DEV Community

WeRumo
WeRumo

Posted on

Zero-Database & Privacy-First Relocation Platform: Complying with German GDPR and Automating with n8n

#architecture #privacy #gdpr #webdev

Introduction: Why Traditional Databases Are a Compliance Liability in Germany

When launching a relocation, housing, and business setup service in Germany, compliance with Articles 5 ("Principles relating to processing of personal data") and 17 ("Right to erasure / Right to be forgotten") of the European General Data Protection Regulation (GDPR / DSGVO) is paramount:

  • Passport and identity documents for notary appointments and trade office registrations;
  • Salary statements (Gehaltsabrechnungen) and SCHUFA credit records for apartment applications;
  • Official registration certificates (§ 17 BMG Meldebestätigung).

If you store these sensitive documents in a traditional relational database (PostgreSQL, MySQL, MongoDB) on an internet-facing server:

  1. You are legally required to maintain an exhaustive Record of Processing Activities (Verzeichnis von Verarbeitungstätigkeiten – VVT under Art. 30 GDPR).
  2. You must implement complex mechanisms to guarantee total physical deletion upon first request (Art. 17 GDPR) across tables, foreign keys, replicas, write-ahead logs, and database backups.
  3. Any SQL/ORM injection or cloud misconfiguration exposes you to direct liability and administrative fines of up to €20 million or 4% of worldwide turnover.

At WeRumo (headquartered in Riesa, Saxony, Germany), we took a radical engineering approach: we designed a web platform with a Zero-Database Architecture on both the frontend and backend, combined with session-isolated client application pipelines.

1. Zero-Database Concept: Static Delivery + Ephemeral Requests

The entire public-facing infrastructure is built with Next.js (App Router) using hybrid static generation (SSG):

  • Over 220+ authoritative guides and interactive calculators covering German immigration law, blue cards, apartment hunting, and taxation are rendered as pure static assets.
  • Zero SQL injection attack surface, zero database connection pool saturation, and zero server crashes during traffic spikes.
  • TTFB (Time to First Byte) under 40ms globally via high-performance European edge CDNs.

When an applicant submits an intake form for a relocation or business setup consultation:

[User Browser]
       │ (HTTPS POST + CSRF Protection + Edge Rate Limiting)
       ▼
[Next.js API Route (Edge Runtime)]
       │ Schema Validation (Zod) + Data Sanitization
       ▼
[Encrypted Transit (TLS 1.3)]
       │ Ephemeral Webhook Trigger
       ▼
[Isolated B2B n8n Worker (Self-hosted in EU / Hetzner Nuremberg)]
       │ PGP/GPG Payload Encryption & Routing
       ▼
[Instant Coordinator Dispatch (End-to-End Encrypted Telegram / Resend SMTP)]
       │
       ▼
[Worker Memory Flushed. Exactly 0 bytes stored on disk.]
Enter fullscreen mode Exit fullscreen mode

2. Stateless Orchestration with Self-Hosted n8n

To coordinate incoming cases and allocate client requests to our immigration and business specialists in Germany, we deployed a lightweight, self-hosted n8n instance in an ISO/IEC 27001-certified German data center (Hetzner, Nuremberg):

Core Security & Privacy Parameters in n8n: 

# Disable storage of execution history and payload data
EXECUTIONS_DATA_PRUNE=true
EXECUTIONS_DATA_MAX_AGE=0
EXECUTIONS_DATA_PRUNE_MAX_COUNT=100
EXECUTIONS_DATA_SAVE_ON_ERROR=none
EXECUTIONS_DATA_SAVE_ON_SUCCESS=none
Enter fullscreen mode Exit fullscreen mode

This guarantees that the HTTP payload containing applicant contact details never gets written to SQLite, PostgreSQL, or disk logs inside the n8n environment.

Transit-Only Processing

The workflow parses incoming JSON, formats an actionable summary card for the case manager on duty, delivers it via encrypted notification channels, and instantly garbage-collects the memory buffers.

3. Legal and Compliance Assessment: Why German Privacy Regulators Favor This Design

Under Article 25 of the GDPR ("Data protection by design and by default"):

  • Data Minimization (Datenminimierung, Art. 5(1)(c) GDPR): Since we do not maintain a web database storing customer files, those records cannot be exfiltrated in a web compromise.
  • Zero Third-Party Trackers & Cookies: The platform intentionally runs without advertising beacons, Google Analytics, or third-party pixels. Visitors enjoy immediate page rendering without obstructive cookie consent walls, drastically optimizing LCP (Largest Contentful Paint).

4. Operational Results & Key Takeaways

  1. Lighthouse Performance & SEO: 98–100 across Performance, Accessibility, Best Practices, and SEO.
  2. Eliminated Data Breach Exposure: A server intrusion reveals only static HTML/JS assets and public configuration templates.
  3. Seamless Multi-Language Scale: Operating four localized versions (German, English, Ukrainian, Russian) requires no database migrations or schema drift management.

Our engineering journey at WeRumo proves that modern European B2B/B2C relocation and consulting platforms can achieve world-class speed, reliability, and ironclad GDPR compliance without bloated infrastructure costs.

Explore our immigration and relocation guides or book a consultation:

Top comments (0)