Sasha Ehrlich
Compliance · EU residency
Writing for Elido since September 2024
Sasha leads compliance and EU data residency posture at Elido. They previously spent four years as a privacy associate at a Frankfurt-based commercial law firm advising SaaS exporters on Article 28 data processing agreements and Schrems II remediation, and a year as data protection counsel at a Berlin fintech.
They write the compliance posts — GDPR Article 3 territorial scope, ISO 27001 vs SOC 2 Type II in EU procurement, sub-processor disclosure obligations — and review every other post for compliance claims that need toning down. If a claim about "GDPR compliant" sneaks past Sasha, it's because the post was published on a Friday afternoon.
Sasha sits on the editorial committee for an EU-focused privacy newsletter and is a non-practising solicitor (England & Wales).
Expertise
- GDPR territorial scope and Article 3 application
- Schrems II remediation and EU-US data transfer mechanics
- ISO 27001, SOC 2 Type II, HIPAA BAA flow
- Sub-processor disclosure and DPA drafting
Posts by Sasha Ehrlich
Mixpanel EU Data Residency: Hosts, Dropped Events, GDPR
Mixpanel EU data residency explained: which ingestion host each region uses, why events sent to the wrong one vanish, and what it means for GDPR transfers.
ComplianceHomograph Attack: Spot Punycode and Lookalike Domains
A homograph attack swaps look-alike characters into a domain, and punycode (xn--) is how it travels. Here is how to spot one before you click.
ComplianceExport Short Link Data: The Four Things You Can Take
A shortener holds four data classes, but only two travel reliably: what you can export short link data for, and how to verify a full pull before you trust it.
MigrationQR Code Accessibility: WCAG, Contrast and Alternatives
A QR code is an image with no text alternative and a target nobody can tab to. What accessibility rules expect, and the printed fallback that fixes most of it.
ComplianceClick Data Retention: How Long to Keep Link Analytics
GDPR gives no number for click data. How to set retention windows per data class, what Elido stores today, and how to delete without losing reporting.
ComplianceQR Codes and GDPR: What a Scan Collects and What You Owe
QR codes and GDPR: the printed code collects nothing, the redirect processes an IP address, which is personal data. What that means for basis and retention.
ComplianceEvent Ticket QR Code Fraud: How to Prevent Screenshots
Event ticket QR code fraud runs on screenshots of static codes. Dynamic single-scan codes, rotating codes, and signatures stop duplication. How each works.
IndustriesDigital Product Passport QR Code: What the ESPR Requires
A digital product passport needs a data carrier, not a QR code by name. What the ESPR says, the February battery deadline, and where a durable QR resolver fits.
ComplianceCookie Consent for Short Links: What the EU Requires
Need cookie consent for short links? A DPO explains when redirect tracking triggers ePrivacy consent, and when a cookieless setup with EU storage avoids it.
ComplianceBitly Assist AI: What It Does With Your Click Data
Bitly Assist is an AI chat over your link and QR data. What it does, and the DPO question about where your EU click data actually gets processed.
ComparisonsIs Google Analytics GDPR Compliant? EU Answer
Is Google Analytics GDPR compliant? It is not banned, but EU regulators ruled it broke GDPR by sending data to the US. What changed since, and what to do.
ComplianceIs Bitly GDPR Compliant? A DPO's Honest Answer
Is Bitly GDPR compliant? It has a DPA, SCCs and Data Privacy Framework certification. Compliant, yes, but not the same as EU-only data residency.
ComplianceEU Alternatives to US SaaS: A Vendor-Checked Guide
EU alternatives to US SaaS, checked against vendor pages: who is actually European, the CLOUD Act vs GDPR conflict, and a five-question test for any tool.
ComplianceAre QR Codes Safe? Quishing and How to Stay Protected
QR codes are safe to scan - the risk is where they lead. How quishing works, how to spot a malicious QR code, and what to do if you scanned a fake one.
ComplianceThe best EU URL shorteners in 2026 (and why it matters)
Which URL shorteners actually host in the EU, what their sub-processor lists look like, and how to read a residency claim against the underlying infrastructure
ComparisonsAre URL Shorteners Safe? What Scanning Does and Misses
Reputable URL shorteners are safe, but a redirect can hide a bad destination. What provider scanning catches, what it misses, and how to check a link.
ComplianceGDPR for URL shorteners: what your DPO actually wants to see
A working DPO's read on the GDPR articles that apply to URL shorteners - Articles 3, 6, 28, 30, 32, 35, sub-processor disclosure, and the DPA clauses
ComplianceCornerstoneSOC 2 and HIPAA for a URL Shortener: What to Ask For
Elido has no SOC 2 report or ISO 27001 yet. What a buyer should request from any URL shortener for SOC 2 and HIPAA, and what Elido can show today.
ComplianceConsent Mode v2 for link tracking: what the DMA changed
Consent Mode v2 and the Digital Markets Act rewrote short-link analytics: what the four signals mean, how server-side recovery works.
ComplianceElido vs Cuttly: EU URL shorteners, where each wins
Both Elido and Cuttly keep your link data in Europe. Where they differ - SSO tier, audit log, API, published controls - decides which is right for you.
ComparisonsSCIM and SSO for Marketing Tools: What Enterprise IT Asks
SSO and SCIM for SaaS, the procurement-checklist version: SAML 2.0 vs OIDC, IdP compatibility, deprovisioning as audit artefact, the marketing-tool gap.
FeaturesSchrems II and Tracking Pixels: Where the DPF Leaves You
Schrems II killed Privacy Shield; the EU-US Data Privacy Framework restored adequacy in 2023. What that means for tracking pixels under GDPR Article 44+.
ComplianceEU data residency for marketing tools: a DPO checklist
What EU data residency covers for link tracking and conversion forwarding, where marketing stacks leak EU data, and eight answers to get from vendors.
ComplianceCookieless Attribution Explained: What Still Works
Third-party cookies are fading and script-set cookies expire fast. Which attribution paths still hold, what they cost you, and where consent still applies.
ComplianceSafari ITP and click attribution in 2026: what still works
Every ITP version broke another tracking workaround. The full timeline, what each change killed, and the server-side redirect pattern that survives them all.
ComplianceWebhooks vs Polling: Click Tracking Webhooks Compared
Webhooks vs polling for click tracking: lag and request maths, retries, idempotency and signatures, plus a decision table and Node code that we ran.
IntegrationsURL shortener security checklist: 10 controls to verify
Ten security controls to check before you trust a URL shortener: threat-feed scanning, signed webhooks, key hashing, rate limits, audit logs and takedowns.
ComplianceGDPR-Friendly URL Shortener: 10 Checks Before You Sign
A GDPR-friendly URL shortener needs a DPA, minimal click data, erasure and no pixels at redirect. Ten contract checks, and where Elido falls short.
Compliance