---
layout: post
title: Appwrite is now GDPR compliant
description: At Appwrite, we take your data seriously. Therefore, we are excited to announce that Appwrite is now GDPR Compliant.
date: 2024-01-09
cover: /images/blog/announcing-appwrite-is-gdpr-compliant/GDPR-Announcement.avif
timeToRead: 3
author: may-ender
category: security, announcement
faqs:
  - question: "What is GDPR and who does it apply to?"
    answer: "The General Data Protection Regulation is the European Union's data protection law. It applies to any organization that processes the personal data of people in the EU, regardless of where the organization itself is based. GDPR sets requirements around lawful basis, consent, data subject rights, breach notification, and the use of processors and sub-processors."
  - question: "What does Appwrite's GDPR compliance cover?"
    answer: "Appwrite Cloud meets GDPR requirements for the platform side: how personal data is encrypted, who can access it, how it is backed up, and how breaches are handled. Appwrite acts as a processor on behalf of you, the customer, who is the controller for your own end-user data."
  - question: "How do I sign a Data Processing Agreement with Appwrite?"
    answer: "Open your organization settings in the Appwrite Console and click the DPA download button. Sign the document and the agreement is implemented automatically. The DPA also covers Appwrite's relationship with its own vendors, so sub-processors are bound by equivalent terms."
  - question: "How does Appwrite encrypt customer data?"
    answer: "Data in transit is protected by TLS/SSL, and data at rest in databases and file storage is encrypted using industry-standard algorithms like AES. Encryption keys are rotated at regular intervals as part of Appwrite's security operations."
  - question: "Is self-hosted Appwrite GDPR compliant?"
    answer: "When you self-host, you act as the controller and processor at the same time. Appwrite gives you the technical building blocks (encryption, access controls, audit logs), but GDPR compliance ultimately depends on how you configure your environment, retention policies, and access procedures."
  - question: "Where can I read Appwrite's privacy policy and security documentation?"
    answer: "The [Appwrite GDPR documentation](/docs/advanced/security/gdpr) covers how compliance is implemented in practice. You can also review the [privacy policy](https://appwrite.io/privacy) and [cookie policy](https://appwrite.io/cookies) for details on how Appwrite's own website and Cloud product handle personal data."
---

We have always kept strict internal policies with regard to personal data and privacy. But to be GDPR compliant, one must undertake the necessary steps and show proof. We have done this and are pleased that we are now certified with the European General Data Protection Regulation (GDPR) standards.

Appwrite developers will no longer have to navigate the complex waters of GDPR compliance, we've got you covered. We have undertaken the necessary measures to protect personal information. Our policies, procedures, and infrastructure have been updated, and we are committed to a continuous improvement cycle as time goes by.

If you are interested in having a data processing agreement with Appwrite, you can now find our DPA download button in our console. Click and sign it, and the agreement will be implemented.

![Download DPA from your organization's settings](/images/blog/announcing-appwrite-is-gdpr-compliant/dpa-card.avif)

Here are some technical insights into how we enhance data security:

- Appwrite implements a multi-layered security approach, integrating centralized IAM (Identity and Access Management) to regulate access to production resources.
- Cloud security processes are employed for provisioning, configuring, monitoring, and accessing cloud resources. Changes in production environments follow a controlled process using Infrastructure as Code (IaC).
- Industry-standard encryption protocols like TLS/SSL safeguard data transmitted over networks. Additionally, data stored in databases and file storage is secured using techniques like AES encryption. Key rotations are performed at regular intervals to ensure data security.
- Appwrite performs regular security audits at the application and infrastructure layers to ensure compliance with industry-leading security standards and practices. Periodic vulnerability scans are also conducted on software dependencies and packages to mitigate against CVEs.

As always, with Appwrite, developers can continue creating with peace of mind. Your personal data will not be mistreated.

Appwrite is also [HIPAA](https://appwrite.io/docs/advanced/security/hipaa) and [SOC 2](https://appwrite.io/docs/advanced/security/soc2) compliant as of April 24th, 2024.

Further resources: [Documentation](https://appwrite.io/docs/advanced/security/gdpr), [Privacy policy](https://appwrite.io/privacy) , [Cookie policy](https://appwrite.io/cookies)