[{"data":1,"prerenderedAt":655},["ShallowReactive",2],{"blog-/en/host-without-us-cloud":3,"blog-related-/en/host-without-us-cloud":465},{"id":4,"title":5,"author":6,"body":7,"date":448,"description":449,"extension":450,"image":451,"meta":452,"navigation":453,"path":454,"seo":455,"stem":456,"tags":457,"__hash__":464},"blog/en/host-without-us-cloud.md","How to Host a Website Without US Cloud Providers (And What Actually Counts as 'EU')","Martin Swoboda",{"type":8,"value":9,"toc":436},"minimark",[10,14,19,22,33,42,46,49,130,139,143,146,155,169,172,176,179,182,185,188,192,195,341,350,354,357,360,363,366,370,388,391,394,402,406,409,412,415,418,421,424,427,430],[11,12,13],"p",{},"Someone has asked whether the website can move \"off American infrastructure.\" The honest answer starts with a correction: where the servers physically stand matters less than who legally controls the company running them. A rack in Frankfurt owned by a US corporation is still reachable by US law.",[15,16,18],"h2",{"id":17},"does-hosting-in-an-eu-data-centre-put-you-outside-us-legal-reach","Does hosting in an EU data centre put you outside US legal reach?",[11,20,21],{},"No. Physical location is one factor among several, and on its own it decides very little.",[11,23,24,25,32],{},"The ",[26,27,31],"a",{"href":28,"rel":29},"https://cms.law/en/deu/legal-updates/white-paper-demystifying-the-debate-on-the-us-cloud-act-vs-european-uk-data-sovereignty-in-the-context-of-cloud-services",[30],"nofollow","US CLOUD Act"," (2018) lets US authorities compel a provider under US jurisdiction to hand over data in its \"possession, custody, or control,\" regardless of where the data sits. That reach extends to US parent companies and, in practice, their European subsidiaries.",[11,34,35,36,41],{},"This isn't theoretical. On 10 June 2025, Microsoft France's legal counsel Anton Carniaux was asked under oath in a French Senate hearing whether he could guarantee French citizens' data would never reach US authorities. His answer: ",[26,37,40],{"href":38,"rel":39},"https://www.convotis.com/en/news/microsoft-access-eu-data/",[30],"\"Non, je ne peux pas le garantir.\""," The limits are real: a warrant or court order is required, and the act is encryption-neutral. But a limit you have to litigate isn't a control you can cite in an assessment.",[15,43,45],{"id":44},"what-actually-counts-as-eu","What actually counts as \"EU\"?",[11,47,48],{},"\"EU\" is used for four different things, and mixing them up is where most bad decisions start.",[50,51,52,68],"table",{},[53,54,55],"thead",{},[56,57,58,62,65],"tr",{},[59,60,61],"th",{},"Level",[59,63,64],{},"What it means",[59,66,67],{},"Does US law reach it?",[69,70,71,87,101,115],"tbody",{},[56,72,73,81,84],{},[74,75,76,77],"td",{},"EU ",[78,79,80],"strong",{},"region",[74,82,83],{},"A US provider's data centre located in the EU",[74,85,86],{},"Yes, the provider is still US-controlled",[56,88,89,95,98],{},[74,90,76,91,94],{},[78,92,93],{},"data residency"," contract",[74,96,97],{},"Contractual promise that data stays in the EU",[74,99,100],{},"Yes, a contract does not override a US court order",[56,102,103,109,112],{},[74,104,105,106],{},"US-branded ",[78,107,108],{},"\"sovereign cloud\"",[74,110,111],{},"A US hyperscaler's EU-operated, sometimes locally-partnered offering",[74,113,114],{},"Contested. Depends on the ownership and operational chain, which varies per product",[56,116,117,124,127],{},[74,118,119,120,123],{},"EU-",[78,121,122],{},"controlled"," provider",[74,125,126],{},"Incorporated and controlled in the EU/EEA, no US parent, no material US operations",[74,128,129],{},"Not directly. This is the only level where the answer changes",[11,131,132,133,138],{},"The fourth row does the work. Everything above it is a mitigation, not a change of jurisdiction. Sovereign-cloud branding from US hyperscalers is a contested claim rather than a