Hosting and the cloud

02The layers of hosting

Cloud providers offer their services at different levels. The higher the level, the less a team has to look after itself.

• Virtual machines: a rented server on which a team installs and maintains everything itself, from the operating system upwards. Flexible, and the most work.
• Managed services: the provider runs a part of the system, such as a database, and takes care of updates, backups and failover. The team only uses it.
• Platforms: the team hands over its code, and the platform builds it, runs it and scales it. Vercel works this way for Next.js applications.
• Software as a service: a finished product rented per user, such as Microsoft 365 or a CRM. Nothing is hosted by the customer at all.

03What an application typically uses

A business application rarely runs on a single service. A typical setup has a few parts, often from different providers.

• Application hosting: runs the pages and the server code.
• Database: stores the records, with automatic backups.
• File storage: holds uploads such as PDFs and images.
• Email sending: delivers sign-in links and notifications.
• Scheduled jobs: tasks that run at fixed times, for example a data import every night.
• AI models, where the application uses them: called through the provider's interface and billed per use.

04Where the data is, and which law applies

Every cloud provider lets you choose a region, which is the location of the data centre that holds the data. For personal data under the GDPR, a region in the EU is the simplest choice, because it avoids transfers to third countries that need extra legal safeguards.

The provider's home country also matters. The large providers are US companies, and US law can in some cases require them to hand over data, even if it is stored in Frankfurt. In practice this is handled with data processing agreements, the EU's standard contractual clauses and the EU-US Data Privacy Framework. Companies with very strict requirements choose European providers, which have a smaller range of services.

Every provider that processes personal data on your behalf needs a data processing agreement under Art. 28 GDPR. The large providers include one in their terms.

05Whose account it is

An often overlooked question is whose name the hosting account is in. Whoever holds the account controls the data, the access and the bills. If an agency hosts a client's application in its own account, the client depends on that agency for every change, and a handover later means moving data.

Accounts in the client's name avoid this. The client invites the developers, can remove them at any time and sees every bill directly.

06What it costs

Cloud services are billed by usage: computing time, stored data, data transferred, number of requests. Most platforms have a fixed monthly base fee per team plus usage on top. For an internal application with a few dozen users the monthly costs are usually modest; a public application with heavy traffic, large files or many AI calls costs more.

Costs can rise unexpectedly, for example when a scheduled job runs more often than intended. Budgets and spending alerts, which every large provider offers, catch this early.

07How we do it

We host in the EU, usually in Frankfurt. Applications run on Vercel, databases on Neon, both in Frankfurt. Where a client already works with Microsoft, we use Microsoft Azure, with data stored in the Germany West Central region. AI models run through Amazon Bedrock in Frankfurt or Microsoft Azure in the EU.

We set up the accounts in the client's name from the start, or move them there at handover. From then on the client pays the providers directly and decides who has access. We switch off our own access when it is no longer needed.

Frequently asked questions