Best Hosting Provider for Sensitive Data: How to Vet One

If you are choosing a host for data that someone else regulates, the decision is not really about hardware. It comes down to whether the provider will hand you three things: a current third-party audit report whose scope actually covers the service you are buying, a signed contract that carries the obligations your own regulator puts on you, and a list of the sub-processors your data will pass through. A provider that cannot produce those is not a candidate, however good the specifications look.

That is the short answer. The rest of this guide is the long one: what PCI DSS, HIPAA, GDPR and SOC 2 actually demand of a hosting arrangement, which parts of the job stay yours no matter who you buy from, the five documents to ask for by name, and how to tell a real answer from a marketing one. We are also blunt about our own product near the end, because for a regulated workload the honest answer is not always the one that sells hosting.

Key Takeaways

• None of these frameworks certifies a host in the way vendors imply. Two of them produce reports about a defined scope over a defined period. Two of them produce contractual obligations. There is no government badge to look for.
• Ask for the report itself, then read the scope, the period covered and the exceptions section. A provider that offers only a logo or a one-page summary has already answered your question.
• A host that stores protected health information is a business associate under the HIPAA rules and needs a signed agreement. Encrypting the disk does not turn it into a mere conduit.
• GDPR Article 28 requires a written processor contract, a sub-processor list and prior authorisation for changes. For card data, the strongest move is almost always to shrink your scope so the numbers never touch your server.
• Responsibility is always split. Even on a hyperscaler you still own the operating system, the application, the access control and the log retention.
• Devoster is a general-purpose host and holds no security certifications. If your workload is regulated, buy from a provider that does. That section is near the end and it is not a soft sell.

Start With the Rulebook, Not the Provider

Most bad hosting decisions in this space start with a search for secure hosting and end with whichever vendor used the word compliant most often. Reverse the order. Work out which rulebook binds you, then find providers that can satisfy it, then compare specifications among the survivors.

Four categories cover the overwhelming majority of real cases:

• Payment card data. If your systems store, process or transmit primary account numbers, the Payment Card Industry Data Security Standard applies to you through your acquiring bank and the card brands, not through a government regulator.
• Health information in the United States. If you are a covered entity or you handle protected health information on behalf of one, the HIPAA Security and Privacy Rules apply, and they reach your vendors through contract.
• Personal data of people in the EU, the UK or a similar regime. GDPR and its equivalents apply to you as a controller and reach your host as a processor.
• Data that is sensitive but not regulated. Trade secrets, unreleased financials, legal files, customer lists. No auditor is coming, but a breach still ends the conversation with your biggest client.

The fourth category is the one people misclassify most often, usually in the direction of over-buying. If nobody can fine you and nobody can audit you, you do not need a compliance-specialist host. You need good engineering, which costs far less.

What Each Framework Actually Requires of a Host

PCI DSS: reduce scope before you go shopping

PCI DSS is maintained by the PCI Security Standards Council and applies to every entity involved in payment card processing, including service providers. Validation happens through a Qualified Security Assessor producing a Report on Compliance, or through a self-assessment questionnaire, depending on your volume and how you handle card data. The document you actually collect from a vendor is the Attestation of Compliance.

Here is the part that saves most small merchants a fortune. If you use a hosted payment page or an iframe from your payment provider, card numbers never reach your server, and your own assessment burden collapses to the simplest questionnaire. If you build a custom checkout that posts card numbers to your application, everything that touches that data lands in scope, including the host.

So the first question is not which host is certified. It is whether you can redesign the payment flow so that the answer stops mattering. Most stores can.

HIPAA: the signed agreement is the whole game

HIPAA has no certification programme. The US Department of Health and Human Services does not issue, endorse or recognise a compliance badge, which means every certified logo you see in this space came from a private assessor applying its own criteria. That is not worthless, but it is not what your regulator asked for.