settled fact, which is why the EU's ",[26,134,137],{"href":135,"rel":136},"https://www.globalpolicywatch.com/2026/06/eu-tech-sovereignty-package/",[30],"Tech Sovereignty Package"," of 3 June 2026 proposes formal \"assurance levels\". The label alone told nobody anything.",[15,140,142],{"id":141},"is-the-eu-us-data-privacy-framework-still-valid-in-2026","Is the EU-US Data Privacy Framework still valid in 2026?",[11,144,145],{},"Yes. As of writing it's still in force, and noticeably less stable than a year ago. Don't plan on it being permanent, and don't plan on it collapsing tomorrow either.",[11,147,148,149,154],{},"On 3 September 2025 the EU General Court ",[26,150,153],{"href":151,"rel":152},"https://iapp.org/news/a/european-general-court-dismisses-latombe-challenge-upholds-eu-us-data-privacy-framework",[30],"dismissed Philippe Latombe's annulment challenge"," (T-553/23), though on the facts as they stood at the 2023 adequacy decision. In October 2025 Latombe appealed to the CJEU, the court that struck down Safe Harbor and Privacy Shield.",[11,156,157,158,162,163,168],{},"Then on 29 June 2026, in ",[159,160,161],"em",{},"Trump v. Slaughter",", the US Supreme Court held 6 to 3 that statutory removal protections for FTC Commissioners are unconstitutional. On 31 July 2026 the EDPB ",[26,164,167],{"href":165,"rel":166},"https://iapp.org/news/a/edpb-requests-review-of-eu-us-data-privacy-framework-following-trump-v-slaughter",[30],"asked the Commission to assess the consequences",", noting that the adequacy decision expressly relies on FTC independence.",[11,170,171],{},"There are also reports of the PCLOB losing quorum and instability around FISA Section 702 renewals. Practically: keep Standard Contractual Clauses and transfer impact assessments in place rather than leaning on the DPF alone.",[15,173,175],{"id":174},"legal-risk-or-political-preference-they-lead-to-different-answers","Legal risk or political preference? They lead to different answers",[11,177,178],{},"Both are legitimate, and conflating them produces incoherent decisions.",[11,180,181],{},"Legal risk is about specific personal data, specific processing, documented transfer mechanisms. It's proportionate (a marketing site logging IP addresses isn't a health portal), and the response is a data map, a transfer impact assessment, and changes to the layers that actually carry personal data.",[11,183,184],{},"Strategic preference is about supply-chain dependency, geopolitical exposure, and where your money goes. It isn't proportionate to risk, and it can justify moving things that pose no legal problem at all.",[11,186,187],{},"If your motivation is the second, say so. Dressed up as a compliance requirement, it becomes a project that fails its own stated test.",[15,189,191],{"id":190},"which-layers-of-your-website-actually-touch-us-services","Which layers of your website actually touch US services?",[11,193,194],{},"More than most people expect. The host is the layer everyone focuses on and usually the least interesting. Each row below is a separate contract, data flow and decision.",[50,196,197,213],{},[53,198,199],{},[56,200,201,204,207,210],{},[59,202,203],{},"Layer",[59,205,206],{},"Common default",[59,208,209],{},"European option",[59,211,212],{},"If you can't switch",[69,214,215,229,243,257,271,285,299,313,327],{},[56,216,217,220,223,226],{},[74,218,219],{},"Server / host",[74,221,222],{},"AWS, Azure, GCP",[74,224,225],{},"Hetzner (DE), IONOS (DE), OVHcloud (FR), Scaleway (FR), UpCloud (FI)",[74,227,228],{},"SCCs plus encryption whose keys you hold",[56,230,231,234,237,240],{},[74,232,233],{},"CDN",[74,235,236],{},"Cloudflare, CloudFront, Fastly",[74,238,239],{},"Bunny.net (SI), Myra (DE), KeyCDN (CH, non-EU but an adequacy country)",[74,241,242],{},"Or drop the CDN; many sites don't need one",[56,244,245,248,251,254],{},[74,246,247],{},"DNS",[74,249,250],{},"Cloudflare, Route 