GDPR checklist for hosting tools.
Hosting and cloud providers hold or serve your data, so they are usually your largest set of subprocessors. Compare 39 common tools and see what to check for each.
Compared at a glance
| Tool | Usual role | Data location | Agreement |
|---|---|---|---|
 Webflow | Usually a processor | Often the United States, check your account | Published by the vendor |
 Amazon Web Services | Usually a processor | Set per account or project | Published by the vendor |
 Vercel | Usually a processor | Often the United States, check your account | Published by the vendor |
 Microsoft Azure | Usually a processor | Set per account or project | Published by the vendor |
 Google Cloud | Usually a processor | Set per account or project | Published by the vendor |
 Hetzner | Usually a processor | Set per account or project | Obtained through the vendor |
 OVHcloud | Usually a processor | Set per account or project | Obtained through the vendor |
 Scaleway | Usually a processor | Set per account or project | Obtained through the vendor |
 DigitalOcean | Usually a processor | Set per account or project | Published by the vendor |
 Render | Usually a processor | Set per account or project | Published by the vendor |
 Railway | Usually a processor | Set per account or project | Published by the vendor |
 Fly.io | Usually a processor | Set per account or project | Obtained through the vendor |
 Squarespace | Usually a processor | Set per account or project | Published by the vendor |
 Wix | Usually a processor | Set per account or project | Published by the vendor |
 Framer | Usually a processor | Set per account or project | Published by the vendor |
 Netlify | Usually a processor | Set per account or project | Published by the vendor |
 Vultr | Usually a processor | Set per account or project | Obtained through the vendor |
 Kinsta | Usually a processor | Set per account or project | Published by the vendor |
 WP Engine | Usually a processor | Set per account or project | Published by the vendor |
 Heroku | Usually a processor | Set per account or project | Obtained through the vendor |
 Fastly | Usually a processor | Set per account or project | Published by the vendor |
 Akamai | Usually a processor | Set per account or project | Published by the vendor |
 Alibaba Cloud | Usually a processor | Set per account or project | Published by the vendor |
 Exoscale | Usually a processor | Set per account or project | Published by the vendor |
 Platform.sh | Usually a processor | Set per account or project | Published by the vendor |
 Koyeb | Usually a processor | Set per account or project | Published by the vendor |
 GoDaddy | Depends on the activity | Set per account or project | Published by the vendor |
 DreamHost | Usually a processor | Set per account or project | Published by the vendor |
 Hostinger | Usually a processor | Set per account or project | Published by the vendor |
 Pantheon | Usually a processor | Set per account or project | Obtained through the vendor |
 Weebly | Usually a processor | Set per account or project | Published by the vendor |
 Duda | Usually a processor | Set per account or project | Published by the vendor |
 Appwrite | Usually a processor | Set per account or project | Obtained through the vendor |
 Back4App | Usually a processor | Set per account or project | Published by the vendor |
 Scalingo | Usually a processor | Set per account or project | Published by the vendor |
 Clever Cloud | Usually a processor | Set per account or project | Published by the vendor |
 Infomaniak | Usually a processor | Set per account or project | Published by the vendor |
 Contabo | Usually a processor | Set per account or project | Obtained through the vendor |
 Gandi | Usually a processor | Set per account or project | Obtained through the vendor |
What to check for hosting tools
- Confirm the region of every service you use, since it is often chosen per project or per resource.
- If any region is outside the EEA, record the transfer safeguard (SCCs, adequacy decision or Data Privacy Framework).
- Check the provider’s subprocessor list and how it announces changes.
- Keep the agreement text you accepted and the date you accepted it.
All hosting tools
- WebflowHosting
- Amazon Web ServicesHosting
- VercelHosting
- Microsoft AzureHosting
- Google CloudHosting
- HetznerHosting
- OVHcloudHosting
- ScalewayHosting
- DigitalOceanHosting
- RenderHosting
- RailwayHosting
- Fly.ioHosting
- SquarespaceHosting
- WixHosting
- FramerHosting
- NetlifyHosting
- VultrHosting
- KinstaHosting
- WP EngineHosting
- HerokuHosting
- FastlyHosting
- AkamaiHosting
- Alibaba CloudHosting
- ExoscaleHosting
- Platform.shHosting
- KoyebHosting
- GoDaddyHosting
- DreamHostHosting
- HostingerHosting
- PantheonHosting
- WeeblyHosting
- DudaHosting
- AppwriteHosting
- Back4AppHosting
- ScalingoHosting
- Clever CloudHosting
- InfomaniakHosting
- ContaboHosting
- GandiHosting
Questions, answered.
What should I check before using a hosting tool under the GDPR?
Confirm the region of every service you use, since it is often chosen per project or per resource. If any region is outside the EEA, record the transfer safeguard (SCCs, adequacy decision or Data Privacy Framework). Check the provider’s subprocessor list and how it announces changes. Keep the agreement text you accepted and the date you accepted it.
Do I need a data processing agreement with a hosting provider?
If the provider handles personal data on your behalf, yes: Article 28 of the GDPR requires a written contract. Some providers publish the text, others give it to you inside your account. Providers that decide their own purposes may act as independent controllers instead, so check the role.
Which hosting tools does Privacyboard cover?
Webflow, Amazon Web Services, Vercel, Microsoft Azure, Google Cloud, Hetzner, OVHcloud, Scaleway, DigitalOcean, Render, Railway, Fly.io, Squarespace, Wix, Framer, Netlify, Vultr, Kinsta, WP Engine, Heroku, Fastly, Akamai, Alibaba Cloud, Exoscale, Platform.sh, Koyeb, GoDaddy, DreamHost, Hostinger, Pantheon, Weebly, Duda, Appwrite, Back4App, Scalingo, Clever Cloud, Infomaniak, Contabo, Gandi. Each has a page with its agreement, usual role and data location, checked on 1 November 2026.
Other categories
Privacyboard is not affiliated with these vendors. Checked on 1 November 2026. This is guidance, not legal advice.