What matters is status. A vendor that creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate, and needs a signed business associate agreement before any data moves. The narrow conduit exception covers services that merely transmit data, like a network carrier. It does not cover a host that stores the data, and HHS has said so directly in its guidance on cloud computing and HIPAA. A provider that stores encrypted health records and never holds the key is still a business associate.

Practical test: email the provider, ask whether they execute a business associate agreement, and ask to see the template. Vendors that do this routinely will send it within a day. Vendors that do not will change the subject.

GDPR: a contract, a list and a transfer route

Under the GDPR you are usually the controller and the host is your processor. Article 28 requires a written contract that sets out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subject, and it requires the processor not to engage another processor without your prior authorisation. That last clause is the one people skip, and it is why the sub-processor list matters as much as the contract.

Article 32 requires appropriate technical and organisational measures, which is deliberately open-ended. Article 33 gives you seventy-two hours to notify your supervisory authority once you become aware of a qualifying breach, which is only achievable if your host commits contractually to telling you fast. Ask for the notification window in hours, in writing.

If personal data leaves the EEA you also need a lawful transfer route under Chapter V, whether that is an adequacy decision, standard contractual clauses or another mechanism. These have been litigated repeatedly, so check the current status of whichever one you plan to rely on rather than trusting a page written three years ago.

SOC 2 and ISO 27001: reports and certificates, not badges

SOC 2 is an attestation examination carried out by a licensed CPA firm under AICPA standards against the Trust Services Criteria. Nobody is SOC 2 certified. They have a report, and the report only becomes meaningful once you have read four things in it.

• Type. Type I describes whether controls were suitably designed at a single point in time. Type II tests whether they operated effectively across a period, commonly three to twelve months. Type I is a starting position, not an answer.
• Scope. Which systems and which services. A report scoped to a company's corporate platform tells you nothing about the shared hosting product you are buying.
• Period. A report covering a window that ended eighteen months ago is stale. Ask when the next examination completes.
• Exceptions and user entity controls. The exceptions list is where the auditor records what failed. The complementary user entity controls section lists the things you must do for the provider's controls to work at all. Read that list before you sign, because it is your homework.

ISO 27001 works differently. It certifies an information security management system against a standard, and the certificate comes with a Statement of Applicability that tells you which controls were included and which were excluded with justification. A certificate without the Statement of Applicability is half a document.

The Shared Responsibility Split Nobody Explains at Sign-Up

Every compliance conversation eventually collapses into an argument about who was supposed to patch the thing. Settle it in advance. The table below shows where responsibility usually sits across the common hosting models. It is a general pattern rather than a contract, and your provider's own responsibility matrix always wins.

Control area	Shared hosting	Unmanaged VPS	Managed platform	Hyperscale cloud
Physical and facility security	Provider	Provider	Provider	Provider
Hypervisor and host kernel	Provider	Provider	Provider	Provider
Guest operating system patching	Provider	You	Provider	You, unless serverless
Application code and dependencies	You	You	You	You
Identity, roles and multi-factor	You	You	Shared	You
Encryption keys and rotation	Provider default	You	Shared	You, with a key service
Log retention and tamper resistance	Limited, provider set	You	Shared	You
Backup testing and restore drills	You	You	Shared	You
Breach notification to your regulator	You	You	You	You

Read the last row twice. No hosting contract transfers your notification duty. The provider tells you, you tell the regulator, and the clock started the moment you became aware.

The Five Documents to Ask For, by Name

Send this as a single email before you compare prices. The speed and shape of the reply is itself the most useful signal you will get.

1. The current audit report, under NDA. Not the badge, not the trust page. The report, with its scope statement, period, exceptions and complementary user entity controls.
2. The signed agreement your framework requires. A business associate agreement for health data, a data processing agreement carrying the Article 28 clauses for personal data of EU or UK residents, or the attestation of compliance for card data.
3. The sub-processor list, with a change notification commitment. Who else touches the data, in which country, for what purpose, and how much notice you get before that list changes.
4. The data location and residency statement. Where primary data lives, where backups live, and where support staff sit when they access systems. Support access is the one people forget and auditors do not.
5. The incident and breach process. The notification window in hours, who is contacted, which forensic artefacts you receive, and how long logs are retained by default.

