Zero-Database & Privacy-First Relocation Platform: Complying with German GDPR and Automating with n8n

Introduction: Why Traditional Databases Are a Compliance Liability in Germany

When launching a relocation, housing, and business setup service in Germany, compliance with Articles 5 ("Principles relating to processing of personal data") and 17 ("Right to erasure / Right to be forgotten") of the European General Data Protection Regulation (GDPR / DSGVO) is paramount:

• Passport and identity documents for notary appointments and trade office registrations;
• Salary statements (Gehaltsabrechnungen) and SCHUFA credit records for apartment applications;
• Official registration certificates (§ 17 BMG Meldebestätigung).

If you store these sensitive documents in a traditional relational database (PostgreSQL, MySQL, MongoDB) on an internet-facing server:

1. You are legally required to maintain an exhaustive Record of Processing Activities (Verzeichnis von Verarbeitungstätigkeiten – VVT under Art. 30 GDPR).
2. You must implement complex mechanisms to guarantee total physical deletion upon first request (Art. 17 GDPR) across tables, foreign keys, replicas, write-ahead logs, and database backups.
3. Any SQL/ORM injection or cloud misconfiguration exposes you to direct liability and administrative fines of up to €20 million or 4% of worldwide turnover.

At WeRumo (headquartered in Riesa, Saxony, Germany), we took a radical engineering approach: we designed a web platform with a Zero-Database Architecture on both the frontend and backend, combined with session-isolated client application pipelines.

1. Zero-Database Concept: Static Delivery + Ephemeral Requests

The entire public-facing infrastructure is built with Next.js (App Router) using hybrid static generation (SSG):

• Over 220+ authoritative guides and interactive calculators covering German immigration law, blue cards, apartment hunting, and taxation are rendered as pure static assets.
• Zero SQL injection attack surface, zero database connection pool saturation, and zero server crashes during traffic spikes.
• TTFB (Time to First Byte) under 40ms globally via high-performance European edge CDNs.

When an applicant submits an intake form for a relocation or business setup consultation:

[User Browser]
       │ (HTTPS POST + CSRF Protection + Edge Rate Limiting)
       ▼
[Next.js API Route (Edge Runtime)]
       │ Schema Validation (Zod) + Data Sanitization
       ▼
[Encrypted Transit (TLS 1.3)]
       │ Ephemeral Webhook Trigger
       ▼
[Isolated B2B n8n Worker (Self-hosted in EU / Hetzner Nuremberg)]
       │ PGP/GPG Payload Encryption & Routing
       ▼
[Instant Coordinator Dispatch (End-to-End Encrypted Telegram / Resend SMTP)]
       │
       ▼
[Worker Memory Flushed. Exactly 0 bytes stored on disk.]

2. Stateless Orchestration with Self-Hosted n8n

To coordinate incoming cases and allocate client requests to our immigration and business specialists in Germany, we deployed a lightweight, self-hosted n8n instance in an ISO/IEC 27001-certified German data center (Hetzner, Nuremberg):

Core Security & Privacy Parameters in n8n:

# Disable storage of execution history and payload data
EXECUTIONS_DATA_PRUNE=true
EXECUTIONS_DATA_MAX_AGE=0
EXECUTIONS_DATA_PRUNE_MAX_COUNT=100
EXECUTIONS_DATA_SAVE_ON_ERROR=none
EXECUTIONS_DATA_SAVE_ON_SUCCESS=none

This guarantees that the HTTP payload containing applicant contact details never gets written to SQLite, PostgreSQL, or disk logs inside the n8n environment.

Transit-Only Processing

The workflow parses incoming JSON, formats an actionable summary card for the case manager on duty, delivers it via encrypted notification channels, and instantly garbage-collects the memory buffers.

3. Legal and Compliance Assessment: Why German Privacy Regulators Favor This Design

Under Article 25 of the GDPR ("Data protection by design and by default"):

• Data Minimization (Datenminimierung, Art. 5(1)(c) GDPR): Since we do not maintain a web database storing customer files, those records cannot be exfiltrated in a web compromise.
• Zero Third-Party Trackers & Cookies: The platform intentionally runs without advertising beacons, Google Analytics, or third-party pixels. Visitors enjoy immediate page rendering without obstructive cookie consent walls, drastically optimizing LCP (Largest Contentful Paint).

4. Operational Results & Key Takeaways

1. Lighthouse Performance & SEO: 98–100 across Performance, Accessibility, Best Practices, and SEO.
2. Eliminated Data Breach Exposure: A server intrusion reveals only static HTML/JS assets and public configuration templates.
3. Seamless Multi-Language Scale: Operating four localized versions (German, English, Ukrainian, Russian) requires no database migrations or schema drift management.

Our engineering journey at WeRumo proves that modern European B2B/B2C relocation and consulting platforms can achieve world-class speed, reliability, and ironclad GDPR compliance without bloated infrastructure costs.

Explore our immigration and relocation guides or book a consultation:

• Main Portal: werumo.com/en
• Relocation Services: werumo.com/en/services/relocation
• Business Setup in Germany: werumo.com/en/services/business-start