Legal

Subprocessors

Every vendor that processes platform or customer data on our behalf, what for, and where — taken directly from how the system is actually built.

Draft under the owner’s legal review — not final until a lawyer has reviewed it. This list is updated if a vendor is added or removed.

OVHcloud — Server hosting

Location: Gravelines, France (EU). The dedicated server the entire platform (this website, the dashboard, the API, customer projects, databases, object storage, the AI builder’s sandboxes and our own mail servers for sending and mailboxes) runs on.

Backblaze — Off-site backups

Location: Amsterdam, Netherlands (EU Central region). Stores the encrypted off-site copy of the platform’s backups (databases, WordPress files, one-click app data, object storage, mail and configuration). Everything is encrypted on our server before upload, so Backblaze only ever holds ciphertext.

Cloudflare — DNS

Location: Global (CDN/DNS provider, US-headquartered). Resolves hostingsurge.com and hostingsurge.app, the domain that customer projects get their default addresses on. A domain you connect stays with your own DNS provider.

GitHub — Source code storage

Location: United States. Managed projects’ source code is stored in private GitHub repositories.

Coolify Cloud (coollabs) — Deployment orchestration

Location: EU-based service. Builds and deploys the platform and managed projects on the OVHcloud server; receives project configuration, including environment variables, in order to deploy it.

Let’s Encrypt — TLS certificates

Location: Global (nonprofit certificate authority). Issues the HTTPS certificates for the platform and connected customer domains.

DeepSeek — AI builder model calls

Location: China. Operated by Hangzhou DeepSeek Artificial Intelligence Co., Ltd. When you use the AI builder, your prompts and the project files the builder works on (including the build errors it is asked to fix) are sent to DeepSeek’s API, which generates the changes. DeepSeek processes them under its own terms. No other AI provider receives the builder’s prompts or project files.

Stripe — Payment processing

Location: United States (with EU processing). Processes payments and subscriptions when billing is enabled on your plan. Card details are handled by Stripe directly and are never stored on our servers.

Backups

Backups run nightly on the production server and are copied, encrypted, to Backblaze in the EU (Amsterdam). A restore from the off-site copy is tested every week.

Questions about a vendor

Reach the operator at hello@hostingsurge.com.