How to grade the reply

• If they send the report under NDA within a couple of business days, they have done this before. Now read the scope.
• If they send a trust centre link with logos and no document, ask once more, specifically for the report. If the second answer is also a link, treat the answer as no.
• If the scope covers a different product line than the one you are buying, it does not count. This is the single most common trick in the category.
• If the report is a Type I and the sales note calls it a full audit, they are either misinformed or hoping that you are.
• If they will not name their sub-processors, you cannot complete your own record of processing activities, so the deal fails on your side regardless of their security.
• If they say certification is on the roadmap, that is a fine thing to hear from a young company and a useless thing to rely on for a deployment happening this quarter.

Which Class of Provider Can Actually Give You This

Individual vendors change their posture constantly, so compare classes first and verify the specific company second. Everything below should be confirmed against a provider's own current documentation before you sign anything.

Provider class	Typical audit evidence	Signs a BAA?	Isolation model	Where it fits
Hyperscale cloud (AWS, Azure, Google Cloud)	Broad report portfolio, published scope per service	Usually, for a defined subset of services	Virtual private network per tenant, dedicated options	Regulated workloads with in-house engineering
Compliance-specialist host	Focused reports, often health or card specific	Usually, as a standard part of onboarding	Dedicated or single-tenant virtual servers	Small regulated teams without a cloud engineer
Managed application platform	Varies widely, often inherits an upstream cloud	Sometimes, on higher tiers only	Container or account level	Teams who want the platform to own patching
General-purpose shared and VPS host	Usually none	Rarely	Account level, or virtual machine level	Sites and applications that are not regulated
Colocation and bare metal	Facility level only, rarely covers your stack	Sometimes for the facility	Physical	Organisations with their own security team

The row that surprises people is the managed platform one. Inheriting an upstream cloud's report does not give you the platform's own controls. Ask whether the platform has been examined itself, or whether it is pointing at its supplier's homework.

Where Devoster Fits, and Where It Does Not

You are reading this on a hosting company's blog, so here is the direct version.

Devoster is a general-purpose host. We sell shared hosting with cPanel, managed WordPress, Node.js hosting, unmanaged KVM virtual servers with full root access, reseller hosting, dedicated servers and domain registration. Virtual servers run on Intel Xeon Gold 6138 processors with NVMe storage and a 1 Gbps link, with unlimited bandwidth, one IPv4 address, DDoS protection and free migration, in a single US-South location. Shared hosting starts at $2.90 per month for Lite and $5.90 per month for Standard, with a Pro tier above that.

Now the part that matters for this article. We hold no security certification of any kind. There is no SOC 2 report to request, no PCI DSS attestation of compliance and no ISO 27001 certificate. We do not execute business associate agreements, we do not publish a data processing agreement as a standard product, and we publish no service level agreement or availability commitment. Our virtual servers are unmanaged, which means operating system patching, hardening, log retention and key handling are entirely yours.

If your workload falls into the first three categories at the top of this article, that list should end your evaluation of us, and we would much rather you learn it in ten minutes here than three months into a deployment with an auditor on the phone. Buy from a provider whose evidence you can put in front of your own regulator.

If your data is sensitive but nobody regulates it, that is a completely different conversation, and a general-purpose virtual private server with full root access is a perfectly reasonable place to run it.

Sensitive but Unregulated: Getting the Engineering Right

This is where most readers actually land. No auditor, real consequences. The controls that matter are unglamorous and mostly free.