53",[74,252,253],{},"deSEC (DE), Hetzner DNS, INWX (DE), Bunny DNS",[74,255,256],{},"Query data is low-sensitivity, but not nothing",[56,258,259,262,265,268],{},[74,260,261],{},"Web fonts",[74,263,264],{},"Google Fonts CDN",[74,266,267],{},"Self-host the font files",[74,269,270],{},"Nothing, just self-host",[56,272,273,276,279,282],{},[74,274,275],{},"Analytics",[74,277,278],{},"Google Analytics",[74,280,281],{},"Matomo (self-hosted or EU cloud), Plausible (EE), Piwik PRO (PL), etracker (DE)",[74,283,284],{},"Consent, IP truncation, DPA",[56,286,287,290,293,296],{},[74,288,289],{},"Embedded video",[74,291,292],{},"YouTube, Vimeo",[74,294,295],{},"Bunny Stream, Dailymotion (FR), self-hosted PeerTube",[74,297,298],{},"Click-to-load facade so nothing loads pre-consent",[56,300,301,304,307,310],{},[74,302,303],{},"Forms + transactional email",[74,305,306],{},"SendGrid, Mailgun, Postmark",[74,308,309],{},"Brevo (FR), Mailjet (FR), Rapidmail (DE), CleverReach (DE), Scaleway TEM",[74,311,312],{},"Your own SMTP on EU infrastructure",[56,314,315,318,321,324],{},[74,316,317],{},"Error tracking",[74,319,320],{},"Sentry, Datadog, LogRocket",[74,322,323],{},"Self-hosted Sentry, GlitchTip",[74,325,326],{},"Scrub PII in the browser before it leaves",[56,328,329,332,335,338],{},[74,330,331],{},"AI in the content pipeline",[74,333,334],{},"OpenAI, Anthropic, Google",[74,336,337],{},"Mistral (FR), Aleph Alpha (DE), IONOS AI Model Hub, OVHcloud AI Endpoints",[74,339,340],{},"Don't paste personal data into any of them",[11,342,343,344,349],{},"Fonts are the cheapest win. In January 2022 the Landgericht München I ",[26,345,348],{"href":346,"rel":347},"https://www.activemind.legal/guides/ruling-google-fonts/",[30],"awarded a visitor €100 in damages"," because a site loaded Google Fonts from Google's CDN, sending the visitor's IP address to the US without consent. Self-hosting the files takes an afternoon.",[15,351,353],{"id":352},"what-you-actually-give-up-by-going-eu-only","What you actually give up by going EU-only",[11,355,356],{},"Real costs, not token ones. Anyone who tells you the switch is free hasn't done it.",[11,358,359],{},"You get fewer managed services. Europe has excellent infrastructure and a much thinner layer of managed services on top, so you'll self-manage things a hyperscaler would have run for you. Ecosystems are smaller too: fewer Terraform modules, fewer integrations, fewer answers at 2am.",[11,361,362],{},"Some gaps are genuine. Error tracking and video hosting are the weakest rows above, where the self-hosted options work but trail Sentry and YouTube in polish. Edge performance outside Europe trails Cloudflare and CloudFront, so if your traffic is in São Paulo or Singapore, a European-only CDN costs real milliseconds. And in the AI layer, European providers have closed a lot of ground, but for some tasks frontier US models are still ahead, so re-check rather than assume.",[11,364,365],{},"None of that is a dealbreaker for a content website. Several of them are, for a global consumer product.",[15,367,369],{"id":368},"where-neleto-fits-in-this","Where Neleto fits in this",[11,371,372,373,377,378,382,383,387],{},"Neleto is a ",[26,374,376],{"href":375},"/blog/full-cms-vs-headless","complete CMS"," with ",[26,379,381],{"href":380},"/blog/eu-hosting-compliance","managed EU hosting"," on Hetzner in Nuremberg and Falkenstein, Germany. Triple-A Soft, the company behind it, is German, and there's no US parent in the chain. That puts the hosting layer in the fourth row of the table above rather than the first, on ",[26,384,386],{"href":385},"/pricing","every plan including the free tier",". Regions in the USA and Asia are coming, and you'll pick the region when you create an instance.",[11,389,390],{},"The more useful argument isn't the flag, it's the count of moving parts. Rendering is built in, so there's no second frontend stack