Fonts, CDNs, and Hosting: The Cross-Border Data Transfers No One Notices
A developer running a service that processes third-party contracts paid close attention to Russia's 152-FZ personal data law. All documents, forms, and logins were routed to a Russian server, which he verified multiple times. When he examined the website itself rather than the backend service, he found three foreign companies receiving data on every visit.
The site used Vercel, a U.S. hosting provider, so every page load exposed the visitor's IP address, browser details, and visited pages. Google Fonts were loaded on all 33 pages, causing browsers to connect directly to Google servers. Two PDF and Word libraries on the contract verification page were served from cdnjs, operated by Cloudflare. Although contracts themselves stayed in Russia, technical visitor data left the country.
Why this counts as cross-border transfer
Article 12 of 152-FZ defines trans-border transfer as any transmission of personal data to a foreign entity. Regulators treat IP addresses combined with cookies, browser fingerprints, and visit history as personal data. A 2022 German court ruling (Landgericht München I, 3 O 17493/20) already awarded compensation to a visitor whose IP was sent to Google Fonts without consent; Russian authorities apply similar logic.
Since March 2023, operators must file a separate notification with Roskomnadzor before any cross-border transfer. Transfers to the United States or EU require a ten-working-day waiting period during which the regulator may block or restrict the transfer. Failure to notify falls under Article 13.11 and carries fines of 150,000–300,000 rubles for legal entities. If forms collect names, phones, or emails on foreign platforms, additional localization violations under part 8 can result in fines of 1–6 million rubles.
Common hidden vectors
- Hosting and CDN: Vercel, Netlify, GitHub Pages, Firebase, and Cloudflare in proxy mode decrypt traffic and see full request data.
- Fonts: Google Fonts and Adobe Fonts loaded via a single link tag on every page.
- Libraries: cdnjs, jsDelivr, unpkg, and Google Hosted Libraries for jQuery, Bootstrap, or PDF readers.
- Analytics and pixels: Google Analytics, Microsoft Clarity, and Hotjar that record clicks and session replays.
- CAPTCHA: reCAPTCHA sends behavioral data to Google on every load.
- Embedded content: YouTube videos, Google Maps, and foreign chat widgets that load even when unused.
- Forms and email: Google Forms, Typeform, Mailchimp, and SendGrid that store submissions abroad.
The developer identified external domains with one console command that extracted all resource hosts from the performance timeline. He then downloaded Inter and Fira Code fonts (256 KB total), hosted pdf.js and mammoth.js locally (2 MB), moved the site to a Russian server, and rewrote the privacy policy to reflect the changes. Only technical Telegram alerts without personal data remain on a foreign platform.
Operators who still need foreign services are advised to submit both processing and cross-border notifications, minimize data sent abroad, and document the arrangement transparently in their privacy policy.
Related articles
MinTsifry Proposes Requiring Telecom Operators to Install SORM Equipment Before Obtaining Licenses
The Russian Ministry of Digital Development plans to introduce legislation obligating telecom operators to deploy SORM surveillance systems prior to receiving operating licenses. Under the proposed rules, companies will only be permitted to begin serving subscribers after the equipment has been installed and handed over to law enforcement agencies. Non-compliance could result in license revocation through an extrajudicial administrative process. Current regulations allow operators to obtain licenses with a network diagram that merely indicates planned or existing SORM components. The change aims to close loopholes exploited by unscrupulous providers that repeatedly register new legal entities to operate without surveillance capabilities. Industry experts note that the minimum cost of a basic SORM complex starts at 5 million rubles, which could disproportionately affect smaller local providers without a transition period or scaled requirements.
GOST R 57580 Compliance: Defining Assessment Scope to Verify Real Protection in Financial Organizations
Financial institutions often maintain extensive documentation on information security yet still fail GOST R 57580 assessments due to mismatches between documented processes and actual infrastructure. The standards GOST R 57580.1-2017 and GOST R 57580.2-2018 set distinct requirements for protection levels and evaluation methodology. Correct application begins with identifying the organization's regulatory category under Bank of Russia rules such as Regulation 851-P for credit institutions or Regulation 757-P for non-credit financial organizations. Defining the precise assessment boundary is critical, including systems, remote access channels, virtualization components, and third-party interactions. Organizations must also distinguish between the full assessment scope and the representative sample selected for verification. Evidence collection requires both policy review and technical confirmation that controls function as intended across the evaluated environment.
Evaluating Secure Development Maturity: Comparing BSIMM, DSOMM, SAMM and GOST R 56939-2024
A detailed analysis compares four methodologies for self-assessing secure software development maturity in Russian companies. The review covers BSIMM from Black Duck, OWASP DSOMM, OWASP SAMM and the updated Russian national standard GOST R 56939-2024. Each model was tested through a simulated audit on a fictional company called ООО «Лиса и лосЬ» that uses GitLab, Nexus and SonarQube. The evaluation scored the methodologies on criteria including ease of maturity calculation, recommendation generation, roadmap building, heat-map creation and SDLC coverage. GOST R 56939-2024 and SAMM received the highest total scores of 35 and 34 out of 47. The article concludes that no single methodology covers all needs and recommends combining approaches tailored to specific company contexts.
GlobalSign Launches New Wave of SSL/TLS Certificate Revocations Targeting Russian Organizations
GlobalSign has initiated another round of revocations affecting SSL/TLS certificates issued to Russian websites, with a total of 11,000 certificates withdrawn from 1,300 organizations so far. The revocations primarily impact entities listed in EU and US sanctions regimes, in line with updated CA/Browser Forum requirements that took effect in May 2026. Greek CA HARICA has also participated in the revocations, sometimes completing the process within seconds and leaving site owners little time to respond. The actions stem from mandatory checks against the OFAC SDN List, BIS Denied Persons List, and equivalent European sanctions databases. Russian authorities recommend obtaining domestic TLS certificates via Gosuslugi within three business days to maintain secure access in foreign browsers. Let's Encrypt has similarly updated its policies to restrict certificates for sanctioned Russian entities while continuing issuance for others.