GDPR AI Hosting: What AI-Built Sites Need in the EU

If you're building sites for European users with AI tools, GDPR is going to come up. Probably from a customer asking about a Data Processing Agreement, possibly from a procurement form, occasionally from an EU-based partner whose policy rules out US-hosted services for personal data.

This post covers what the regulation actually requires for AI-built sites, what's myth, and how to set up a GDPR-friendly deploy without booking an enterprise sales call.

What GDPR actually requires for hosting

The General Data Protection Regulation governs personal data of people in the EU. For a website host, the relevant pieces are:

1. A Data Processing Agreement (DPA). If you process personal data on behalf of a customer, you need a written DPA with them. If you use a host that processes data on your behalf, you need one with the host. Article 28 calls it "a contract or other legal act".
2. Lawful basis for transfers outside the EU. Personal data leaving the EU needs a lawful basis (Standard Contractual Clauses, an adequacy decision, or specific consent).
3. Subject access rights. People can ask for a copy of their data, deletion, and correction. Article 12 gives you one month to respond, which you can extend by two further months for complex requests. Your hosting setup must let you find and delete a person's data in that time.
4. Breach notification. A host that processes data for you must tell you about a breach without undue delay. You must notify your supervisory authority within 72 hours where feasible, unless the breach is unlikely to put people at risk.

That's the regulatory baseline. The ranking-of-host criterion that matters most is: does your host make these obligations easy or hard?

Why EU hosting helps

You can host on US infrastructure and still be GDPR-compliant. The Standard Contractual Clauses path works. But it means every customer asking about data residency requires a thorough explanation of how transfers work. It means your privacy policy has to spell out US transfers. And some buyers, often in the public sector or regulated industries, ask for EU-only processing in their procurement forms.

EU hosting removes most of that. The DPA is shorter. The privacy policy is shorter. The customer compliance review is faster, and there is less to revisit if the legal basis for EU-US transfers changes.

It also signals something to the customer. "We host in the EU" is a one-liner that closes a lot of compliance questions before they're asked.

What "EU hosting" actually means

Watch out for marketing wordplay here.

• EU presence: the company has an EU office. Doesn't mean your data stays in the EU.
• EU region available: the host has data centres in the EU but you have to opt in. Default is elsewhere. Easy to misconfigure.
• EU-only: the host serves your site only from data centres in the EU and runs its control plane there too. The strict reading also checks the subprocessor list: who else touches the data, and where.

The big platforms are US companies. Vercel Inc. and Netlify, Inc. are based in California and Cloudflare, Inc. in San Francisco, according to their own privacy policies. Vercel's policy asks you to consent to the processing of your information "in the United States and other jurisdictions in which we operate", and both Vercel's and Netlify's policies name the EU-US Data Privacy Framework for US transfers. At Cloudflare, choosing where it inspects and stores your data takes its Data Localization Suite, an Enterprise-only paid add-on.

For many AI-built sites, those safeguards are acceptable. For customers with strict residency rules, they make for a longer conversation.

VibeDeploy is built for that conversation. Sites run on its own Kubernetes cluster in Belgium, and the deploy pipeline and the control plane stay in Belgium too, under EU jurisdiction. The eight subprocessors are listed publicly, and customer site content does not pass a US processor unless you use the optional AI builder features. The US companies on that list have narrow roles: the AI builder features (OpenRouter, Google Stitch), DNS lookups for domain verification (Cloudflare, Google Public DNS), and EU-region storage designated for off-site copies of the platform database (Backblaze). The trade-off is reach: one region, no global edge network.

The DPA shortcut

If your host doesn't publish a standard DPA, you'll waste a week chasing one. Look for these red flags:

• DPA only on enterprise plans
• DPA "available on request" (means: not standardised, expect lawyer back-and-forth)
• "We're working on a DPA" (means: you can't sign one today)

A good host publishes its DPA at a public URL, so you can read it before signing up. VibeDeploy's is at /dpa and is included on every paid plan.

For your customers asking you for a DPA: you sign their version (usually a checkbox in your platform's customer agreement) and you're done.

Cookies and analytics

A common mistake on AI-built sites: the AI generates a Google Analytics snippet without a cookie consent banner. For EU visitors, that is a consent problem waiting to happen.

