Most "EU hosting" is a US company renting rack space in Frankfurt. The server sits in Europe, but the entity that controls it — and therefore your customers' data — answers to a US court order. For a genuinely GDPR-compliant EU VPS, the datacenter location is table stakes; what actually matters is who owns the legal entity, who owns the network, and which jurisdiction can compel disclosure. This is a note from our NOC on how we draw those lines, and which of those layers we can and can't keep inside the EU.
What "GDPR-compliant EU VPS" actually requires
GDPR does not ban international transfers outright, but it makes them expensive to defend. The moment your processor is a US-controlled entity, you inherit the US CLOUD Act — a law that lets US authorities compel a US company to hand over data it holds anywhere in the world, including its Frankfurt region. That is the exposure the Schrems II ruling was built around, and it is why "data stored in the EU" and "data outside US legal reach" are two different claims. A defensible setup needs three things aligned: an EU-established controller/processor, physical storage in EU datacenters, and a clear answer on how traffic leaves the provider's network.
NODED.CLOUD is operated by X ZONE IT SRL, a Romanian company — an EU legal entity under Romanian and EU law, billing in EUR. That is the part a datacenter pin on a map can't give you.
The sovereignty wedge: we own the network, not just the server
Here is where most "European sovereign cloud alternative" pitches get thin. They rent compute from a hyperscaler, so a US-controlled company sits in your processor chain. We don't resell hyperscaler compute. We run our own AS60982 — our own autonomous system, registered to X ZONE IT SRL at RIPE NCC and announcing the IPv4 space your VPS addresses come from — connected to the internet through IP transit from one upstream carrier, with no internet-exchange peering today. Data at rest stays in the EU location you pick; traffic to and from the internet takes whatever path the internet takes, as it does with any provider. You can read the details on our network page.
Owning the AS matters for GDPR specifically because it keeps your processor chain short and visible: the only other parties handling your server data are the data-centre and infrastructure partners in each location (hosting and network connectivity, named on request) and Cloudflare in front of the control panel, both listed on our sub-processor page. With a reseller, there is always another company — often US-headquartered — sitting between you and the metal. With us, the entity that provisions the VPS and announces its IP space is the same EU entity on your invoice.
EU data residency you can point at in a DPA
Data residency is a clause auditors read closely. Our VPS fleet in Romania, Bulgaria, Poland, the Netherlands, Germany and Austria runs in EU datacenters on enterprise SSD storage with unmetered traffic, in cities such as Amsterdam and Frankfurt — the same jurisdictions a German or Dutch controller wants to name in a Data Processing Agreement. For teams whose compliance team specifically asks for gdpr vps netherlands germany coverage, that is deliverable: we run VPS in both Amsterdam and Frankfurt, and the one caveat — control-panel traffic passes through Cloudflare's network — is spelled out in our DPA. Ashburn, our one VPS location outside the EU, is in the United States, so keep EU personal data on the other six.
Because the billing entity, the control-panel hosting and the storage are all EU-side, your Standard Contractual Clauses exercise gets shorter: the data on your server stays in the EU location you pick, and the one non-EEA sub-processor in the path — Cloudflare, which carries control-panel and browser-console traffic — is named on our sub-processor list with its safeguard (the EU–US Data Privacy Framework and Standard Contractual Clauses). We built the dedicated GDPR-compliant hosting use case around exactly this chain of custody.
An EU operator under EU law
X ZONE IT SRL is a Romanian company, an EU legal entity under Romanian and EU law, and data you keep in our six EU countries stays in the EU, on servers administered only by our staff in the EU. That is a fact about which company operates the service and where the disks sit, not a policy toggle in a dashboard. We are not promising we would refuse a US warrant — we are telling you plainly which entity holds your data and where it lives.
Payment is part of the same story. We accept card, SEPA, and BTC, so an EU customer can pay via a SEPA bank transfer without routing personal financial data through a US payment processor, and privacy-sensitive customers can settle in BTC.
Specs, tiers, and what you actually deploy
Sovereignty shouldn't cost a premium. Our hourly VPS line runs six tiers, billed by the hour so a short-lived compliance test environment costs cents:
| Tier | RAM | vCPU | SSD | Price |
|---|---|---|---|---|
| VPS I | 2 GB | 1 | 20 GB | EUR 4/mo (EUR 0.0056/hr) |
| VPS II (popular) | 4 GB | 2 | 40 GB | EUR 6/mo |
| VPS III | 8 GB | 2 | 60 GB | EUR 10/mo |
| VPS IV | 16 GB | 4 | 80 GB | EUR 16/mo |
| VPS V | 24 GB | 6 | 100 GB | EUR 30/mo |
| VPS VI | 32 GB | 8 | 120 GB | EUR 58/mo |
Every tier ships with root SSH, KVM virtualization, a dedicated IPv4 (plus free IPv6 in Romania, the Netherlands and Germany), a choice of 26 Linux and FreeBSD images, and a deploy time of about a minute. Backing all of it is 100 Gbps of DDoS protection included on every product and a 99.9% monthly availability target. Full specs live on the VPS hosting page, and if a compliance workload needs isolated hardware — single-tenant disks, more IPv4 (/29–/27 add-ons), your own /24 announced from our AS, or your own ASN and /24 over a BGP session with us — that moves to dedicated servers.
How Noded Can Help
If you are moving a workload off a US-controlled cloud to shrink your GDPR surface, we can stand up an EU VPS on our own AS60982 in about a minute and give your compliance team a clean chain of custody: EU legal entity, EU datacenters, our own EU-registered AS, SEPA billing. We are happy to walk through your DPA requirements before you migrate — where the data physically sits, which jurisdiction holds it, and how traffic leaves our network. Spin up the smallest tier hourly to validate the setup, and scale to dedicated hardware if your data residency clause calls for single-tenant isolation. Start on our GDPR-compliant hosting page.
FAQ
Is a VPS in an EU datacenter automatically GDPR-compliant?
No. Physical location is only one factor. If the provider is a US-controlled company, the US CLOUD Act can compel disclosure of data held in its EU datacenters. Compliance also depends on the operating entity's jurisdiction. NODED is operated by X ZONE IT SRL, an EU (Romanian) entity, with storage in the location you pick (six EU countries, or Ashburn in the US) and routing on our own AS60982.
Where does NODED stand on the US CLOUD Act?
The CLOUD Act attaches to US-established companies. X ZONE IT SRL is a Romanian company under Romanian and EU law, and data you keep in our six EU countries stays in the EU, on servers administered only by our staff in the EU; keep EU personal data out of Ashburn, our US location.
Where is my data physically stored?
In the location you pick. In Romania, Bulgaria, Poland, the Netherlands, Germany and Austria it sits on enterprise SSD storage in EU datacenters, reachable on IPv4 addresses announced by our own AS60982; Ashburn is in the United States. Data at rest stays there; traffic to and from the internet leaves through our upstream transit carrier.
Can I pay without using a US payment processor?
Yes. We accept SEPA bank transfer and BTC alongside card, so EU customers can settle in EUR without routing financial data through a US processor.
What does the smallest GDPR-compliant EU VPS cost?
VPS I starts at EUR 4/mo, or EUR 0.0056/hr billed by the hour, with 2 GB RAM, 1 vCPU, and 20 GB SSD. It includes 100 Gbps of DDoS mitigation, root SSH, a dedicated IPv4 (IPv6 free in Romania, the Netherlands and Germany), and a 99.9% availability target — enough to validate a compliance setup before scaling up.