Where Your Client Data Lives When You Use a Hosting Provider

When a Romanian company puts its customer database on a hosting provider, the provider does not become responsible for that data. The company does. It stays the controller, the provider is a processor, and the law requires a written agreement between them. Two questions decide whether the arrangement survives an inspection: what the agreement says, and where the data actually goes.

You are the controller even when you never touch a server

The GDPR defines the controller as the body that determines the purposes and means of the processing, and the processor as the one that processes personal data on its behalf (Article 4(7) and 4(8)). Purpose is the test, not who holds the disk. An online shop keeps orders in a managed Postgres instance. The shop decides why that data exists, how long it stays and who may read it; the provider supplies compute, storage and backups and decides none of it. The shop is the controller and the provider is the processor.

The provider is still a controller for your account and billing data, which is why the roles clause at the top of a data processing agreement is worth reading first.

What a processor agreement has to contain

Article 28(1) says a controller "shall use only processors providing sufficient guarantees" that the processing meets the regulation. Article 28(3) requires that processing by a processor "shall be governed by a contract or other legal act under Union or Member State law", binding on the processor, setting out the subject matter and duration, the nature and purpose, the type of personal data, the categories of data subjects, and the obligations and rights of the controller. It then lists what the processor must commit to:

• processing only on your documented instructions, including on transfers to third countries, and telling you when the law forces it to do otherwise;
• keeping the people who can access the data under confidentiality obligations;
• taking the security measures required by Article 32;
• respecting the conditions for engaging another processor;
• helping you answer requests from data subjects;
• helping you meet Articles 32 to 36, from security and breach notification to impact assessments;
• deleting or returning the data at your choice when the service ends, unless the law requires storage;
• giving you the information needed to show compliance and allowing audits.

The closing sentence of that paragraph is easy to miss: the processor must tell you immediately if, in its opinion, an instruction of yours breaks the GDPR. You will not negotiate this text. Providers publish a standard agreement that applies when you accept their terms; Supabase's states that it "supplements and forms part of the Supabase Terms of Service". Read it, keep the version you accepted, and check that each point above is in it.

Sub-processors are where the chain gets long

A provider rarely does everything alone. Article 28(2) says a processor "shall not engage another processor without prior specific or general written authorisation of the controller", and with general authorisation it must inform you of changes so you can object. Article 28(4) requires the same obligations to flow down by contract and keeps the first processor "fully liable" if the second fails.

Almost every provider uses general authorisation plus a published list, so notice and objection are what differ. Supabase gives at least 30 days' notice, but only to customers who subscribe, and the objection must arrive within five days of it. Vercel notifies subscribers by updating its list and gives five calendar days to object; if the objection is not resolved, your only remedy is to terminate, without a refund. Netlify allows 30 days and refunds prepaid fees if it cannot avoid the sub-processor. Five days is shorter than most small companies take to read an email twice.

Transfers outside the EEA

A hosting choice is also a transfer question. Article 44 allows a transfer to a third country only if the conditions of the chapter are met. Article 45 covers countries the Commission has found adequate; the EU-US Data Privacy Framework, adopted in July 2023, is the current example for US companies that participate in it. Without adequacy, Article 46 allows appropriate safeguards, and Article 46(2)(c) names "standard data protection clauses adopted by the Commission".

The Commission's page calls these pre-approved model clauses usable as a ground for transfers from the EU to third countries. The current set is Commission Implementing Decision (EU) 2021/914 of 4 June 2021, in four modules: controller to controller, controller to processor, processor to processor, and processor to controller. Providers name the module they sign; Supabase and Vercel point to Module Two when you are a controller and Module Three when you are a processor for a client.

Signing is not the end. Clause 14 of the 2021 set has both parties warrant that the law and practice of the destination country do not prevent the importer from meeting its obligations, after weighing the length of the processing chain and the number of actors. That is the documented transfer impact assessment. For a small business it fits on a page: which data goes, to which entity, under which module, and what the sub-processor list says about government access.

