Why is Qualifio doing this move?

From its early days Qualifio has been working with OVH as almost exclusive cloud infrastructure provider.

OVH is not a small player. It's one of the largest hosting companies in the world with 24 data-center in Europe, North America & Asia. It's valued at between 3.5 et 3.75 billion euros and it's the 1st European hosting company.

While we are generally happy with the relationship, there is a series of obvious shortcomings in using a single provider:

Redundancy: although we build our infrastructure with redundancy at all levels, a global outage at supplier level cannot be excluded and cannot be compensated for. We had an example of this in the recent history. Moving to a multi-cloud approach is the only way to offer some protection against these types of events;
Technology expertise: all cloud providers have specialised in certain kinds of services and some are way more mature for some technologies. AWS created the S3 object storage API (now ubiquitous and de facto standard for storing files in the cloud) and is still arguably offering the best, most feature-rich service;
New locations: as our services are expending internationally, we need to be able to get closer to our clients and participants to ensure the best possible user experience. OVH alone is currently not covering all the locations in the world where we might be tempted to deploy our infrastructure.

Will my data be stored outside EU?

No. EU customers will always be served and have their data stored in a EU located data center.

But technically due to the end of the EU-US privacy shield, a US-based company offering hosting services in the EU may still be compelled by the US authorities to reveal part of their data to them.

For this reason, from a pure legal standpoint, these new sub-processors must be treated as EU-US data transfer.

From our point of view this is a theoretical position as:

These suppliers have taken a strong position about how they intend to deal with such inquiries from the US authorities;
Qualifio will take additional organisational and technical measures to limit the possibility of any practical use of this data;
There is no reason to believe that in the short/medium term an agreement cannot be found between the EU and US authorities to restore legal certainty.

Will you migrate all my data to AWS or Azure?

No, not at all. We will start to use a few selected services from one or both of these two cloud providers mostly to:

Implement new features or revamp existing features on top of Azure/AWS services bringing values to Qualifio;
Increase redundancy of new or existing services.

A complete "lift and shift" of the whole infrastructure to AWS or Azure is not what we aim at.

Will my data be less secured / protected?

No. Actually quite the opposite!

As explained in "Why is Qualifio doing this move", the aim is to improve redundancy, performance and to get closer of our clients. The benefit will obviously not be instant but on the long run a better redundancy actually means that your data and your investment in Qualifio is better protected.

Of course we will be doing all this without sacrificing anything in terms of other protective measures. Our servers and databases will be as secure as before wherever they execute.

Needless to say, both Azure and AWS implements the highest physical and electronic security standards.

What are the advantages for me as a client?

On the long run, these new partners will allow Qualifio to offer you a better services, with even less risk of outage and closer to the location of your audience.

I am still concerned by this decision, what can I do?

If you need more explanations about these changes, contact DPO@qualifio.com and we will make sure you receive all the answers your need.

Sub-processor update