EU web hosting: more than server location
EU web hosting means a host subject only to EU law, not just a server located in Europe. A US company renting servers in Frankfurt or Paris is still subject to the CLOUD Act.
And your website depends on more than its host: DNS, content delivery, email and third-party services each have their own provider. Our audit of a website's independence reviews all of them.
Questions to ask a host
- Where is the company headquartered, and who owns it? That decides which law applies.
- Where are the servers, and where are the backups? They are not always in the same place.
- Which subcontractors are involved (support, monitoring, storage), and in which countries?
- For sensitive data in France: does the offer hold the SecNumCloud qualification from ANSSI, the French cybersecurity agency?
The layers people forget
A website hosted in the EU can still route every visit through US DNS and a US content delivery network. Each layer has its own provider:
- DNS, which turns your domain name into an address;
- the content delivery network (CDN), often placed in front of the host;
- email, which receives messages for your domain;
- services called by your pages: fonts, analytics, videos, bot protection, payment.
What we find on the sites we audit
75%rely on a single provider for several critical layers, including at least one that all traffic passes through
85%send personal data outside the EU without safeguards
These percentages cover about 30 websites we audited between August 14, 2026 and September 24, 2026. Each one counts only the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.
Where to start
The first step is knowing your providers, layer by layer: that is what the audit establishes. The guide on what your website sends outside the EU covers the services your pages call; the CLOUD Act guide covers your host, DNS and email.
Then move the easy parts, fonts and third-party services, before the ones that need a migration: hosting, DNS and email.
What this check doesn't tell you
We identify the providers visible from the outside: host, DNS, CDN, email, services called by your pages. Backups, your host's subcontractors and internal tools stay invisible to us.
This guide replaces neither legal advice nor a review of a certification: it tells you what to ask.
Read next
CLOUD Act: is your website exposed?
The CLOUD Act reaches data held by US providers, even on servers in Europe. Which layers of your website it covers, and what the audit looks at.
Read the guide →What your website sends outside the EU
A visit can send your visitor's IP address outside the EU (fonts, analytics, videos). Why it counts as a transfer, and what the audit records.
Read the guide →