deployed elsewhere. Image scaling is built in, so images never travel to an external transformation service. Fewer third-party services touching the page means fewer data-transfer questions in the first place, and every row you delete from that table is a DPA you don't sign and a subprocessor you don't re-check when its ownership changes.",[11,392,393],{},"Neleto doesn't make anyone automatically GDPR-compliant. That depends on what you collect and what you bolt on. Embed YouTube and load Google Analytics on a Neleto site and you have the same problems as anywhere else.",[11,395,396,397,401],{},"One caveat on our own stack: Neleto ships a ",[26,398,400],{"href":399},"/blog/native-mcp-vs-wrapper","native MCP server",", and the AI clients people use it with (Claude Code, Cursor, Windsurf) are US products. If your policy is EU-only end to end, that's a layer like any other, and we aren't exempt from it.",[15,403,405],{"id":404},"when-this-is-not-worth-doing","When this is not worth doing",[11,407,408],{},"Skip the migration if any of these describe you.",[11,410,411],{},"You process no personal data beyond server logs, with no analytics, no forms and no embeds. Exposure is already near zero and the project would be theatre.",[11,413,414],{},"Your organisation is US-based or US-owned. A German host doesn't change your own jurisdiction. Fix the data map first.",[11,416,417],{},"You need global edge performance more than jurisdictional clarity. Worldwide e-commerce traffic will feel a European-only CDN.",[11,419,420],{},"You depend on a US-only managed service with no European equivalent. Name it, then decide whether the rest is worth moving anyway. Partial migration is a legitimate outcome.",[11,422,423],{},"Nobody has actually asked the question. Budget spent on a problem you can't articulate is budget not spent on one you can.",[11,425,426],{},"The middle path is usually right: move the layers that carry personal data and are cheap to move (fonts, analytics, DNS, transactional email), keep what's load-bearing, and document why for each. \"Everything is in the EU\" is rarely true once someone reads the subprocessor list.",[428,429],"hr",{},[11,431,432,435],{},[78,433,434],{},"Try it yourself:"," Open your site with the browser network tab recording, load a page in a private window, and list every domain it contacts. That list is your real answer, and it's usually longer than the one in your privacy policy.",{"title":437,"searchDepth":438,"depth":438,"links":439},"",2,[440,441,442,443,444,445,446,447],{"id":17,"depth":438,"text":18},{"id":44,"depth":438,"text":45},{"id":141,"depth":438,"text":142},{"id":174,"depth":438,"text":175},{"id":190,"depth":438,"text":191},{"id":352,"depth":438,"text":353},{"id":368,"depth":438,"text":369},{"id":404,"depth":438,"text":405},"2026-09-28","An EU data centre is not the same thing as being outside US legal reach. Here is the difference, layer by layer.","md","/img/blog/host-without-us-cloud.svg",{},true,"/en/host-without-us-cloud",{"title":5,"description":449},"en/host-without-us-cloud",[458,459,460,461,462,463],"GDPR","EU Hosting","Digital Sovereignty","CLOUD Act","Data Compliance","Neleto","sjtCuyqdvUtGuTWja5Ab4xFzhqGvw87vGwZyt8IM8l4",[466,468,481,493,504,513,520,531,540,550,559,567,575,584,594,604,612,622,630,640,647],{"path":454,"title":5,"description":449,"date":448,"author":6,"image":451,"tags":467},[458,459,460,461,462,463],{"path":469,"title":470,"description":471,"date":472,"author":6,"image":473,"tags":474},"/en/native-mcp-vs-wrapper","Native MCP vs an MCP Wrapper: Why the Difference Shows Up in Production","Both speak the same protocol. The gap opens in what they can reach, who they act as, and how many round-trips one instruction costs.","2026-09-21","/img/blog/native-mcp-vs-wrapper.svg",[475,476,477,478,479,480,463],"MCP","AI Agents","CMS","Integration","Claude