Hosting your website in Europe: performance and compliance

“Our website must be hosted in Europe.” The request comes up often, and it is legitimate. Yet it mixes two questions that are not settled the same way: where visitors’ personal data is stored, a compliance question, and where pages are served from, a speed question. A static site has the advantage of separating them cleanly. This article takes them one at a time. If your current site still runs code on every visit, our guide to migrating to a static site with Astro explains what that change simplifies.

Two questions, not one

A site that builds its pages on every visit mixes the two: the database that holds the pages also holds accounts, comments and often enquiries. A static site separates them: pages are files with no personal data, which can be served from anywhere, and data only exists at the few places where a visitor acts.

What the law says

The GDPR contains no obligation to host in Europe. Its Chapter V governs transfers of personal data outside the European Economic Area: they are allowed to a country recognised as offering adequate protection, or with appropriate safeguards such as standard contractual clauses. For the United States, this framework has changed three times, as the Court of Justice of the EU’s press release of 3 September 2025 recalls:

1. October 2015

   The Court of Justice invalidates the first transfer framework to the United States (Schrems I judgment).

2. 16 July 2020

   It invalidates the second, the “Privacy Shield” (Schrems II judgment), while upholding standard contractual clauses.

3. 10 July 2023

   The Commission adopts a new adequacy decision, the “Data Privacy Framework”.

4. 3 September 2025

   The EU General Court dismisses a French MP’s action against that decision.

5. 31 October 2025

   The MP appeals to the Court of Justice.

As of this article, a transfer to a US company certified under this framework is therefore lawful. Sources for the timeline: the Schrems II judgment, the Commission’s decision and the appeal lodged on 31 October 2025. For a company that does not want to depend on the outcome of the appeal, keeping personal data in Europe with a European provider remains the simplest answer to explain.

A second question follows: a US host storing your data in a European data centre. The US Department of Justice explains, in its paper on the CLOUD Act, that a provider subject to US law must disclose data it controls in response to valid legal process, wherever it stores that data. The same paper notes that many countries have comparable rules for companies in their jurisdiction. Data location and the host’s nationality are therefore two separate criteria, and the choice between them depends on your clients and your sector. Our article on Europe’s dependence on US cloud providers widens the question to the rest of your tools.

Where a website’s personal data really is

On a static site, personal data passes through a few points, always the same ones:

1. 01The form.

   Each enquiry holds a name, an email address, often a phone number. It is the site’s most sensitive data, and the only data that is kept.

2. 02Audience measurement.

   Depending on the tool, it reads the IP address, sets cookies and sends data to its vendor.

3. 03Third-party resources.

   A font, a video or a map loaded from another domain passes the visitor’s IP address to that domain.

4. 04Logs.

   The host and the delivery network record requests, IP addresses included, for a period they set.

Point 3 is the one most often forgotten, and a court has already ruled on it: in January 2022, the Munich Regional Court ordered a website operator to pay 100 euros in damages to a visitor, because fonts loaded from Google’s servers passed on his IP address without his consent. Serving fonts from your own site removes the problem without changing how pages look.

What we do on this site

This site is served by Cloudflare, a US company, from its global network. That choice holds because the pages contain no personal data. Cloudflare’s network sees visitors’ IP addresses in its logs, like any host; what the site itself keeps stays in Europe:

• form enquiries are saved in storage under the EU jurisdiction restriction, which Cloudflare’s documentation describes as a guarantee that objects are stored within the Union, and which cannot be changed after the storage is created;
• fonts are served by the site itself, with no call to a third-party service;
• audience measurement still runs on Google Analytics: replacing it with a cookieless tool is on our technical debt list.

How enquiries are saved is detailed in our article on forms and search on a static site.

What distance does to speed

Display speed depends partly on distance: a request that crosses a continent takes longer than one that stays in the same city. For a European audience, a server in Europe is well placed. For a global audience, a single server, wherever it is, slows down part of the visitors.

This is where a static site helps: its pages are files identical for everyone, which a content delivery network copies to dozens of points and serves from the one closest to the visitor. Speed is then measured page by page, against the thresholds Google publishes, covered in our article on Core Web Vitals for business leaders.

Three possible setups

• All in Europe. A European host, delivery from Europe, form and audience measurement hosted in Europe. The simplest to explain to a client or a public buyer; providers such as OVHcloud, Scaleway, Hetzner or Infomaniak make it possible, among others.
• Pages on a global network, data in Europe. This site’s setup: speed everywhere, and the data the site keeps stored in the Union.
• Your own server, in Europe. For a site that sits next to business applications already hosted on that server. Global delivery and maintenance become your job again, as our comparison of Cloudflare, Netlify or a VPS explains.

Questions to ask a host

1. Where is the data stored, and can it be guaranteed by contract? Not just the files: logs, backups, form data.
2. Under which law does the company operate? Headquarters, parent company, and what that implies for requests from authorities.
3. Which sub-processors are involved? Article 28 of the GDPR requires a processing contract and prior authorisation of further sub-processors: ask for the list.
4. How long are logs kept? With IP addresses, they are personal data.
5. How do you leave? A static site moves by copying a folder; the form data must be able to follow.

The rest of the project

Hosting is only one piece. A multilingual site serves several audiences from the same setup (one language, one URL). The form is also the block that turns a visit into an enquiry (the five blocks of a business website). Changing host loses nothing when 301 redirects and URLs stay identical, and the redesign that often comes with it sorts the existing pages (which pages to keep, merge or delete). The yearly cost depends on the setup (how much a business website costs), WordPress adds its own data to protect (why WordPress sites get hacked), and a content editor stores data somewhere too (headless Astro and Sanity, or Markdown in the repository or a CMS). The accessibility obligation applies whatever the host (what the 2025 EU obligation changes), as does the question of disclosing that a text was written by AI.

Both our website offers leave the setup open: the business website to start from scratch, the static site migration to leave hosting that runs code on every visit, URLs kept.

Frequently asked questions

Sources

1. Court of Justice of the European Union, press release No 106/25, 3 September 2025 (new tab)curia.europa.eu
2. Court of Justice of the European Union, press release No 91/20, 16 July 2020 (new tab)curia.europa.eu
3. European Commission, press release of 10 July 2023 (new tab)ec.europa.eu
4. WilmerHale, December 2025 (new tab)wilmerhale.com
5. US Department of Justice, The Purpose and Impact of the CLOUD Act, April 2019 (new tab)justice.gov
6. IHK Bergische Region, LG München I judgment of 20 January 2022 (new tab)ihk.de
7. Cloudflare R2, data location (new tab)developers.cloudflare.com