TrueNAS Made in USA: Honestly Assessing the Data Privacy Debate for EU Customers

Few topics get German IT circles as heated as the question: “Are we even allowed to use software from the US if we want to be GDPR-compliant?” With TrueNAS — developed by iXsystems, headquartered in San Jose, California — this reflex comes up regularly. Some consultants advise against it wholesale, others wave the topic through without any review. Both are unprofessional. At DATAZONE we have worked with TrueNAS in SMB environments for over a decade, and this article aims to provide an honest, technically grounded assessment.

The short version up front: from a GDPR perspective, TrueNAS is one of the least problematic storage solutions on the market — provided you understand what actually matters, and cleanly separate hardware operation from contractual side stages. The following sections explain what the CLOUD Act really regulates, what data flows to iX exist (spoiler: none by default), and which details to check when buying and operating the system.

CLOUD Act: What it regulates — and what it does not

The US CLOUD Act of 2018 allows US authorities to demand data from US companies that they “own, possess or control” — regardless of the physical storage location. That is the core of GDPR concerns and the reason cloud offerings such as Microsoft 365 or AWS are viewed critically in public-sector circles.

The decisive point for TrueNAS users: the CLOUD Act applies to data processors that actually have access to the data. With a TrueNAS server operated in your server room in Neuburg, Ingolstadt or Munich, iXsystems has no access whatsoever. There is no “master key”, no exfiltrated copy, no cloud connection out of the box. The company in San Jose could not hand over your backups to the FBI even if it wanted to — it simply does not have them.

This fundamentally distinguishes TrueNAS from SaaS offerings. A US hyperscaler hosting your VM or object bucket in Frankfurt is fully subject to the CLOUD Act. A US software vendor whose product you operate on-premises is not subject to it for your data. This distinction is legally clear and is also reflected in the EDPB’s recommendations on third-country transfers.

What flows to iX by default — and what does not

TrueNAS SCALE (currently 25.10 “Goldeye”) is explicitly configured so that no payload data and no identifying metadata leave the system. After installation you can verify this yourself with tcpdump or on your OPNsense firewall:

Data flow	Default	Controlled via
Update check (train info)	Active, only reports version state	System → Update → “Check for Updates” can be disabled
Usage statistics	Active, anonymous hardware info	System → General → “Usage collection” can be disabled
Cloud sync targets (S3, B2, Wasabi)	Only if manually configured	Data Protection → Cloud Sync
TrueCommand connection	Only if manually activated	System → TrueCommand
NTP to pool servers	Active, no payload data	System → General → NTP Servers

For environments with high compliance requirements, at DATAZONE we typically disable usage collection and automatic update checks and run the appliance with fully egress-filtered firewall rules. A TrueNAS without internet egress works flawlessly; updates are then imported manually via signed update files.

Source-available and auditability

Unlike closed NAS systems — for instance from vendors that do not publish their firmware source — TrueNAS is based on openly viewable code. The core (kernel, ZFS, middleware, web UI) is available on GitHub under the iXsystems organisation. Anyone can inspect what network connections the middleware opens, which logs are written, and how the permission model is implemented.

From a data protection perspective this is an enormous advantage. You do not have to “trust” a US company that no back door exists — you can verify it yourself or have it audited by a third party. For customers in regulated sectors (law firms, tax advisors, healthcare, critical infrastructure) this is exactly the decisive point that we can document in compliance reports.

A practical example: in a customer project for a tax advisory firm, we had to prove during the data processing agreement review that no client data leaves the local network. With a closed SaaS storage this would have remained a matter of trust. With TrueNAS and documented egress filtering on the OPNsense, the proof was produced within a few hours and documented in an audit-ready form.

Where EU customers should still pay attention

To be fair: not every aspect is trivial. There are three areas where the US connection raises real questions.

1. Support contracts and Silver/Gold support. If you sign a commercial support contract with iXsystems or a reseller, the support engineer may — as part of a ticket — access your system (typically via a signed WireGuard tunnel and a one-time release token). Legally this is a third-country transfer and requires a proper data processing agreement with EU standard contractual clauses. At DATAZONE we therefore offer first- and second-level support inside the EU and only involve iX as third level in exceptional cases — then with a documented customer approval.

2. Enterprise licence activation. TrueNAS Enterprise (the commercial variant with HA, Fibre Channel and extended support) requires a licence that is technically registered with iX. This registration contains a serial number and customer ID, no payload data. The Community Edition (TrueNAS SCALE Community, free of charge) has no such registration.

3. Third-party apps in the app catalogue. SCALE ships with a catalogue of dockerised applications (Nextcloud, Immich, Plex, …). Their data privacy behaviour depends on the respective project and is independent of iX. Anyone who configures these carelessly — for example Plex with an active cloud login — creates their own US data link, regardless of the operating system underneath.

A concrete configuration checklist

For customers seeking maximum GDPR cleanliness, we work with the following baseline:

# Egress whitelist on the firewall (OPNsense example)
allow  truenas -> ntp.example.de:123    # NTP
allow  truenas -> update.example.de:443 # internal update mirror
deny   truenas -> any                   # everything else blocked

# TrueNAS system (System → General)
Usage collection:      DISABLED
Update check:          DISABLED (manual)
Console messages:      LOCAL only
NTP:                   internal pool servers

# System → Advanced
Autotune:              DISABLED
Serial console:        internal only

This is complemented by documented backup targets — typically a second TrueNAS at a branch site via replication or a backup chain following 3-2-1 with local tape or encrypted object storage at an EU provider. No “cloud sync to AWS US-East” without an explicit customer instruction.

Conclusion: No contradiction, but attention to detail

Using TrueNAS from the US is unproblematic from a GDPR perspective, provided you understand the difference between “software origin” and “data processing”. The hardware sits with you, the data sits with you, iX has no access — that is the core. The remaining topics (support access, enterprise registration, third-party apps) can be handled if they are addressed deliberately.

Anyone who instead reaches for a European closed-source NAS “because it’s from Europe” usually buys inferior verifiability — and has to trust the vendor’s firmware behaviour just as much, only without source-code insight.

DATAZONE supports you in designing your storage infrastructure in a GDPR-compliant way — from egress filtering to support contract structuring to audit-ready documentation for your data processing agreement. Get in touch: contact the DATAZONE team.