Code","Permissions",{"path":482,"title":483,"description":484,"date":485,"author":6,"image":486,"tags":487},"/en/jimdo-to-neleto-migration","Jimdo to Neleto: A Real Migration Story","We rebuilt a live Jimdo one-pager on Neleto with Claude. The first pass hurt accessibility; two prompts later Lighthouse showed 99/100/100/100.","2026-09-14","/img/blog/jimdo-to-neleto-migration.svg",[488,489,490,491,492,475,463],"Case Study","Migration","Jimdo","Accessibility","Lighthouse",{"path":494,"title":495,"description":496,"date":497,"author":6,"image":498,"tags":499},"/en/mcp-server-faster-image-ingest","The same AI build went from 30 minutes to 4 — here's what we changed in our MCP server","Image uploads were the slowest part of building a site with an AI agent. What we changed in Neleto's MCP server, with before-and-after numbers.","2026-09-07","/img/blog/mcp-server-faster-image-ingest.svg",[463,475,500,501,502,503],"AI","Agents","Build in Public","Performance",{"path":505,"title":506,"description":507,"date":508,"author":6,"image":509,"tags":510},"/en/full-cms-vs-headless","Full CMS vs Headless: Why All-in-One Wins for Most of the Web","Headless earned its reputation for real reasons. Here's the honest trade-off — and why, for most sites, a complete CMS is the better deal.","2026-08-31","/img/blog/full-cms-vs-headless.svg",[511,477,512,475,459,463],"Comparison","Headless",{"path":514,"title":515,"description":516,"date":517,"author":6,"image":518,"tags":519},"/en/self-verifying-ai","The AI That Checks Its Own Work","Most AI-plus-CMS setups write content and hope it rendered. Neleto checks three ways: structured output, LSP checks and a look at the live page.","2026-08-24","/img/blog/self-verifying-ai.svg",[463,500,475,501,502,477],{"path":521,"title":522,"description":523,"date":524,"author":6,"image":525,"tags":526},"/en/five-plugins-built-in","Five New Neleto Plugins — Built In, Not Bolted On","Search, comments, Google reviews, SEO and accessibility audits, and galleries: five plugins that run inside your Neleto instance, no third-party scripts.","2026-08-17","/img/blog/five-plugins-built-in.svg",[463,527,477,502,528,529,530],"Plugins","SEO","Search","DSGVO",{"path":532,"title":533,"description":534,"date":535,"author":6,"image":536,"tags":537},"/en/why-neleto-runs-on-rust","Why Neleto Runs on Rust (And the Benchmarks to Prove It)","Why Neleto runs on Rust: real benchmarks (11 ms TTFB, ~9,400 req/s, 78 MB RAM) and what it cost us in dev speed, hiring and young libraries.","2026-08-10","/img/blog/why-neleto-runs-on-rust.svg",[463,538,503,539,502],"Rust","Benchmarks",{"path":541,"title":542,"description":543,"date":544,"author":6,"image":545,"tags":546},"/en/page-builder-walkthrough","Building a Landing Page in Neleto: A Real Walkthrough (Mouse and Prompt)","I built the same landing page twice, by hand in the visual builder and by prompting Claude, and timed both. Including the parts that were slower.","2026-07-27","/img/blog/page-builder-walkthrough.svg",[463,547,477,475,548,549],"Page Builder","AI CMS","No-Code",{"path":551,"title":552,"description":553,"date":554,"author":6,"image":555,"tags":556},"/en/mcp-connectors","Connect Neleto to Anything: The Native MCP Server and Connector Ecosystem","Your CMS shouldn't be an island. Here's how Claude, Cursor, and Windsurf talk to your content directly — and where it goes next.","2026-07-20","/img/blog/mcp-connectors.svg",[475,557,500,479,558,463,477],"Connectors","Cursor",{"path":560,"title":561,"description":562,"date":563,"author":6,"image":564,"tags":565},"/en/wordpress-migration-walkthrough","40-Page WordPress Migration: Honest Walkthrough","The content migration took under an hour. The full cutover (domain, DNS, redirects, forms, QA) took most of a day. Every step, every gotcha.","2026-07-13","/img/blog/wordpress-migration-walkthrough.svg",[566,489,477,458,459,463],"WordPress",{"path":568,"title":569,"description":570,"date":571,"author":6,"image":572,"tags":573},"/en/html-to-editable-cms","Turn