A data centre in Frankfurt is not the whole answer

Take Supabase. A project can be created in eu-central-1 in Frankfurt, and the regions page says "the region you choose also determines where your primary project data is stored", with exceptions for legal requirements, extra instructions or service needs. The same page is honest about its limits: "Region selection is a data-location control, not proof of regulatory compliance."

Now open the sub-processor list. The version dated 12 October 2026 lists Supabase, Inc. in the United States for "provision of support services" and Supabase Pte. Ltd. in Singapore for marketplace support, next to AWS, Cloudflare and Google, all in the United States. A support engineer answering your ticket on a Frankfurt project can be employed by a US entity, and the agreement says Supabase may process covered data "anywhere that Supabase or its Sub-processors maintain facilities".

Vercel has the same shape: functions can run in fra1, cdg1, dub1 or arn1, but "Vercel's primary processing facilities are in the United States". Netlify runs each function in one region and defaults new sites to cmh in Ohio, a region choice listed for Pro and Enterprise plans.

None of this makes those providers a bad choice. Distributed support is normal and part of why the price works. But "our database is in the EU" answers one question and leaves three open: which entities can reach the data, under which transfer mechanism, and on what notice.

Four checks you can run this week

Ask for the sub-processor list

Supabase and Netlify publish theirs, and Vercel keeps its list in its trust centre at security.vercel.com. Read the countries and the description of each entry, not just the names, and subscribe to updates. A provider that cannot produce the list has answered the question too.

Download the data processing agreement

Save the PDF or the page with its date. Read five clauses: the roles, the sub-processor terms with notice and objection, the transfer mechanism and module, the breach notification window, and deletion or return at the end of the contract. Those five decide whether you can answer a client's questionnaire without guessing.

Confirm the region the database lives in

Look in the dashboard, not on the sales page, and write down the exact region code. A general "Europe" grouping is not an EU region: Supabase's documentation notes that its Europe group includes London and Zurich, which are not EU member states. If the data must stay in the EU, pick a specific region such as eu-central-1 and check that backups and read replicas follow it.

Record the answers in one document per provider

One page per provider, kept with the contract, is enough. It takes an hour and turns a vague feeling of compliance into something a colleague can check.

What the record should contain

Write down the provider's legal entity, the service you use, the categories of personal data and of data subjects, the region code, the sub-processors that can reach the data and their countries, the transfer mechanism and module, the DPA version and download date, the breach notification window and contact, the deletion terms, and the date of the next review.

This is not invented paperwork. Article 30 already requires a record of processing activities, and Article 30(1)(d) and (e) ask for the categories of recipients, including in third countries, and for transfers with the safeguards you rely on. A file per provider is the raw material for that record, and the only way to answer "where does this data go" in an afternoon.

Breach notification belongs in the same document

Article 33(1) gives the controller 72 hours from becoming aware of a breach to notify the supervisory authority, and Article 33(2) says the processor notifies the controller without undue delay. Your clock starts when the provider's message arrives. Supabase commits to notifying "without undue delay, and where feasible, within forty-eight (48) hours"; Netlify commits to 48 hours; Vercel says "without undue delay" without a number. Put that contact in the record, and make sure it is an inbox someone reads at the weekend.

When the provider is a small local host

Smaller Romanian hosts often have no published agreement and no sub-processor list. Article 28(3) does not require a specific form, only "a contract or other legal act", so a signed annex can work. Ask for the same eight commitments, the location of servers and backups, and the names of people with access. If the answer is that they have nothing and will sign nothing, you are still the controller, and the risk stays with you.

What this article is not

This is an explanation, not legal advice. The obligations above are the ones the regulation states, and the provider terms are the ones their pages stated when we fetched them; both change. In Romania the supervisory authority is the ANSPDCP, which publishes the regulation and the complaint procedure. If you process special categories of data, data about children, or large volumes of customer records, spend an hour with a lawyer before you sign, and review the file when a provider changes its agreement or its region list.

The four checks are small on purpose. A business that can name its provider's legal entity, its region code and its sub-processors is already ahead of most, and the same file answers the questionnaire a corporate client will send you. If you are choosing where a new project's data should live, our piece on running a site without a database covers the storage decision from the other side, and the basics for a small business covers what to do with the access you keep.