-min.webp)
The General Data Protection Regulation, DSGVO for short, does not allow personal data to be stored or processed on US servers. This makes it difficult to use tools from the US, such as Bubble.io. In this article, we will show you how to make Bubble.io compliant with the GDPR.
Note: This article does not constitute legal advice. Our research has been done to the best of our knowledge and belief, but of course cannot guarantee one hundred percent correctness and completeness. Therefore, we do not assume any liability for the content. Please have your own individual case checked by a legal expert.
The three most important factors you need to pay special attention to with regard to the GDPR are databases, authentications and tracking or cookies. Personal data is processed in these 3 places. In the following, we will present you with various alternatives to ensure that either no personal data is stored and processed, or if it is, then only on an EU infrastructure and servers.
The problem from a privacy perspective with Bubble is the custom PostgreSQL database in each project created. This database, like Bubble itself, is hosted on the Amazon Web Services infrastructure. According to various forum posts, it is the aws-us-west-2 region, i.e. in the USA.
Applications that are operated in a DSGVO-compliant manner must resort to alternatives. The advantage is that integrating an external database into Bubble is relatively easy. Through the free SQL Connector and API Connector plugins provided by Bubble, a variety of backend systems can be connected.
SQL databases are based on a relational database model, which is a simple and intuitive way to store data in tables. If you have already used Bubble for several projects, you already know the principle very well.
There are different types of SQL databases, all of which can be operated either in-house or with a cloud service. You should only put your own database server into operation if you can provide the corresponding infrastructure, security and performance. The most popular SQL database systems include MySQL, PostgreSQL and MSSQL (Microsoft SQL).
It's best to use one of the following cloud services here:
The connection to your Bubble app works via the SQL Connector plugin. For this, Bubble needs the connection string to the database, i.e. the address at which your database is accessible. There are different authentication methods, but the most common one is a defined database user. Make sure that your data is transferred encrypted.
You can find out more about connecting SQL databases via the SQL Connector plugin here.
You only understand station? Then check out our free preview of our Bubble Masterclass!
Another database system that can be integrated into your Bubble App is MongoDB. This is a document-oriented database system that was created for extremely scalable data volumes. This is already derived from the name: "Mongo" abbreviation from Humongous, in German "gigantic". Data is stored in JSON documents. Javascript Object Notation is a compact data format with easily readable text content, which is used for the exchange between applications. Unlike relational databases such as SQL databases, MongoDB uses a flexible data schema. Fixed data structures, as known from SQL tables, are therefore optional.
The connection to your Bubble App works in this case with the API Connector Plugin. MongoDB provides corresponding API endpoints for your created collections.
You can find providers of MongoDB at the developer directly or at IONOS.
In addition to the various database systems, there are also various cloud services that can serve as a backend for your Bubble application. They can all be connected to your application via the API Connector plugin.
Authentication ensures that the identity of a user can be proven and verified against a system. This requires the exchange of sensitive data. To ensure that this data is not processed and stored on US servers, the following options are available.
According to Auth0, data from European customers is processed exclusively on EU servers, primarily in Germany, with Ireland as a failover alternative.
You can link to Auth0 via the Bubble Plugin or the Bubble API Connector.
Users are then directed to an Auth0 login screen for authentication. There, they can register or log in, and an access token then forwards the data to the web app.
Another possibility for authentication is the integration of an own API endpoint in Xano. For this you need a user table, in which the user data incl. password are stored.
In Bubble, you can include the forms for registration and login for the integration of Xano as usual. When the user clicks on the button, the data is sent to Xano via the API and the tool returns an authentication token. This is then stored as a cookie in the Current User for as long as the session exists.
For the DSGVO compliance of the tracking functionality and the cookie banners, there are a few different options that I would like to present to you below:
When a bubble app is launched in the browser, a user session is created. In this user session, a temporary user is created. This user is assigned the status "not logged in".
This temporary user behaves like a registered user, he can change and save attributes.
For example, the query of a user's age can be made before registration. When this user later creates an account, the age is stored in the temporary user. In the bubble workflow, you simply save the value for the "Current user".
Then when it registers, you can pass the value from the temporary user to the created account in the background.
So if the user comes back to your site later and has not deleted any cookies in the meantime, the user will have all the properties as in his last session, in this example the age. Bubble automatically deletes these temporary users after 3 days. When the user comes back to your site, a new temporary user is created.
With the above mentioned ways, you are on the right track. If data is only stored on EU servers and the cookie banner works correctly, your web application should be GDPR compliant. However, you should always seek advice from a legal expert to be sure.
The EU and the USA are currently working on the Trans Atlantic Data Privacy Framework as a new version of the Privacy Shield Agreement. Data transfers to the USA should then be possible with a new set of rules and binding protective measures. However, it will still take a while before this is the case.
Start for free with our Bubble Fundamentals course and learn how to develop your own websites and web applications.
