When you choose where to host a website or app, you usually look at price, speed and support. There’s another question, just as important if you handle personal data: where does your customers’ data physically live, and who has access to it?

The data on your website means contact form messages, customer accounts, orders, addresses, invoices. You are responsible for all of it.

What the GDPR says about where data lives

Inside the European Economic Area (the EU, plus Iceland, Liechtenstein and Norway), personal data flows freely: a server in Germany or Finland is, from the GDPR’s point of view, the same as one in Romania.

Outside it, the rules change. Data can be transferred only if there is a legal basis: a European Commission decision that the country protects data adequately, standard contractual clauses or other safeguards provided by the regulation1. And making sure the transfer is lawful is your responsibility, as the data controller.

The United States: ground that has shifted three times

For transfers to the US, the rules have changed several times in the last decade. The EU Court of Justice struck down two successive agreements: Safe Harbor in 2015 and Privacy Shield in 2020. Since July 2023 there has been a third, the EU-US Data Privacy Framework, which allows data to be transferred to US companies that have joined it2. The EU General Court upheld it in September 2025, but the ruling can be appealed3.

In practice: an agreement that is valid today may be struck down tomorrow, and companies relying on it then have to rebuild their legal basis in a hurry.

It’s not just where, but who

A server “in Frankfurt” doesn’t automatically mean the data is only under European law. The company running it matters too.

The US law known as the CLOUD Act (2018) allows US authorities to require US providers to hand over data they control, wherever it’s physically stored4. European data protection authorities have pointed out that this can conflict with the GDPR. For a European provider with no ties to the US, the question doesn’t arise.

This doesn’t mean US services are forbidden

Many companies lawfully use US services, based on the Data Privacy Framework or standard contractual clauses. The difference is that with a European provider, with servers in the EU, the situation is simpler, more stable and easier to explain to customers and authorities.

The contract with your provider

The company hosting your app processes data on your behalf, so the GDPR requires a data processing agreement with it (Article 28)1. It sets out what the provider may do with the data, how it protects it and which sub-processors it uses. Serious providers offer one as standard.

Watch out for sub-processors: your provider may be European, but may in turn use services outside the EU for email, backups or support.

What to check with your providers

Hosting isn’t the only place your data passes through. List every service your website or app uses and check, for each one, where the data lives and who the company is:

  • hosting and backups;
  • company email and the emails the app sends automatically;
  • forms, chat, appointment booking;
  • traffic analytics and marketing tools;
  • CRM, invoicing, the payment processor;
  • AI services: if you send customer data to an AI model, that’s a data transfer too.

The practical benefits of EU hosting

Beyond the legal side, hosting close to your customers has concrete benefits:

  • speed: a server in Europe responds faster to visitors from Romania than one on another continent;
  • clarity: you can easily answer “where is my data?”, a question customers ask more and more often, especially large ones;
  • stability: you don’t depend on the fate of international agreements.

How we do it

We host websites and apps at Hetzner, a German provider with data centers in Germany and Finland; in Germany, all the electricity it uses comes from renewable sources5. The email services we use also have servers in the European Union. When a project needs external services, we check from the start where the data goes and help you document everything for your privacy policy.

See how we work with infrastructure

  1. Regulation (EU) 2016/679 (GDPR): Article 28 and Chapter V (Articles 44–50). ↩ ↩

  2. European Commission, EU-US data transfers. ↩

  3. IAPP, European General Court dismisses Latombe challenge, upholds EU-US Data Privacy Framework, September 2025. ↩

  4. EDPB and EDPS, initial assessment of the CLOUD Act’s impact on the EU legal framework, July 2019. ↩

  5. Hetzner, Sustainability at Hetzner. ↩

Cover image: Thomas Kvistholt, Wikimedia Commons (CC0)