GDPR and database hosting: what to look for when choosing a provider

If your app processes personal data of people in the EU, your database provider is your data processor. Choosing one is a legal decision, not only a technical one. This post is not legal advice — it is a checklist that helps you ask the right questions.

1. Where are the data physically?

It is not only the database region that matters, but also the location of backups, logs and replicas. At HostBase the pl-waw-1 region means the database, backups and logs stay in Poland.

2. Data processing agreement (DPA)

Article 28 GDPR requires a processing agreement. Check whether the provider offers one as standard and whether you can sign it without negotiation.

3. Sub-processors

Ask for the list of sub-processors (data centers, email providers, monitoring). Every transfer outside the EEA needs a legal basis, for example standard contractual clauses.

4. Access from outside the EU

A provider headquartered outside the EU may be subject to laws that allow authorities to access data regardless of server location. For sensitive data (health, finance) this is often the key argument.

5. Technical safeguards

• encryption at rest and in transit (TLS),
• project isolation and dashboard access control (roles, 2FA, audit logs),
• the ability to delete data and backups after the contract ends.

Checklist

Question	HostBase
Region in Poland	Yes — pl-waw-1
Backups in the same country	Yes
Data processing agreement	Yes, in the dashboard (Team, Enterprise) or on request
VAT invoice in PLN	Yes
Audit logs	Team plan and above

Details are on the Security page and in the Privacy Policy.