Subprocessors

Location: Gravelines, France (EU). The dedicated server the entire platform (this website, the dashboard, the API, customer projects, databases, object storage, the AI builder’s sandboxes and our own mail servers for sending and mailboxes) runs on.

Location: Amsterdam, Netherlands (EU Central region). Stores the encrypted off-site copy of the platform’s backups (databases, WordPress files, one-click app data, object storage, mail and configuration). Everything is encrypted on our server before upload, so Backblaze only ever holds ciphertext.

Location: Global (CDN/DNS provider, US-headquartered). Resolves hostingsurge.com and hostingsurge.app, the domain that customer projects get their default addresses on. A domain you connect stays with your own DNS provider. Cloudflare Turnstile checks that a person, not a bot, is using the sign-up, password reset and abuse report forms; it receives your IP address and browser signals for that check. Safeguards for the US transfer: the EU–US Data Privacy Framework and the EU standard contractual clauses.

Location: United States. Managed projects’ source code is stored in private GitHub repositories. Safeguards for the US transfer: the EU–US Data Privacy Framework and the EU standard contractual clauses.

Location: EU-based service. Builds and deploys the platform and managed projects on the OVHcloud server; receives project configuration, including environment variables, in order to deploy it.

Location: Global (nonprofit certificate authority). Issues the HTTPS certificates for the platform and connected customer domains.

Location: China. Operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. When you use the AI builder, your prompts and the project files the builder works on (including the build errors it is asked to fix) are sent to DeepSeek’s API, which generates the changes. DeepSeek processes them under its own terms. No other AI provider receives the builder’s prompts or project files.

Location: United States (mail goes out through its EU region, Ireland). Only if a team uses our shared Resend account, which is not offered today: the domain, and each email that website sends (sender, recipients, subject, content). Safeguards for the US transfer: the EU–US Data Privacy Framework and standard contractual clauses in Resend’s data processing agreement. A team that connects its own Resend account has its own agreement with Resend; we then only use its key to set up its domains.

Location: United States. Only when you buy or transfer a domain through Hostingsurge: Dynadot registers it and receives the registrant details, which go on to the registry of the top-level domain under its rules. WHOIS privacy is used where the top-level domain allows it.

Backups run nightly on the production server and are copied, encrypted, to Backblaze in the EU (Amsterdam). A restore from the off-site copy is tested every week.

No third-party payment provider processes data for us. You pay with Bitcoin through a BTCPay Server that we run ourselves on our own server. Stripe is not used.

We update this list and email team owners at least 30 days before a new sub-processor starts processing customer data (see /legal/dpa).

Reach the operator at hello@hostingsurge.com.