Compliance
GDPR & data processing at BearHost
If you run a business in the EU, UK or Switzerland and put personal data on a BearHost server, this page tells you where that data lives, who can touch it, and gives you the Article 28 agreement your auditors will ask for. Everything here describes how the platform actually runs today.
The short version
- Your servers are in the EU. VPS disks live on hardware we operate in Eygelshoven (Netherlands) and Paris (France). You choose the location at checkout.
- We are a processor, and an unmanaged one. We never log in to your server and hold no credentials for it. Our access stops at the hypervisor and is logged.
- A signed DPA is one click away, with the EU Standard Contractual Clauses built in. Use the request button below; we return it signed, normally the same business day.
- Breach notification within 48 hours. Deletion at termination. Sub-processors listed below with 14 days’ notice of changes.
- Operated by Bearhosting LLC, 1908 Thomes Ave STE 64828, Cheyenne, WY 82001, USA. Questions to support@bearhost.com.
Where your data lives
| Data | Where | Notes |
|---|---|---|
| VPS disks (Netherlands plans) | SkyLink Data Center, Eygelshoven, Limburg, Netherlands | Local NVMe storage on hypervisors we operate |
| VPS disks (France plans) | Paris, France | Local NVMe storage on hypervisors we operate |
| Automated backups (optional add-on) | Backblaze, USA or EU region | Off by default. Tell us if you need the EU region before enabling. |
| Account and billing records | United States | Name, company, email, invoices, tickets. Never the content of your servers. |
Data Processing Agreement
Article 28 of the GDPR requires a written contract between you (the controller) and any company that stores personal data for you (the processor). Our standard agreement covers every point the article lists, names our sub-processors, describes our security measures as they really are, and incorporates the EU Standard Contractual Clauses for the transfer to Bearhosting LLC as a US-established processor, governed by the law of the Netherlands.
Request your signed DPA
Opens a pre-filled ticket in your client area. Standard DPA version 2026-10.
- Click the button. If you are not logged in you will be asked to sign in first; the request form is then pre-filled for you.
- Add your company’s legal name, registered address, country and the name and title of your signatory.
- We return the agreement signed for Bearhosting LLC on the ticket, normally the same business day.
- You countersign and return it on the ticket. It is in force from that date.
Need a clause adjusted for your sector? Say so in the request; reasonable changes are made at no cost.
Article 28 checklist
For compliance teams: each processor obligation and how we meet it.
| Requirement | How BearHost meets it |
|---|---|
| Process only on documented instructions (Art. 28(3)(a)) | Unmanaged service: we never log in to your server. Hypervisor actions happen only when you trigger them in the dashboard or ask on a ticket. Every action is logged. |
| Confidentiality of authorised persons (28(3)(b)) | Administrative access is limited to the company owner and operations tooling, all bound by confidentiality obligations. |
| Security measures under Article 32 (28(3)(c)) | KVM isolation, key-only restricted admin access, brute-force protection, logging, 2FA and passkeys on customer accounts. Details below. |
| Sub-processor conditions (28(3)(d), 28(2), 28(4)) | Published list below, 14 days’ notice of changes, same obligations flowed down by contract. |
| Assistance with data-subject requests (28(3)(e)) | You hold the data and the keys; we provide access, exports and console operations on request so you can respond to your data subjects. |
| Assistance with Articles 32–36 (28(3)(f)) | Breach notification within 48 hours, cooperation on investigation, information for your DPIAs on request. |
| Deletion or return at end of service (28(3)(g)) | Export any time while active; virtual disks are deleted at termination; backups deleted within 30 days. |
| Information and audits (28(3)(h)) | Written answers within 15 business days; one documentation audit per year on 30 days’ notice. |
| Transfers outside the EEA (Chapter V) | EU Standard Contractual Clauses (2021/914, Module Two) incorporated in the DPA, governed by Dutch law. |
Who can access your server
BearHost VPS are unmanaged. You install the operating system, you hold the passwords and keys, and we do not log in. Our administrative access is to the virtualisation layer only: power control, console, reinstall and password reset, used when you trigger them from the dashboard or ask on a ticket, or where strictly necessary to protect the shared infrastructure.
That access is held by the company owner and our operations tooling, is key-based, restricted by source address and logged in both our control panel and your account activity log. Bearhosting LLC is a US company, so we do not claim that administrative access is exclusively from inside the EEA; the Standard Contractual Clauses in the DPA are the legal safeguard for that.
