj OS Appliance (ISO) for example or for Docker for SNO who want to host GDPR or others compliance model + using idenfication processes. Thanks for all Storj and Storj Community. ---
**Author:** ![Alexey](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/alexey/32/41_2.png) [@Alexey](https://forum.storj.io/u/Alexey)\ **Post date:** [June 4, 2023, 1:51pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/34 "2023-06-04T13:51:08Z")
we have a geofencing option for the paid customers. You need to [file a support ticket](https://supportdcs.storj.io/hc/en-us/requests/new) though. And accordingly this article: > [@Update Proposal for Storage Node Operators](https://forum.storj.io/t/update-proposal-for-storage-node-operators/21749/640): > > This has already been addressed in the Twitter Spaces, see summary post: For those that don´t want to read all the 30 pages of legalese: The article specifically states on P30: Use Case 1: Data storage for backup and other purposes that do not require access to data in the clear 84. A data exporter uses a hosting service provider in a third country to store personal data, e.g. for backup purposes. If 1. the personal data is processed using strong encryption before transmission, and the ident… we should be compliant. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [June 5, 2023, 4:34am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/35 "2023-06-05T04:34:42Z")
[https://review.dev.storj.io/c/storj/storj/+/9978/2/docs/blueprints/certified-nodes.md#49](https://review.dev.storj.io/c/storj/storj/+/9978/2/docs/blueprints/certified-nodes.md#49) > The United States has a rule that if node operators earn more than $600/year, > we need to file a 1099 for each of them. I was just wondering if such requirements could be bypassed if the nodes side of the operation would be handled by a non-us company. Like if all nodes would subscribe to and get paid by a non-us subsidiary of Storj. ---
**Author:** ![nerdatwork](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/nerdatwork/32/1135_2.png) [@nerdatwork](https://forum.storj.io/u/nerdatwork)\ **Post date:** [June 5, 2023, 8:49am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/36 "2023-06-05T08:49:38Z")
> [@jammerdan](#): > > Like if all nodes would subscribe to and get paid by a non-us subsidiary of Storj. That might be categorized as tax evasion and IRS does not play cool with that. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [June 5, 2023, 9:08am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/37 "2023-06-05T09:08:35Z")
I don’t know. A tax lawyer would need to be consulted for that. But without being one and just spin around that idea: When I work for Microsoft and if I am an employee of their German subsidiary Microsoft Deutschland GmbH, I don’t think I have to deal with IRS at all let alone pay any US taxes. So there is no tax evasion there. ---
**Author:** ![ACarneiro](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/acarneiro/32/1129_2.png) [@ACarneiro](https://forum.storj.io/u/ACarneiro)\ **Post date:** [June 5, 2023, 9:58am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/38 "2023-06-05T09:58:21Z")
There’s tax evasion and tax avoidance. The first will get you in trouble, the second very much not. Definitely would need “someone who knows” to give an opinion. ---
**Author:** ![nerdatwork](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/nerdatwork/32/1135_2.png) [@nerdatwork](https://forum.storj.io/u/nerdatwork)\ **Post date:** [June 5, 2023, 12:48pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/39 "2023-06-05T12:48:49Z")
> [@ACarneiro](#): > > Definitely would need “someone who knows” to give an opinion. It’s all about resources. A tax lawyer won’t give free advice. The time and money would be better spent on important things like implementing partial exit or other things than “a way to avoid/evade” tax, IMO. Besides no matter what you do, you will end up paying more or less tax either in USD or in your local currency. I feel the pain of paying higher tax and if it was possible Storj would have paid us using Paypal. I also think its kinda off topic but the blueprint jots down different use cases and its mention is missing from the current title of this thread. > [@jammerdan](#): > > When I work for Microsoft and if I am an employee of their German subsidiary Microsoft Deutschland GmbH, I don’t think I have to deal with IRS at all let alone pay any US taxes. So there is no tax evasion there. You are correct but German Microsoft would pay tax for getting paid by US MS then you as an employee would get taxed for getting paid. In short you do get taxed in your local currency. ---
