Hosting, vendor lock-in and resilience
Who does your site depend on, and what happens if one of those dependencies becomes unavailable? We look at visible dependencies: hosting, DNS, CDN, third-party services, technical concentration, and public signs that can reveal dependencies that may complicate continuity or a move to another provider.
Try our method for free
One page. One pillar. A real report.
Enter your website and we’ll email you a report on Independence & resilience for your home page. Please allow at least 24 hours.
Our plans cover the 9 pillars across the pages of your whole site.
What we check
- The hosting country, and above all the supplier’s jurisdiction: servers located in Europe can still fall under extraterritorial orders if the operator answers to the law of another state.
- The share of your dependencies held by a single player, when one page calls on it alone for its audience measurement, its fonts, its bot protection and its maps.
- The layers crossed by all of your traffic (hosting, domain name, address resolution, content delivery, mail), and how many of them rest on the same supplier.
- The personal data that leaves the European Union during a plain visit, without anyone having asked for anything.
- What it would take to leave: a site set on a closed platform does not carry its content away the way a site built on open formats does.
What we find on the sites we audit
Across about 30 websites we audited between August 14, 2026 and September 24, 2026:
- 85% send personal data outside the European Union without safeguards
- 75% depend on one provider for several critical layers
Each percentage covers the sites where the point could be checked. Many were audited because a defect showed up quickly, so these figures describe our audits, not websites in general.
See also: GDPR compliance and privacy; a real business website report.
What it changes for you
Your customers, and their lawyers, may ask these questions before signing. Public tenders, major clients and European partners sometimes ask them in writing.
Resilience is the other half of the subject, and it is not the same thing. A site hosted entirely at a non-European player but redundant is resilient without being independent; a site at a single European host is independent without being resilient. The report scores the two separately.
The weight of this pillar
An overall score has to weigh what matters for your business: the 9 pillars do not carry the same weight depending on what your site is for. Here is what “independence & resilience” represents in the overall score, under each weighting. The report always states which one produced your score.
| Type of site | Share of the overall score |
|---|---|
| Type not determined | 9% |
| Business / brochure site | 8% |
| E-commerce site | 8% |
| Application / customer portal | 8% |
| Blog / media site | 7% |
| Public-sector site | 13% |
This pillar is examined alongside the other eight in every plan, whatever the number of pages. See pricing →
Guides for this pillar
CLOUD Act: does it apply to your website?
The CLOUD Act reaches data that US providers hold, even on servers in Europe. Which layers of your website it covers, and what to ask your providers.
Read the guide →Website data transfers outside the EU
Fonts, analytics, videos, maps: a single visit can send your visitor's IP address outside the EU. What triggers it, and what to do about it.
Read the guide →EU web hosting: more than server location
A server in the EU is not enough: the law your host and its subcontractors answer to matters, and so do DNS and email. The questions to ask first.
Read the guide →Website single point of failure: what to do
When one company runs your domain, DNS, hosting and email, one outage takes them all down. What to separate first, without doubling your costs.
Read the guide →Google Fonts and GDPR: self-host your fonts
Fonts loaded from Google send each visitor's IP address to Google, no cookie needed. What a Munich court ruled in 2022, and what to do about it.
Read the guide →