• Shrink the blast radius first. Do not store what you do not need. Purge old exports, drop unused columns, set a retention period on anything containing personal data and enforce it with a scheduled job.
• Separate environments properly. A test copy of production data is a production system with weaker passwords. Use anonymised fixtures instead.
• Key handling beats disk encryption. Full-disk encryption protects against a stolen drive and nothing else, because a running server has the volume mounted. Application-level encryption for the two or three fields that genuinely matter is worth more than encrypting everything badly.
• Ship logs off the box. An attacker with root can rewrite local logs. Forward authentication and application logs somewhere the web server cannot delete.
• Test the restore, not the backup. A backup you have never restored is a hypothesis. Put a quarterly restore drill in the calendar and time it, because that number is your real recovery objective.
• Lock down administrative access. Key-based SSH only, no password authentication, no shared accounts, and multi-factor on the control panel and the domain registrar. Registrar takeover is a faster route into your data than your firewall.

Our VPS security hardening checklist works through these as concrete commands, and the website security best practices guide covers the application layer. Neither of them turns an unregulated setup into a regulated one, and neither claims to.

What This Actually Costs

Hosting that can support a compliance programme is priced differently, and the gap is mostly people rather than silicon. You are paying for an audit programme, a legal team that will sign agreements, and support staff who can answer an auditor's question in writing. Expect an order-of-magnitude difference between a general-purpose plan and a health-specific or card-specific environment at equivalent compute.

Three costs that get missed in the first budget: the assessor's fee if you need a report of your own, the engineering time to implement the complementary user entity controls the provider's report hands you, and log storage, which grows quietly and is often billed separately once retention goes past a few weeks.

One useful sanity check before you spend anything. If the regulated part of your system is a single form or a single table, consider moving just that part to a specialist provider or a purpose-built service, and leaving the marketing site, the blog and the documentation on ordinary web hosting. Splitting the estate is usually cheaper than lifting everything into an expensive environment, and it makes your scope statement much easier to write.

Frequently Asked Questions

Which certifications does Devoster hold?

None. There is no third-party attestation report, certificate or audit summary to request, because no such examination has been carried out. If a compliance framework binds your project, that answer should remove us from your shortlist, and we would rather say so plainly than let you discover it later.

Can I run a HIPAA workload on Devoster?

No. Storing protected health information on behalf of a covered entity makes the host a business associate, and that requires a signed business associate agreement. We do not execute one, so there is no lawful arrangement to build on. Choose a provider that offers the agreement as a standard part of onboarding.

Is a host with a SOC 2 report automatically safe for my data?

No. The report describes a defined scope over a defined period, and it may not cover the product you are buying. Read the scope statement, the period, the exceptions section and the complementary user entity controls, which list what you must do yourself. A report is evidence, not a guarantee.

Does encrypting data mean my host is not a business associate?

No. The conduit exception is narrow and covers services that only transmit data, such as a network carrier. A provider that stores encrypted health records is still maintaining that information, and remains a business associate even without access to the keys.

Do I need certified hosting to take credit cards?

Usually not, if you never touch the card number. Using your payment provider's hosted page or iframe keeps account numbers off your server and reduces your own validation to the simplest self-assessment questionnaire. Build a custom checkout that receives card data and your host lands in scope alongside you.

What if a provider will not show me the audit report?

Treat that as the answer. Providers who hold real reports share them under a routine non-disclosure agreement, usually within a day or two. A trust page with logos, a sales deck slide, or a promise that certification is in progress is not evidence you can hand to an auditor or a customer.

Is sensitive data always regulated data?

No, and conflating the two wastes budget. Trade secrets, legal files and unreleased financials deserve serious engineering but attract no auditor. If no regulator can fine you and no customer contract requires an attestation, spend on backups, access control and log handling rather than on a compliance-specialist plan.

Your Next Step

Write down which of the four categories your data falls into, then send the five-document email to every provider on your shortlist before you look at a single price. The replies will shorten the list faster than any comparison table, including this one.

If your answer is the fourth category, sensitive but unregulated, then a well-configured VPS or a straightforward shared hosting plan with disciplined backups and tight access control will serve you well, and we would be glad to have you. If your answer is one of the first three, buy from someone who can produce the paperwork, and come back to us for the parts of your estate that are out of scope.