RU EN
www.
Technical audit · 2026-04-29

saada.rik.ee

Submitting Official Applications, Including AKI Complaints
EE

The portal through which a citizen files official applications — including complaints to the Data Protection Inspectorate about GDPR violations. Someone wanting to protect their data from being sent to Google and Amazon comes here — and within 223 milliseconds their IP address goes to Amazon, and within 242, to Google. Before any consent.

Timeline of the leak

+223 ms · before consent
cdn.form.io (an AmazonS3 server, Amazon CloudFront CDN, USA) loads a CSS file on each of the 7 pages in the session. Status 200, an actual transfer.
+242 ms · before consent
fonts.googleapis.com — the Roboto, Lato, Nunito Sans, and Roboto Slab typefaces. Every request transmits the user's IP address to Google (USA). 28 requests per session. Followed by fonts.gstatic.com (+365 ms).
Consent banner
Completely absent. Not a single request to a consent-management system, not a single cookie in the entire session.

Declared versus actual

+ form.io — Amazon AWS / CloudFront (USA), undeclared — не заявлен
+ Google Fonts — fonts.googleapis.com, fonts.gstatic.com, IP address to the USA — не заявлен
+ Cloudflare CDN — cdnjs.cloudflare.com — не заявлен

Transfer timings

+223 ms cdn.form.io

Amazon AWS / CloudFront, USA. CSS on 7 pages. Status 200

+242 ms fonts.googleapis.com

Google Fonts, 28 requests. IP address to the USA

+365 ms fonts.gstatic.com

Google's font CDN, 14 requests. Data to the USA

+9235 ms cdnjs.cloudflare.com

Cloudflare CDN, the flatpickr library, 4 requests. Data to the USA

Detected trackers

Indicators of GDPR non-compliance

Context

saada.rik.ee is the application-submission portal run by RIK, Estonia’s Center of Registers and Information Systems. Through it, citizens file official applications with state authorities, including complaints to the Data Protection Inspectorate (AKI) about GDPR violations. HAR: 153 requests, 4 external domains.

Context matters here: on April 14, 2026, AKI received a formal notice about violations found on its own site, aki.ee. Around April 28, the direct complaint-submission form on aki.ee disappeared, and users were redirected to saada.rik.ee. Traffic for this portal was captured on April 29.

223 milliseconds after the start, cdn.form.io (an AmazonS3 server, Amazon CloudFront CDN, USA) loads a CSS file — an actual transfer, on each of the 7 pages in the session. At +242 ms, fonts.googleapis.com sends the user’s IP address to Google: four typefaces on every page, 28 requests per session. Followed by fonts.gstatic.com and Cloudflare CDN. There is no consent banner whatsoever — not a single request to a consent-management system, not a single cookie. All of this happens before a person has even had time to read the page.

Declaration versus fact

The privacy policy does not name the actual data recipients: Google (fonts), Amazon (form.io / CloudFront), and Cloudflare (cdnjs) — a violation of Art. 13(1)(e). No transfer mechanism to the USA is stated for any of them — neither SCC nor an adequacy decision (Art. 13(1)(f)).

Conclusion

This is an architectural contradiction: the very mechanism for filing GDPR complaints itself violates GDPR. Someone wanting to protect their data from being sent to Google and Amazon comes to this portal — and within 223 milliseconds, their IP address goes to Amazon, and within 242, to Google, with no consent. eesti.ee and edpb.europa.eu prove that the right architecture is achievable: only local domains, a strict CSP, zero external trackers. There are no technical excuses — only decisions. A portal through which a citizen files a complaint about violations to their own data should start with its own code.

Evidence
Original (audit)
HAR file: ee/saada-rik-ee-2026-04-29.har
SHA-256: d28f2371fddba9a11ef135895c517997ebe56aed3b25ca26c4a50a89eebc5f65
Re-check snapshot
Awaiting changes
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
IMPORTANT: before filing a complaint with the regulator, first contact the company directly and give it 30 days to respond. Without this step the regulator may reject the complaint. Details and a template letter to the company are in the Methodology.
Ready-to-send complaint letter

Where to file: Estonian Data Protection Inspectorate (AKI) — write to info@aki.ee

Important: AKI only handles submissions in Estonian. Translate the letter before sending.

To: Estonian Data Protection Inspectorate (AKI)
From: [Your name], [contact email]

1. Subject of the complaint
I am filing a complaint regarding the processing of my personal data by the website saada.rik.ee.

2. Circumstances
I visited the website saada.rik.ee and found indications that the processing of my personal data does not comply with the GDPR. The technical analysis published on gdpru.eu on 29 April 2026 (open methodology, reproducible measurements) documents the following indications:

1) cdn.form.io (AWS), fonts.googleapis.com, fonts.gstatic.com, and cdnjs.cloudflare.com fire 223–9235 ms before any user consent.

2) There is no consent mechanism whatsoever — no banner, no settings, no choice. Zero cookies across the entire session.

3) Google (fonts), Amazon (cdn.form.io / CloudFront), and Cloudflare (cdnjs) are not declared as data recipients.

4) No transfer mechanism to the USA is stated for any recipient — neither SCC nor an adequacy decision.

Full technical documentation is published at: https://gdpru.eu/en/audits/ee-saada-rik-ee/

3. Provisions violated
GDPR Art. 6(1), Art. 5(1)(a); GDPR Art. 7; GDPR Art. 13(1)(e); GDPR Art. 13(1)(f), Chapter V

4. Request
I request that you investigate the violations described and apply the measures provided for in Article 58(2) GDPR.

5. Attachments
The full evidence base — the HAR file, its SHA-256 checksum and the quotation from the site's privacy policy documenting the stated contradiction — is published and verifiable at the link in point 2 above.

[Date]                                    [Signature / name]