Trust and security: where your data lives and who can reach it

CloudHosting stores client data in its own data centre in Riga, Latvia, inside the EU, unless you order a service in another location. VPS and dedicated servers ordered for the Netherlands, the ready 10 Gbps servers included, run in Amsterdam, S3 object storage is replicated across several data centres in the EU, and capacity in Dubai (DXB1) is brought online only on request, for projects that need a location outside the EU. You choose the location when you order, so it is known before the contract. Web hosting, server colocation, the company infrastructure we run, and VPS and dedicated servers ordered for Riga stay in Riga.

The CloudHosting data centre in Riga is guarded, and visitors, clients included, are not admitted to it. Clients bring their equipment to our office and hand it over there, and our engineers install it in the rack; access to the data centre itself is limited to a small number of our own specialists. We keep the public description of physical security to this outline on purpose and do not publish the measures in detail. Power, cooling and network redundancy are described separately, above on this page and on the data centre page.

The CloudHosting data centre in Riga follows a Tier 3+ design: N+1 power with UPS and a diesel generator, N+1 cooling and two uplinks behind a BGP core. N+1 means every critical component has at least one independent reserve, so a part can fail or be taken out for maintenance while the load carries on. Tier 3+ describes how the site is built; it is not a certificate issued by an outside body. The data centre page shows the redundancy scheme with the paths for power, cooling and network.

CloudHosting keeps daily VPS backups for 7 days and daily web hosting backups for 14 days, in both cases on storage separate from the server itself. On web hosting you can restore a single file, a database or the whole account from cPanel yourself. For company infrastructure we run, the backup schedule, the retention and the recovery targets are written down for each project. For data you cannot afford to lose, we still recommend one more copy outside any single provider, and we say that about ourselves too.

On systems CloudHosting administers for you, each engineer works under a named personal account rather than a shared login, and that access can be revoked. That covers the company infrastructure, remote offices and other services we run for you. On a service you run yourself, such as an unmanaged VPS or a dedicated server, you hold the administrator access and decide who else gets an account. In the data centre, physical access is limited to a small number of our own specialists, and visitors are not admitted.

CloudHosting runs monitoring and incident response 24/7, and an incident that stops your work is handled at once, whatever the hour. Other alerts that arrive outside working hours are picked up the next working morning. Engineers answer requests, tickets and calls on working days from 9:00 to 17:00 Riga time, in English, Latvian and Russian. The status page shows the state of the shared platform; a problem limited to one server may not appear there, so write to support when something is wrong on your side.

CloudHosting's standard terms do not contain an SLA: 99.9% availability is our target, not a contractual guarantee. We say it plainly because a figure that is not in the contract should not look as if it were. If your project needs contractual service levels, raise it before the offer, and we will tell you what we can commit to for that setup. The redundancy, monitoring and incident handling described on this page apply either way.

CloudHosting does not hold ISO 27001 or SOC 2 certification, and the Tier 3+ of the Riga data centre describes its design, not a certificate. Instead we show things you can check: this page with the date its facts were last checked, our public terms of service, the company entry in the Latvian Register of Enterprises (registration number 40103966259), our network AS58269 in the RIPE database and a free 30-minute call with an engineer. A data processing agreement (DPA) under Article 28 of the GDPR is signed on request. The partner statuses we hold are Fortinet authorised partner and Microsoft partner.

CloudHosting provides the technical side that NIS2 and GDPR expect from a supplier: servers in the EU, backups with fixed retention and, for the infrastructure we run, written recovery targets, named access that can be revoked, and monitoring and incident response 24/7, all from a Latvian company. The duties themselves stay with your company: under the Latvian Cybersecurity Law a subject registers, reports incidents and assesses itself, and under GDPR the controller keeps its records and policies. We do not certify compliance. If you need help with those duties, our NIS2 service, our data protection specialist and an IT audit from 200 EUR cover them.

CloudHosting can serve a financial entity as an ICT supplier, but DORA puts the assessment of every ICT supplier on the entity itself: you need to know where the data is, who can reach it and what the contract says. This page answers the first two questions, our standard terms of service are public, and an engineer can go through your questions on a call. If your DORA register or contract policy needs clauses beyond our standard terms, name them at the start, and we will tell you honestly which ones we can accept. The DORA duties stay with you; no supplier can take them over.