**Author:** ![heunland](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/heunland/32/6076_2.png) [@heunland](https://forum.storj.io/u/heunland)\ **Post date:** [June 5, 2023, 3:09pm UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/40 "2023-06-05T15:09:52Z")
Please refer to [https://support.storj.io/hc/en-us/articles/360042696711-What-tax-forms-do-Storage-Node-Operators-need-to-submit-](https://support.storj.io/hc/en-us/articles/360042696711-What-tax-forms-do-Storage-Node-Operators-need-to-submit-) for the actual rules that apply to SNOs who are US persons vs Foreign Contractors. Foreign contractors do NOT have to file any 1099 US tax form nor will they owe any US taxes. Foreign contractors that earned more than $600 only need to file a [Form W-8BEN](https://www.irs.gov/pub/irs-pdf/fw8ben.pdf) which is informative only. Please abstain from suggesting that SNOs or Storj Labs should try to circumvent tax laws. ---
**Author:** ![jammerdan](https://storj.bcdn.literatehosting.com/user_avatar/forum.storj.io/jammerdan/32/1121_2.png) [@jammerdan](https://forum.storj.io/u/jammerdan)\ **Post date:** [June 12, 2023, 3:39am UTC](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050/41 "2023-06-12T03:39:16Z")
> [@nerdatwork](#): > > You are correct but German Microsoft would pay tax for getting paid by US MS then you as an employee would get taxed for getting paid. In short you do get taxed in your local currency. Of course everyone gets taxed as per their local laws they fall under. But you brought up the question of IRS and what I am saying and what you basically seem to agree to is that as a foreign entity you normally do not have obligations with the IRS. IRS requirements and obligations are for US entities. And if you are not a US company - even just a foreign subsidiary of a US-company - you normally shouldn’t have matters with the IRS at all and therefore you don’t have to issue whatever IRS forms to the people you pay. And that was the point that @jtolio was ‘complaining’ about. The amount of taxes to pay does not play a role at all here: > The United States has a rule that if node operators earn more than $600/year, > we need to file a 1099 for each of them. **Our current way of dealing with this** > **is manual and time consuming** , and so it would be nice to automate it. He also described what is all required to keep track of. The blueprint discusses a technical way to deal with the requirements, my thinking was about a legal way based on tax and company laws. Here is quick Google link that I found to backup my thoughts: > **[Do foreign entities in business with us firms/ consulting outfits have to...](https://ttlc.intuit.com/community/tax-credits-deductions/discussion/do-foreign-entities-in-business-with-us-firms-consulting-outfits-have-to-issue-form-1099/00/41487)** > > Solved: Do foreign entities in business with us firms/ consulting outfits have to issue form 1099? > “Do you know, if a foreign based company is not required to provide a 1099-misc, what form do you use to report income on your tax return? Thanks!” > > " **No, the IRS rules regarding Form 1099-MISC do not apply to foreign entities operating outside the US**. However, a foreign-based company with an office in the US would be required to prepare 1099-MISC under the IRS rules. As this link suggests, there is no obligation to issue (whatever) IRS forms or keep track of any of them for a foreign company. This could make running satellites and paying node operators much easier if you are not a US company as then it would fall under the sole responsibility of the node operators to report their earnings to whatever authorities they have to report it. All tech giants - thus my example with Microsoft - are operating multiple foreign subsidiaries for various reasons, so it is not considered tax evasion or even illegal per se. And if such a corporate construct could help to save valuable resources, then I see nothing wrong with thinking about such an option. But as I have said it before, to be legally on the safe side you would have to consult with an appropriate tax lawyer as international tax and company laws are tricky. [Previous page](https://forum.storj.io/t/gdpr-or-hippa-compliance/7050.md?page=1)