Sub-processors
Companies that can touch customer data or account data in providing the service. We give DPA customers 14 days’ notice before adding or replacing one.
| Provider | Purpose | Location | Data | Transfer basis |
|---|---|---|---|---|
| Tube-Hosting (SkyLink Data Center) | Physical hosting and network for the Netherlands servers | Eygelshoven, Netherlands | Server disks and traffic | EEA |
| VirtFusion | Virtualisation control panel | United Kingdom (vendor); control plane run by us | Server metadata (names, IPs, resources), no disk content | UK adequacy decision |
| DigitalOcean | Hosting of billing system and control plane | New York, USA | Account and billing data, server metadata | Standard Contractual Clauses |
| Vercel | Website and customer dashboard hosting | USA | Account data in transit | Standard Contractual Clauses |
| Stripe | Card payments | Ireland / USA | Payment and billing data | SCCs / Data Privacy Framework |
| Cryptomus | Cryptocurrency payments | Lithuania | Payment reference data | EEA |
| Mailgun (Sinch) | Transactional email | USA | Account email content | Standard Contractual Clauses |
| Cloudflare | DNS and web delivery | USA / global edge | Website traffic metadata | SCCs / Data Privacy Framework |
| Backblaze | Backup storage (only if you enable the backup add-on) | USA or EU, your choice | Full server backups | SCCs; EU region available |
Security measures
- Physical: Tier 3 data centres with controlled access, CCTV and redundant power and cooling.
- Isolation: KVM virtualisation with dedicated vCPU, RAM and disk per server; RAM is never oversold.
- Administrative access: SSH key-only, restricted by source address, brute-force protection, host firewalls, every control-panel action logged with actor and time.
- Your account: two-factor authentication and passkeys available; all logins and actions recorded in your activity log.
- Encryption: TLS on every panel and API. Disks are not encrypted at rest at the hypervisor level today; we recommend LUKS or BitLocker inside your server so only you hold the keys. Hypervisor-level encryption at rest is on the roadmap.
- Backups: none unless you enable the add-on; then daily, encrypted, seven restore points, in the region you choose.
- Deletion: virtual disks deleted at termination and storage reused; backups deleted within 30 days.
Incidents and breaches
If an incident affects your server or the infrastructure it runs on, we notify you without undue delay and in any event within 48 hours of becoming aware, by email to your account address and through the notice in your client area, with what we know about the nature of the incident, the data concerned and the steps taken, so you can meet your own 72-hour obligation to your supervisory authority. Live and historical availability is public at status.bearhost.com.
Your rights and your customers’ rights
For the data on your servers you are the controller: you can export, correct or delete it at any time, and we assist with access, exports and console operations when you ask. For your own account data held by us, you can view and update it in the client area, request a copy, or ask for deletion once your services have ended and the period required by tax and accounting law has passed. Send requests to support@bearhost.com from your account email.
Our Privacy Policy covers how we handle visitor and account data as a controller; this page and the DPA cover how we handle your data as a processor.
Frequently asked
Is my VPS data stored in the EU?
Yes. VPS disks are stored on hypervisors we operate in the SkyLink Data Center in Eygelshoven, Netherlands, and in Paris, France. The data does not leave the location you chose unless you enable the optional backup add-on and pick a storage region outside the EEA. Your account and billing records are held in our billing system hosted in the United States.
Do you provide a GDPR Article 28 Data Processing Agreement?
Yes. Use the "Request your DPA" button on this page: it opens a pre-filled support ticket in your client area. Add your company’s legal name, registered address, country and signatory, and we return a signed copy, usually the same business day. You countersign and it is in force.
Bearhosting LLC is a US company. How are transfers to the US covered?
The DPA incorporates the European Commission’s Standard Contractual Clauses (Decision 2021/914, Module Two, controller to processor), governed by the law of the Netherlands. We do not rely on, and are not certified under, the EU-US Data Privacy Framework.
Can BearHost staff access the data on my server?
Not in the ordinary course of the service. BearHost VPS are unmanaged: we hold no operating-system credentials and do not log in. Our access is at the hypervisor level only (power, console, reinstall, password reset), used when you ask for it or to protect the shared infrastructure, and every action is logged in your account activity log.
Are disks encrypted at rest?
Not at the hypervisor level today. We recommend enabling full-disk encryption inside your server (LUKS on Linux, BitLocker on Windows) so that you alone hold the keys. Hypervisor-level encryption at rest is on our roadmap and this page will be updated when it ships.
How quickly do you notify a data breach?
Without undue delay and in any event within 48 hours of becoming aware, by email to your account address and through the notice in your client area, with the information you need for your own 72-hour notification to the supervisory authority.
Last reviewed 30 October 2026. This page is kept in step with the standard DPA (version 2026-10); when a location, sub-processor or security measure changes, both are updated together.