The fix is one of:

1. Use cookieless analytics. Plausible says it uses no cookies, stores visitor data in the EU and needs no cookie banner for analytics. Fathom, a Canadian company, also runs without cookies and keeps EU visitors' IP addresses in the EU. Matomo can be self-hosted.
2. Add consent management. Real consent before any non-essential cookies fire. Klaro, Cookiebot, Termly. Prefer the open-source ones if you can stomach the integration.
3. Skip analytics entirely. Many small sites don't actually need it.

Recommendation for AI-built sites: Plausible. It's run by a company incorporated in Estonia, uses no cookies, and keeps visitor data in the EU. Maintenance cost is zero.

Forms and email

If your site has a contact form, that's a personal data processor. The form-handler service you use needs:

• A DPA you can sign
• Clear data retention policy
• EU hosting if you can get it

If you host on VibeDeploy, its built-in forms relay emails submissions from infrastructure in Belgium, and it is included on every plan, the 14-day trial too. Otherwise, two EU picks: Formspark, run from Belgium with data in Ireland and Germany, and Tally, also Belgian, which stores form data in Europe. Both offer a DPA. Avoid US-based form handlers if your customers are GDPR-strict.

What this looks like in practice

A GDPR-friendly AI-built deploy in 2026:

1. Host: EU-only host with a publicly available DPA on every paid plan.
2. Domain: ideally registered through an EU-based registrar, such as Gandi or OVHcloud (both French).
3. Analytics: Plausible or Fathom.
4. Forms: VibeDeploy's built-in forms relay (included on every plan, hosted in Belgium), or an external EU form service such as Formspark or Tally.
5. External APIs: if your site sends personal data to an AI API run by a US company, that's a transfer outside the EU. Mention it in your privacy policy and sign the provider's DPA; Anthropic's, for example, builds in the EU Standard Contractual Clauses.
6. Privacy policy: state your hosting region, your subprocessors, the basis for any transfers.

For a new site, most of the setup time goes into the privacy policy.

Common myths

"GDPR only applies if I have EU customers." It applies if you offer goods or services to people in the EU, or monitor their behaviour, even from outside the EU. The threshold is low.

"My static site has no personal data so GDPR doesn't apply." If you have any analytics, contact form, account system, or comment form, you process personal data. That's nearly every site.

"A privacy policy is enough." It's necessary but not sufficient. You also need lawful basis, subject access procedures, breach notification, and a DPA with each processor.

"Cloudflare is fine because they're huge." Size does not settle residency. Cloudflare, Inc. is a US company, and controlling where it processes your data takes the Enterprise-only Data Localization Suite. For strict residency, a host that only runs in the EU is simpler.

What to ask a host before signing up

• "Where are my data and your control plane physically located?"
• "Do you publish a standard DPA on every paid plan?"
• "What subprocessors do you use, and where are they located?"
• "How do I request data deletion for a specific user?"
• "What's your incident notification SLA?"

A good host has answers to all five within 60 seconds. If they don't, that tells you something.

Where to go next

• How to deploy AI-built websites in 2026: the complete deploy guide, with 25 AI tools compared.
• Deploy a Lovable site to a custom domain: tool-specific walkthrough.
• Bolt.new export to production URL: tool-specific walkthrough.
• VibeDeploy's subprocessors and DPA.

If you're looking for a host in the EU with flat pricing and a public DPA: VibeDeploy was built for this. Hosted in Belgium, 14-day trial without a credit card, DPA on every paid plan.

Sources

• GDPR, Article 3 (territorial scope), Article 12 (one month to respond, extendable by two months), Article 28 (processor contract) and Article 33 (breach notification). Checked 13 October 2026.
• Vercel privacy notice, Netlify privacy policy and Cloudflare privacy policy: legal entities, addresses and US transfers. Checked 13 October 2026.
• Cloudflare, Data Localization Suite: an Enterprise-only paid add-on. Checked 13 October 2026.
• Plausible data policy and Fathom data isolation: cookies, consent banners, where data is processed, where each company is based. Matomo On-Premise: self-hosting on your own servers. Checked 13 October 2026.
• Formspark and GDPR and Tally GDPR: company location, data storage, DPA. Checked 13 October 2026.
• OVHcloud terms: OVH Groupe SA, Roubaix, France. Checked 13 October 2026.
• Anthropic Data Processing Addendum: Standard Contractual Clauses. Checked 13 October 2026.