a Static HTML Site into an Editable CMS","Web designers lose days rebuilding finished designs as a CMS. With Neleto's MCP server it takes one prompt, animations and custom cursor included.","2026-07-06","/img/blog/html-to-editable-cms.svg",[475,476,574,479,477,463],"Web Design",{"path":576,"title":577,"description":578,"date":579,"author":6,"image":580,"tags":581},"/en/console-launch-free-tier","Neleto Console Is Live — and the Free Tier Is Open","Sign up at console.neleto.io, get a real CMS, and pay us nothing. Here's why we built it that way.","2026-06-29","/img/blog/console-launch-free-tier.svg",[502,463,582,583,459,477],"Free Tier","Self-Serve",{"path":585,"title":586,"description":587,"date":588,"author":6,"image":589,"tags":590},"/en/mcp-server-explained","MCP Server Explained: The Deep Dive","How the Model Context Protocol enables secure, native AI agent interaction with your applications — and why native implementation matters.","2026-06-22","/img/blog/mcp-server-explained.svg",[475,591,592,476,593],"MCP Server","Model Context Protocol","AI Integration",{"path":595,"title":596,"description":597,"date":598,"author":6,"image":599,"tags":600},"/en/neleto-vs-contentful","Neleto vs Contentful: Which CMS Should You Choose in 2026?","A practical comparison for developers, agencies, and growing businesses — covering pricing, performance, AI integration, editor experience, and EU compliance.","2026-06-16","/img/blog/neleto-vs-contentful.svg",[463,601,602,603,548],"Contentful","Headless CMS","CMS Comparison",{"path":605,"title":606,"description":607,"date":608,"author":6,"image":609,"tags":610},"/en/agentic-traffic-surpassed-humans","Bots Just Out-Numbered Us: What the Agentic Web Means for Your CMS","Cloudflare says AI agents now drive the majority of web traffic — 18 months early. Here's why that changes how you publish content, and what to do about it.","2026-06-08","/img/blog/agentic-traffic-surpassed-humans.svg",[611,476,475,477,463],"Agentic Web",{"path":613,"title":614,"description":615,"date":616,"author":6,"image":617,"tags":618},"/en/glw-gmbh-case-study","Modernizing a 40-Year Family Business: GLW GmbH's New Website with Neleto","How we delivered a fast, multilingual, and CRM-integrated website for a leading German cable processing specialist — in close collaboration with agency Inhalt.","2026-06-05","/img/blog/glw-gmbh-case-study.svg",[488,619,463,620,621],"Customer Story","CRM Integration","Custom Plugin",{"path":623,"title":624,"description":625,"date":626,"author":6,"image":627,"tags":628},"/en/eu-hosting-compliance","Why EU Hosting Compliance Matters for Your Website","Data sovereignty, GDPR, and choosing the right infrastructure in 2026","2026-06-01","/img/blog/eu-hosting-compliance.svg",[458,459,462,629,463],"Privacy",{"path":631,"title":632,"description":633,"date":634,"author":6,"image":635,"tags":636},"/en/buergerstiftung-ravensburg","Bürgerstiftung Ravensburg: A Modern Website for Community Impact with Neleto","How we built a clear, fast, and emotionally engaging website for a regional community foundation using Neleto CMS — in close collaboration with agency Inhalt.","2026-05-29","/img/blog/buergerstiftung-ravensburg.svg",[488,637,638,463,639],"Nonprofit","Foundation","Website",{"path":641,"title":642,"description":643,"date":644,"author":6,"image":645,"tags":646},"/en/what-is-mcp","What is the Model Context Protocol (MCP)?","The new standard connecting AI agents to your tools and data","2026-05-25","/img/blog/what-is-mcp.svg",[475,500,592,476,477],{"path":648,"title":649,"description":650,"date":651,"author":6,"image":652,"tags":653},"/en/why-neleto-exists","Why Neleto Exists","The CMS Built for Speed, Simplicity, and the AI Era","2026-05-18","/img/blog/why-neleto-exists.svg",[477,500,654,503,463],"Web Development",1790661774443]