GDPR-Compliant Remote Access for MSPs: EU Hosting, Audit Logs, and No Third-Party Routing

Every MSP operating in the EU handles client data that falls under the GDPR, usually the moment an engineer opens a session. When you RDP into a client server, reach a clinic's imaging system, or open a law firm's file store, you are processing personal data on that client's behalf. The GDPR does not ban remote access. It expects you to secure it, log it, and keep it out of the hands of third parties you cannot vouch for. Most mainstream remote support tools make at least one of those three harder than it should be.

What the GDPR Actually Requires of a Remote Access Tool

Three parts of the regulation do most of the work here:

• Article 32 (security of processing) expects appropriate technical measures: encryption in transit, access control, and multi-factor authentication where feasible.
• Article 5(2) (accountability) means you must be able to demonstrate who accessed what and when. An audit trail is not a nice-to-have, it is how you prove the measures under Article 32 were actually in force.
• Chapter V (international transfers) makes routing personal data through servers outside the EU or EEA a question you have to answer, usually with extra paperwork such as standard contractual clauses and a transfer risk assessment.

A remote access session touches all three. It carries personal data, someone needs to be accountable for it, and the path that data travels matters.

Where Mainstream Tools Create Friction

TeamViewer, AnyDesk, and Splashtop route sessions through their own global infrastructure, frequently including US-based points of presence. That is convenient for connectivity and inconvenient for Chapter V: your client's data now transits a third party outside the EEA, and you have to account for it. Both TeamViewer and AnyDesk were breached in 2024, which is exactly the kind of event Article 32 asks you to guard against.

Agent-based tools add a second problem. Every device that runs a remote control agent is another component processing personal data, another vendor in your processing chain, and another attack surface to keep patched. For an estate of NVRs, servers, and appliances, that is a lot of agents to account for.

How ProxyLink Fits the Requirements

ProxyLink was built EU-first, and the architecture lines up with the three obligations above.

• EU hosting, no third-party routing. The relay runs on Hetzner infrastructure in Germany. Sessions do not traverse a US CDN or a vendor's global remote-access network. There is no third party in the path to account for under Chapter V.
• Encryption on an open protocol. The transport is WireGuard, a modern, audited, open VPN protocol. You are not trusting a proprietary black box for the encryption that Article 32 expects.
• Multi-factor authentication. Two-factor authentication is available on every account, so engineer access to client systems is not protected by a password alone.
• A real audit trail. Every session is logged with engineer identity, target IP and port, timestamp, and duration. RDP and SSH sessions can be recorded per link. That is the accountability record Article 5(2) asks for.

Data Minimisation: The No-Agent Advantage

The GDPR favours doing more with fewer moving parts, and ProxyLink's model is naturally lean. You install one WireGuard tunnel on the client site's router or gateway. Nothing is installed on the individual devices you reach. That means no per-device agent collecting or transmitting data, fewer components in your processing chain to document in a DPA, and a smaller attack surface overall.

It also closes the exposure that port forwarding creates. Because the tunnel dials outbound and holds itself open, the client network keeps zero open inbound ports. A scan of the site's ISP range finds nothing to connect to, so the systems holding personal data stay dark to the internet. Kernel-level WireGuard peer isolation keeps one client's tunnel from ever reaching another's, so a shared platform never becomes a shared blast radius.

What a Tool Cannot Do For You

Be clear-eyed here: no product makes you GDPR-compliant on its own. You still need a data processing agreement with each client, a lawful basis for the processing, a defined retention policy, and staff who follow it. What ProxyLink gives you is infrastructure that supports those obligations instead of working against them: EU data residency, encryption, MFA, an audit trail, and a data-minimising architecture. The compliance work is yours; the tooling should not make it harder.

Try ProxyLink free at app.proxylink.dev, no card required, free during early access. One tunnel per client router, every device reachable from a browser, every session logged. Setup guides for MikroTik, pfSense, OPNsense, and OpenWRT are in the docs.