Server location

What we check

We use the IP address of the website to determine in which country the server is located. From the responses of the server and from the DNS records we also recognise whether the website is delivered via a content delivery network (CDN) such as Cloudflare, Fastly or Amazon CloudFront.

We judge the location by the rules of the market you start the check in:

• In the market itself (EU and EEA for Germany, the UK, Switzerland and Liechtenstein): fine.
• In a country with adequate data protection recognised by the market: note. Permitted, but belongs in the privacy policy.
• Elsewhere: warning. This has to be stated in the privacy policy and needs additional safeguards.
• United States and international version: note with the country. There is no rule on the location, but the privacy policy should name it.
• CDN: note. Visitor data passes through this provider, the location depends on the visitor.

This is an automatic preliminary check, not legal advice.

Why it matters

Every visit to the website transmits personal data to the server, at least the IP address, often form input as well. Privacy laws in the EU, the UK and Switzerland restrict transfers to countries without adequate data protection and require the privacy policy to name them.

• EU and EEA: transfers within the EEA are free. The EU Commission recognises further countries as adequate, among them Switzerland, the UK, Japan and Canada.
• USA: under the EU-US Data Privacy Framework (and its UK and Swiss extensions) transfers to certified providers are permitted, to others additional safeguards such as standard contractual clauses are needed.
• Other countries: as a rule standard contractual clauses or comparable safeguards are needed.

Many websites are with international providers without the operators knowing, for example because the agency chose a cheap server abroad.

How to fix it

Complete the privacy policy

In every case name:

• the hosting provider,
• the country of the server location,
• with a CDN the provider, and that data may be processed worldwide,
• for countries without adequate data protection, the safeguards relied on.

Choose the location deliberately

Most hosting providers let you choose the data centre region. For simple websites a move is usually done in a few hours. With website builders such as Wix or Squarespace the location cannot be chosen; then the correct statement in the privacy policy is enough.

Use a CDN deliberately

A CDN makes a website faster and protects against attacks. If one is used, it belongs in the privacy policy.

How to check it yourself

Ask the hosting provider or look in the customer area to see in which data centre the website is located. Online IP lookup services show the country for the IP address of the domain.

Frequently asked questions

May a European website be hosted in the USA?

Yes, if the transfer is safeguarded, for example because the provider is certified under the EU-US Data Privacy Framework or uses standard contractual clauses. And it has to be stated in the privacy policy.

Why does the check show a different country from the one the hosting provider states?

We determine the location via the IP address. With a CDN or an upstream protection service we see its server, not the actual hosting server. Databases of IP origin are also not always exact.

Is this legal advice?

No. We show where the server is technically located. What obligations arise from this is for a professional to judge.