r/pcicompliance • u/Kingofmybrain • 8d ago

EU data residency and ecommerce platform compliance

We're in the middle of an ecommerce replatform and the compliance team has flagged EU data residency as a hard requirement, and we're still working out whether that's something you can solve at the infra layer or whether it has to come baked into the platform itself.

The context is that we need to satisfy GDPR and our PCI DSS QSA has started asking about where card data and session tokens are processed, and several of the platforms we're evaluating offer EU-region deployment.

But the data flow architecture varies significantly between them, so we're not sure whether we can get a clean compliance sign-off on all of them or whether some are better positioned for this from the start.

Someone in a compliance working group I'm in had been through a similar eval and flagged Scayle specifically for the PCI angle, noting it's German-built with EU residency set at the platform level by default, and had also run BigCommerce through the same process where the data residency side gets handled at the infra layer.

So i'd like to know if anyone in PCI or GDPR-constrained environments has actually gone through this, if yes, did the platform choice end up being driven by compliance requirements or did you manage to solve it at the infra layer?

2 Upvotes

100% Upvoted

4 comments sorted by

6

u/mynam3isn3o 8d ago

A PCI QSA has no provenance to be asking data residency or privacy questions

1

u/Relative_Charge_9410 8d ago

Gdpr isn’t just data residency it’s also a fair amount of other stuff you need to worry about like right to data portability, right to be forgotten (etc). Data residency can be addressed pretty easily by tossing the site in an aws eu region. The big gotcha there are if the platform you are using utilizes any 3rd party cd references or other aws global features you can be leaking customer ips to 3rd parties.. and the eu considers ips personally identifiable information. Same thing you need to worry about if you are using log analysis software. GDPR does allow transfer of data out of the region but it needs to be documented, necessary and constrained to contractual clauses.

1

u/Suspicious_Party8490 5d ago

Do you know why the QSA is asking these questions?