Cloud hosting: what compliance means for your data

'Where is my data?' is usually the first real question a prospective client asks once the demo is over. It's a fair question, and the honest answer has two parts, not one: the marketing site you're looking at right now runs on different infrastructure than the data your CRM, dashboard or automation stack actually stores. It's also the question most agencies answer vaguely, because most agencies genuinely don't know — the infrastructure decision was made once, years ago, by whoever first set up hosting, and nobody has revisited it since.

Two different things share the word 'hosting'

Our own legal notice states it plainly: this website runs on Vercel Inc., a United States company. That's the public marketing site — pages, a contact form, an opt-in newsletter signup, nothing that needs a data-processing jurisdiction guarantee beyond what it already gets. The systems we build for clients are a different matter entirely: CRM bridges, KPI dashboards, custom platforms, all the places where leads, call records, invoices and — for training organisations — trainee files actually live. That data is hosted in the EU, in France, for every client we run, without exception.

That split isn't an accident of tooling — it's a deliberate boundary. The marketing site needs to be fast and cheap to run globally; the systems holding a client's actual business data need a jurisdiction guarantee that a generic global host doesn't promise by default, so the two never share infrastructure.

What 'hosted in the EU' actually commits to

• Client data hosted in the EU (France)
• Encrypted daily backups
• Security patches applied as part of the plan, not as a special request
• Uptime monitoring with alerts
• A monthly health report
• Data export on request, at any time — never held hostage

A data-processing agreement is available on request for any client whose own compliance file needs one — the standard GDPR processor relationship, documented rather than assumed. That paperwork exists because a client's own auditor may ask for it, not because we expect most clients ever will.

What the marketing site itself doesn't do

Even hosted in the US, this site is built to need nothing beyond what it already discloses: visit statistics run on Vercel Web Analytics, which sets no cookies and stores no personal identifiers, and the site carries no advertising or tracking cookies at all. The compliance question about the marketing site mostly answers itself once you look at what it actually collects — very little.

Why this isn't specific to training organisations

Qualiopi organisations feel this most directly because their audit files make the stakes explicit, but the same guarantee applies to every client: a CRM bridge holding lead phone numbers, a dashboard showing seller performance, call recordings synced from a phone system — all of it personal data under GDPR, all of it hosted in the EU by default, whether or not a client ever thinks to ask the question. The same rule applies whether a client is a five-store retail group or a single-location consultancy — the hosting guarantee doesn't scale down.

Why this matters more for some clients than others

A Qualiopi-certified training organisation handles a lot of personal data as a matter of course: trainee records, session attendance, certification evidence. For a client like Formalthys — CRM and trainer portal, 12 n8n flows automating trainer scheduling and transactional email — EU hosting isn't a nice-to-have sitting next to the feature list. It's close to a prerequisite for their own audit file, given how much of what a training organisation has to prove is personal data about real people. GDPR compliance gets built in parallel with everything else during the build itself — accessibility, tests, performance — not bolted on afterward because a client happened to ask.

How this shows up in the contract

None of this is an upsell. It's one line on the services ladder, right next to uptime monitoring and the monthly report, included at every tier from the first Run engagement onward. A client who decides to leave, for any reason, takes the data with them: the export commitment listed above isn't a footnote, it's the actual test of whether 'your data, hosted in the EU' means anything in practice.

The training page covers what this looks like for a Qualiopi organisation specifically: /training. The Formalthys case study has the fuller picture: /work/formalthys.