Kinsta

What is Kinsta

Kinsta is a premium managed WordPress, application and database hosting platform founded in 2013, with headquarters in California and a globally distributed remote team. Kinsta runs exclusively on Google Cloud Platform using the C2 and C3D compute tiers, with 37 data centres worldwide including Belgium, Netherlands, Frankfurt, Finland, Italy, France, Poland, Switzerland and London. Kinsta is EU US Data Privacy Framework certified, SOC 2 Type II audited and ISO 27001 attested.

Data and cookies collected

Kinsta processes server logs, request headers, visitor IP addresses, bandwidth and CDN usage. The hosting itself does not set tracking cookies in the visitor browser. The MyKinsta dashboard (my.kinsta.com) and marketing site (kinsta.com) set first party cookies for authentication, session management, analytics and customer support chat. Cloudflare sits in front of every site for DDoS protection and may set the __cf_bm and cf_clearance security cookies.

GDPR and ePrivacy implications

Kinsta is a data processor under Art. 28 GDPR. The site owner is the controller. Kinsta publishes a Data Processing Addendum, a list of sub processors including Google Cloud and Cloudflare, and supports Standard Contractual Clauses. Because Cloudflare is always in the request path, it must be disclosed even if no other front edge service is enabled. The ePrivacy Directive does not require consent for the hosting layer itself, but any analytics or marketing tools installed on top of WordPress are still subject to consent.

Consent requirements

No visitor consent is required for the Kinsta hosting layer or for the Cloudflare strictly necessary security cookies. Consent remains required for any third party tools installed inside WordPress, such as Google Analytics, Meta Pixel, marketing chat widgets or A/B testing tools. Kinsta APM, an internal performance tool, runs server side and does not require visitor consent.

Data transfers outside the EEA

Kinsta Inc. is a US incorporated company, so support, billing and admin access can take place from the United States. By selecting an EU GCP data centre, the customer site data stays in the EEA. US staff access remains a transfer to a third country and is covered by Standard Contractual Clauses and the EU US Data Privacy Framework, for which Kinsta is certified. Cloudflare points of presence are global and can route traffic through nodes outside the EEA, which must be documented.

Practical compliance steps

Accept the Kinsta Data Processing Addendum in MyKinsta, choose a European GCP region during site creation, add Kinsta, Google Cloud and Cloudflare to your sub processor list, run a Transfer Impact Assessment that references Kinsta's certifications, configure WordPress to avoid unnecessary cookies, set GeoIP edge rules if needed, and review the Kinsta sub processor list at least once a year for changes.