GDPR-compliant VPS hosting in the EU: what to check before you sign
"GDPR-compliant" on a hosting page means nothing on its own. These are the five things to check, and our own answers to each.
1. Where is the company registered?
The legal entity matters as much as the datacenter. A provider registered outside the EU can be ordered by its home government to hand over data, wherever the server sits.
Our answer: Euronodes Ltd is registered in Cyprus, an EU member state. Our supervisory authority is the Cyprus Commissioner for Personal Data Protection.
2. Where are the servers, and who owns them?
Ask for the city and the datacenter, not "EU region". Then ask if the provider owns the hardware or resells someone else's cloud: a reseller adds a company you never signed with.
Our answer: our own servers in two EU datacenters, ONI in Lisbon (Portugal) and Coolhousing in Prague (Czech Republic). We own the servers, switches and routers and run our own network, AS199053; only the rack space is rented.
3. Is there a data processing agreement?
Article 28 of the GDPR requires a written contract between you (the controller) and your host (the processor). If the provider cannot show one, stop there.
Our answer: our Data Processing Agreement is public and has been in force since 2017.
4. Who are the sub-processors?
Every provider uses other companies, for payments, DNS or email. A serious one lists them, says where they are, and promises notice before adding new ones.
Our answer: the sub-processor list is public, with each company's location and the legal basis for any transfer outside the EU. We give 30 days' notice before adding one. None of them has access to the disks of your VPS: they handle account, billing and support data only.
5. Who can actually reach your data?
Ask what the provider's staff can see inside your server. On an unmanaged VPS the honest answer is: nothing, unless you give them access.
Our answer: - We do not log in to your VM without your permission, and we do not inspect your traffic. - Your disk stays on our hardware in the datacenter you chose. - Every disk is part of an array, so a single disk never holds a usable copy of your data. A retired disk is securely wiped before disposal, under our disk disposal policy.
What GDPR does not do for you
Hosting in the EU covers where the data sits and who processes it. Encryption, access control, backups and your own privacy policy are still your job as the controller.
In short
| Question | Euronodes |
|---|---|
| Company | Euronodes Ltd, Cyprus (EU) |
| Datacenters | Lisbon (PT) and Prague (CZ) |
| Hardware | Owned, own network AS199053 |
| DPA | Public, since 2017 |
| Sub-processors | Public list, 30 days' notice |
VPS plans start at €4.54 a month in Lisbon or Prague, billed hourly.