eucsoft

SiteGround

Hosting PaaS · siteground.com · last read 2026-11-09

At a glance

Is SiteGround GDPR compliant?
No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what SiteGround itself publishes, each answer linked to its source and the date we read it.
Does SiteGround have a data processing agreement (DPA)?
Yes. SiteGround publishes a data processing agreement at world.siteground.com. It gives 10 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
How does SiteGround transfer personal data out of the EU?
SiteGround's agreement relies on the EU standard contractual clauses and the UK transfer addendum. Source and date
Does SiteGround offer EU data residency?
The vendor documents an EU region but states nothing about which plan reaches it or what it costs. Source and date

The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.

Identity

Legal entitySiteGround Hosting Ltd.
HQGB
Parent company—
Ultimate ownership—
EU contracting entity—
LEI—
US CLOUD Act reachNot determined from the sources read
Sourceworld.siteground.com · 2026-11-09

SiteGround data residency

RegionEU data locationMinimum planSourceObserved
EUTerms not stated—siteground.com2026-11-09

EU: The document says hosting spans datacenters including Europe and that "You choose where your site is hosted when you set up hosting"; it names no plan requirement or cost for picking a location.

The same question for every vendor: where SaaS vendors store EU data.

Subprocessor chain

No subprocessor list transcribed. Either the vendor does not publish one where we could reach it, or it is gated — see the documents table below for which.

Processing terms

From the vendor's data processing agreement · read 2026-11-09 · world.siteground.com

TermWhat the agreement says
Transfer mechanismSCC (module not stated)
Transfer mechanismUK IDTA
Notice of new subprocessorsAt least 10 days in advance, specific written notice of additions or replacements to the agreed sub-processor list
If you object to oneCustomer may terminate the Agreement immediately by written notice given within 10 calendar days of being informed of the new sub-processor; this is the sole and exclusive remedy, and prepaid fees for the remaining term are refunded
Breach notificationwithout undue delay after becoming aware
AuditDocumentation review or audit by customer or an independent auditor it appoints, on written request; SiteGround may charge a fee and customer pays auditor and audit costs; SiteGround may refuse unqualified, non-independent or competitor auditors
Transfer impact assessmentSiteGround is deemed to perform appropriate risk assessments when transferring Customer Data outside the UK, EU and EEA; nothing said about providing or publishing an assessment

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Which version applies

We found no version number or date in the agreement as we read it.

These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.

Assurance

No certification claims transcribed yet.

SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.

Official registers

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Vulnerability reporting: no security.txt at the well-known path (read 2026-11-09)

How other vendors publish theirs: security.txt across the registry.

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
dpaPublicfull2002026-11-09
residencyPublicfull2002026-11-09

History

Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.

Every reviewed change across the registry, newest first: vendor changes.