The verdict in three sentences
For a Berlin company whose website collects personal data (forms, customer accounts), a European host such as OVH or Scaleway at 20 to 120 EUR excl. VAT per month offers the simplest GDPR compliance to document. Vercel Pro (20 USD per member per month, then 150 to 400 USD per month at high traffic) brings better deployment productivity, but requires framing the transfer to the United States with the Data Privacy Framework and standard contractual clauses. The right call for a CFO: price total cost over 3 years, legal risk and team time included.
2026 offer comparison
Prices below are 2026 estimates for a company website with 20,000 to 150,000 monthly visits, a contact form and a light customer area.
| Criterion | OVHcloud (VPS or Public Cloud) | Scaleway (Instances, Serverless) | Vercel Pro |
|---|---|---|---|
| Monthly cost, moderate traffic | 20-60 EUR | 25-70 EUR | 20 USD per member (3 members: 60 USD) |
| Monthly cost, high traffic | 60-120 EUR | 70-120 EUR | 150-400 USD |
| Data location | France, Germany (Frankfurt, Limburg) | France, Netherlands, Poland | EU regions available, US company |
| Latency from Berlin | 10-20 ms | 15-25 ms | 10-25 ms via CDN |
| CLOUD Act exposure | no (French company) | no (French company) | yes |
| Admin effort | medium to high (VPS) | medium | low |
| Certifications | ISO 27001, BSI C5 on some offers | ISO 27001, HDS | SOC 2 Type 2, ISO 27001 |
What the CFO must validate on GDPR
GDPR does not ban hosting with a US provider, but it requires documenting the transfer. Since July 2023, the Data Privacy Framework allows transfers to certified US companies. It remains contested and a new CJEU ruling could weaken it, as happened to Privacy Shield in 2020. German regulators, from the federal BfDI to the Berlin data protection authority, have historically taken a strict line on US transfers, so standard contractual clauses plus a transfer impact assessment are the expected safety net.
| Requirement | EU host | US host | Estimated effort |
|---|---|---|---|
| Processing agreement (Article 28) | standard | standard | 1 h review |
| Legal basis for non-EU transfer | not applicable | DPF + standard contractual clauses | 1-2 days of legal time |
| Transfer impact assessment | not applicable | recommended | 800-2,000 EUR of advice |
| Up-to-date records of processing | yes | yes, with transfer noted | 2 h |
| Privacy notice wording | EU location | third country and safeguards | 1 h |
| Risk if DPF is invalidated | none | migration needed | 3,000-8,000 EUR |
For sensitive data (health, HR), hosting with a European provider holding BSI C5 or equivalent certification becomes in practice the only comfortable option.
3-2-1 backups and continuity
Whatever the host, apply the 3-2-1 rule: three copies of the data, on two different media, one off site. The fire at OVH's Strasbourg datacentre in March 2021 showed that backups in the same building are not enough. In practice: nightly database backup, a copy to object storage in another region (2 to 10 EUR per month for 100 GB) and one restore test per quarter.
Mini case study
Julia, CFO of a 180-employee industrial SME in Berlin, compares two scenarios for the new website. Vercel scenario: 3 members at 20 USD plus 200 USD of traffic overage, i.e. 260 USD a month, about 240 EUR, plus 1,500 EUR of initial legal review. 3-year cost: 8,640 + 1,500 = 10,140 EUR. OVH Frankfurt scenario: 80 EUR a month and 4 hours of monthly admin at 60 EUR, i.e. 320 EUR a month. 3-year cost: 11,520 EUR, with no transfer risk. The 1,380 EUR gap over 3 years is lower than a forced migration (3,000 to 8,000 EUR) if the DPF fell: Julia picks OVH with automated deployment to cut admin time.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Is a brochure site without customer accounts affected by non-EU transfers?
Yes, as soon as it collects IP addresses, form data or analytics cookies. The volume is small, but the transfer must appear in the records and privacy notice, which takes 2 to 3 hours.
Can Vercel keep data in Europe?
Vercel lets you choose a European compute region, such as Frankfurt. The company remains subject to US law, so the transfer must be framed by the DPF and standard contractual clauses.
OVH or Scaleway for a German company?
OVH has German datacentres and is often 10 to 20 % cheaper on VPS. Scaleway offers simpler serverless and managed services for a small team, with datacentres in Paris and Amsterdam.
How much does a hosting migration cost?
For a modern company website, budget 3,000 to 8,000 EUR and 2 to 4 weeks, including tests and DNS switchover. A site built with containers from day one halves that cost.
Who is liable if the host suffers a breach?
The company remains the controller and must notify its supervisory authority within 72 hours. Fines can reach 4 % of global turnover, hence the value of a precise processing agreement.
Let's scope your project. Tell us about your website, the data you collect and your traffic, and we will recommend the right hosting with a 3-year total cost and a 3-2-1 backup plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
