Data processing agreement

Hostingsurge's registered operator details are being published here. Until then, this page names the brand (Hostingsurge) only.

You as the customer are the controller and we are your processor for the personal data in what you run on the platform. This agreement is part of the terms of service (/legal/terms) and applies automatically when you use the service for such data, with no signature needed. If you want a signed copy, contact us below.

Personal data we process for our own purposes, such as about your account and payments, is covered by the privacy policy (/legal/privacy) instead.

We store, run and back up what you deploy, and provide the features you use:

• Hosting of sites, apps, WordPress and databases, and object storage.
• Email: mailboxes, forwarding and sending.
• Build, runtime and request logs, cookieless visitor analytics and uptime alerts.
• Backups and restores.
• The AI builder, when you use it: your prompts and project files are sent to the model provider (see Sub-processors).
• Support, when you ask for help with a specific project.

You decide which data is processed. Typically: visitors of your sites (requests to your site; the proxy’s raw log with IP addresses is kept for at most two days, and the analytics store no IP addresses), your users and customers (accounts, orders, forms in your app or database) and the people who send and receive email in your mailboxes.

Only put special categories of data (Article 9) or data about offences (Article 10) on the platform if you have a basis for it and have judged the measures below sufficient.

• We process the data only on your documented instructions. The terms of service, this agreement and what you do in the dashboard, API, CLI or MCP are your instructions.
• We tell you if we believe an instruction infringes data protection law.
• If we must process data because the law requires it (for example an order from an authority), we tell you first unless the law forbids it.
• You are responsible for having a legal basis for the processing and for informing your own visitors and users.

• Confidentiality: everyone with access to the data is bound by confidentiality, and we only enter a customer project when operations, security or a support case need it.
• Security under Article 32: see Security measures below.
• Data subject rights: you can export, correct and delete data yourself with the dashboard’s tools. If you need more help with a request from a data subject, we help.
• We assist you with security, impact assessments and prior consultation (Articles 32–36) with the information we have.
• We keep a record of processing as a processor (Article 30(2)).

We notify you without undue delay, and at the latest within 48 hours of becoming aware of a personal data breach affecting your data, with the information we have: what happened, which data and how many people are affected, the likely consequences and what we are doing. We add to it as we learn more, so that you can notify the supervisory authority within 72 hours where required.

You give a general authorization for the sub-processors listed at /legal/subprocessors. We impose the same data protection obligations as in this agreement on them and remain responsible to you for them.

We announce changes by updating the list and by email to the team’s owners at least 30 days before a new sub-processor starts processing your data. If you have reasonable grounds to object, you can end the service before the change takes effect.

DeepSeek receives your data only when you use the AI builder yourself. Do not use it for personal data that must not leave the EU.

The server and the off-site backups are within the EU (OVHcloud in France, Backblaze in the Netherlands). Sub-processors outside the EU and the safeguard for each transfer are listed at /legal/subprocessors and in the privacy policy. We do not transfer your data to a country outside the EU/EEA without a valid safeguard under Chapter V of the GDPR.

• During the agreement you can export your files and versions, download backups of your databases and export your environment variables at any time.
• When you delete a project, a single backup is kept for 30 days, for disaster recovery.
• When you delete your account, the teams you were the only member of are deleted after a 30-day grace period, with no final copy.
• Backups of site files, app data, WordPress and customer databases are rewritten every night without deleted projects. Copies of email, object storage and the control database age out on schedule (up to about six months, plus at most 30 days at the storage provider). They are encrypted and used only for restores.
• We keep only what the law requires us to keep.

We give you the information needed to show that we comply with Article 28. You, or an independent auditor you appoint who is bound by confidentiality, may audit us once a year with 30 days’ notice, at your own cost and without disrupting operations or revealing other customers’ data. More often after an incident or where a supervisory authority requires it.

• Everything runs on a dedicated server at OVHcloud in France (EU), with mirrored disks and container protections, resource limits per project and per-IP limits.
• HTTPS with Let’s Encrypt certificates for the platform and customer domains.
• Passwords are stored only as hashes, two-step verification is available for every account, and teams can require it, use SSO and restrict access to certain IP addresses.
• Environment variables and other secrets are stored encrypted.
• The database separates customers with row-level security, and each service has its own database login with the least privileges it needs.
• The staff console has its own sign-in with two-step verification, and every action there is logged.
• Nightly backups (the control database every 15 minutes, WordPress and app databases hourly), encrypted on our server before they are copied to Backblaze in the EU, with a restore tested every week.
• Monitoring of operations, backups and certificates with alerts.

Liability is governed by the terms of service, except where the GDPR provides otherwise. In a conflict, this agreement prevails over the terms of service on personal data, and the EU standard contractual clauses, where they apply, prevail over both.

This agreement applies for as long as we process personal data for you. Swedish law applies.

Reach the operator at hello@hostingsurge.com.