The verdict in three sentences
A brokerage that collects health data through its quote forms must host that data inside the European Union, with a provider whose service carries recognised security certification (ISO 27001, BSI C5 in Germany), and keep 30-day backups. Shared hosting at 8 EUR a month remains acceptable for a brochure site with no sensitive form, not beyond. For a mid-sized broker, managed hosting at 80 to 250 EUR a month in a German or EU region is usually the best balance of cost, compliance and internal workload.
Why quote forms change everything
A private health or income-protection quote may ask for age, insurance status, medical history or a health questionnaire. Once that information is collected, GDPR (DSGVO) classes it as special category data under Article 9, which demands stronger safeguards. Data protection authorities also stress that any transfer outside the EU needs specific guarantees, best avoided by staying with a European provider or an EU region with encryption you control.
| Option (2026 order of magnitude) | Monthly price | EU region | Suited to health data | Internal technical load |
|---|---|---|---|---|
| Consumer shared hosting | 8 EUR | Yes | No | Low |
| VPS (Hetzner, IONOS, OVHcloud) | 20 to 60 EUR | Yes, Germany | Only with hardening and certified setup | High (updates, firewall) |
| German managed hosting | 80 to 250 EUR | Yes, Germany | Yes with certified offer | Low |
| AWS Frankfurt (eu-central-1) | 40 to 200 EUR depending on use | Yes | Yes, C5-attested services | Medium to high |
| Third-party form hosted in the US | 15 to 50 EUR | No | Avoid | Low |
European provider or AWS: the useful comparison
All of them offer data centres in Germany. The difference lies in applicable law, the certification of the exact service you use and ease of operation.
| Criterion | Hetzner / IONOS | OVHcloud | AWS (Frankfurt) |
|---|---|---|---|
| Headquarters and law | Germany | France | United States (Cloud Act exposure) |
| Security attestation | ISO 27001, C5 on some IONOS offers | ISO 27001, C5 on some offers | C5 and ISO 27001 on eligible services |
| Entry-level VPS | About 5 to 30 EUR | About 6 to 30 EUR | About 10 to 40 EUR (Lightsail or EC2) |
| Automatic 30-day backups | Paid option | Paid option | Snapshots billed per GB |
| Support in German | Yes | Yes | Paid for a real SLA |
| Billing complexity | Low | Low | High |
For a brochure site with a quote form, the simplest setup is often to split the flows: the public site on managed hosting, sensitive answers passed straight to the brokerage's management tool or certified storage, without keeping them in the site's database.
The cost of an incident
After a data breach, the controller must notify the supervisory authority within 72 hours and, if the risk is high, inform the people affected. The notification itself is free; crisis handling is what costs.
| Item after a leak (estimate for a 10-person firm) | 2026 cost |
|---|---|
| Technical and forensic analysis | 5,000 to 20,000 EUR |
| Legal advice and drafting the notification | 3,000 to 10,000 EUR |
| Informing 2,000 clients (letters, call centre) | 2,000 to 8,000 EUR |
| Restoring the site and hosting | 1,500 to 6,000 EUR |
| Possible regulatory fine | Up to 4% of global turnover, often thousands to tens of thousands of EUR for an SME |
| Estimated client loss | 3 to 8% of the book |
Mini case study
Lukas runs an 8-person insurance brokerage in Berlin. His site sits on 8 EUR a month shared hosting and stores about 1,500 health questionnaires a year in its WordPress database. He moves to certified managed hosting at 180 EUR a month, with immediate transfer to his brokerage software and purge from the site within 24 hours.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Extra annual cost: (180 - 8) x 12, or 2,064 EUR. Against that, a single leak would cost at least 11,500 EUR in direct fees according to the table, before any client loss. With a book generating 420,000 EUR of annual commission, a 3% loss means another 12,600 EUR. The extra cost equals less than 0.5% of commission.
FAQ
Must a broker use specially certified hosting?
Germany has no direct equivalent of France's HDS label, but Article 9 GDPR requires appropriate safeguards for health data. In practice, an EU provider with ISO 27001 or C5 and a signed data processing agreement is the expected baseline.
Is AWS Frankfurt GDPR-compliant?
The data stays in Germany, but AWS is a US company subject to the Cloud Act. The risk drops with encryption whose keys you manage and a documented impact assessment.
How long should backups be kept?
30 days is a good standard to restore after an attack discovered late. Beyond that, apply your GDPR retention period and purge.
Is a 20 EUR a month VPS enough?
Technically yes, but allow 2 to 4 hours a month of updates and monitoring, or 150 to 400 EUR of time if you outsource it.
What should we do in the 72 hours after a leak?
Contain the incident, document the facts, notify the supervisory authority (in Berlin, the Berlin Commissioner for Data Protection) and prepare client communication if the risk is high.
Let's scope your project. Describe your quote forms and current tools: we propose a compliant hosting architecture, the sensitive data flow and an indicative monthly budget. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
