> How Zeabur (PaaS) handles data residency across Asian, US and EU regions, the GDPR Article 46 safeguards required and the European alternatives available. > > Canonical: https://www.flowconsent.com/en/services/hosting/zeabur Hosting # Zeabur Unclassified · [Official website](https://zeabur.com) Zeabur is a developer cloud platform (PaaS) that enables one-click deployment of web applications from Git, with global edge regions, custom domains and managed infrastructure. [Block Zeabur until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=hosting) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Hosting](https://www.flowconsent.com/en/services/hosting) - Consent Unclassified - Prior consent Required - Documented cookies 3 - Third-party domains 5 - Servers Multi-region (Singapore, Hong Kong, Tokyo, United States, EU available depending on plan) Overview ## What does Zeabur do? ## **What Zeabur is and how it processes data** Zeabur is a developer cloud platform (Platform as a Service) that allows engineering teams to deploy web applications, APIs, databases and background workers from a Git repository in a single click. It positions itself as an alternative to Vercel, Railway or Render and targets full-stack developers who want managed infrastructure without operating their own Kubernetes cluster. From a GDPR perspective Zeabur is typically a processor under Article 28: it executes customer code, stores customer databases, terminates TLS, manages custom domains and emits build, runtime and deployment telemetry on behalf of its customers. ## **Data residency and chosen region** Zeabur is headquartered in Asia (Singapore/Taiwan) and exposes multiple deployment regions including Singapore, Hong Kong, Tokyo, the United States and EU regions depending on the plan. The actual location where compute and storage live is determined by the region selected at deployment time, not by the location of the customer or of the Zeabur dashboard. EU operators must verify this region carefully: Singapore benefits from a UK adequacy decision but not from a current EU adequacy decision, Hong Kong is not covered by any adequacy decision and Tokyo is covered by the EU-Japan adequacy decision. The chosen region must be recorded in the Record of Processing Activities under Article 30 GDPR. ## **Article 46 safeguards and Schrems II** Where Zeabur deploys workloads outside the EEA in a country that does not benefit from an EU adequacy decision (notably Hong Kong, the United States and Singapore), transfers must rely on Article 46 GDPR safeguards. In practice this means Standard Contractual Clauses signed between the controller and Zeabur, combined with a Transfer Impact Assessment in line with the Schrems II ruling of the Court of Justice of the European Union (case C-311/18). Supplementary measures such as encryption in transit and at rest, key management under the customer's control and minimisation of personal data in build logs should be documented. ## **Cookies and tracking** Zeabur itself, as a hosting platform, does not place advertising or analytics cookies on visitors of the customer's website. The Zeabur dashboard uses strictly necessary cookies such as 'zeabur\_session' and CSRF tokens to authenticate developers, and these are exempt from consent under Article 5(3) of the ePrivacy Directive. However, applications hosted on Zeabur may set their own cookies, and operators remain responsible for collecting consent for any non-essential cookie placed by the hosted application. ## **Sub-processors and supply chain** Like most PaaS providers Zeabur relies on underlying IaaS sub-processors (cloud providers, CDN providers, observability vendors) to deliver compute, storage and edge capacity. EU controllers should obtain an up-to-date list of sub-processors from Zeabur, ensure that the DPA grants them prior information and a right to object to new sub-processors, and verify that flow-down SCCs exist down the chain. ## **EU alternatives** Operators who wish to keep their hosting infrastructure within the EEA can consider European PaaS and cloud providers such as Scalingo (France), Clever Cloud (France), OVHcloud (France) and Hetzner Cloud (Germany), as well as fly.io configured exclusively with EU regions. These alternatives avoid most Article 46 transfer obligations by keeping compute and storage in EU data centres operated by EU entities. Compliance ## Zeabur and the GDPR Zeabur is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis legitimate\_interest\_and\_contract - Risk level medium - Applicable regulations GDPR, ePrivacy Directive Article 5(3), Schrems II, Article 46 GDPR (where applicable) ### Impact assessment (DPIA) Zeabur acts as a hosting and infrastructure processor under Article 28 GDPR. A DPIA is recommended when sensitive or large-scale personal data is processed on the platform. Key risks to document: data residency depending on the region selected (Singapore, Hong Kong, Tokyo, US, EU), transfers to non-adequate third countries (notably Hong Kong), sub-processor chain (underlying IaaS providers), retention of build logs and deployment telemetry, access by Zeabur support staff, and incident response timelines. A Data Processing Agreement (DPA) including SCCs must be signed and the chosen region must be documented in the Record of Processing Activities (Article 30 GDPR). ### Sample text for your banner > We use Zeabur to host and deliver this website. Zeabur sets strictly necessary session cookies (such as 'zeabur\_session' and CSRF tokens) required to operate its dashboard and to serve the application. These cookies are exempt from prior consent under Article 5(3) of the ePrivacy Directive. Depending on the selected region, application data may be processed outside the European Economic Area under appropriate Article 46 GDPR safeguards. Cookies and trackers ## What Zeabur sets and contacts - Tracking method session cookies, CSRF tokens, server logs, build and deployment telemetry - Server location Multi-region (Singapore, Hong Kong, Tokyo, United States, EU available depending on plan) - Data transferred outside the EU Zeabur is headquartered in Asia (Singapore/Taiwan) and operates global edge regions. Customer compute and storage may be deployed in Singapore, Hong Kong, Tokyo, the United States or EU regions depending on the region selected at deployment time. For EU/EEA operators, transfers to non-adequate regions require Standard Contractual Clauses (SCCs) under Article 46 GDPR together with a Transfer Impact Assessment consistent with the Schrems II ruling. Hong Kong in particular is not covered by an EU adequacy decision and triggers heightened scrutiny. ### Cookies set (3) | Name | Type | Duration | Purpose | | ------------------- | -------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | zeabur\_session | http\_cookie\_first\_party | session | Strictly necessary authentication session cookie used by the Zeabur dashboard to keep developers logged in. Exempt from prior consent under Article 5(3) of the ePrivacy Directive. | | zeabur\_csrf\_token | http\_cookie\_first\_party | session | Cross-Site Request Forgery (CSRF) protection token used by the Zeabur dashboard to validate that state-changing requests originate from the legitimate logged-in user. Security cookie, exempt from prior consent. | | zeabur\_preferences | http\_cookie\_first\_party | 12 months | Stores developer preferences (theme, selected workspace, last region) for the Zeabur dashboard. Functional cookie strictly necessary for the requested service. | ### Third-party domains contacted (5) - `zeabur.com` - `dash.zeabur.com` - `api.zeabur.com` - `zeabur.app` - `cdn.zeabur.com` Questions ## Frequently asked questions about Zeabur Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Does Zeabur require user consent for cookies? Zeabur itself sets only strictly necessary cookies on its developer dashboard (session, CSRF), which are exempt from prior consent under Article 5(3) of the ePrivacy Directive. Sites hosted on Zeabur may set their own cookies and remain subject to the consent obligations of the hosting operator. ### Where is my data stored when I deploy on Zeabur? Data is stored in the region you select at deployment time. Zeabur currently exposes Singapore, Hong Kong, Tokyo, the United States and EU regions depending on the plan. The chosen region governs the location of compute, persistent storage and most logs and must be documented in your Record of Processing Activities under Article 30 GDPR. ### Is Zeabur GDPR compliant for EU operators? Zeabur can be used in a GDPR-compliant manner when a Data Processing Agreement is signed and an EU region is selected, or when Article 46 safeguards (Standard Contractual Clauses plus a Transfer Impact Assessment) are in place for transfers to non-adequate countries such as Hong Kong, Singapore or the United States. Compliance is ultimately the responsibility of the controller. ### What about Schrems II and transfers to Hong Kong or the United States? Hong Kong is not covered by any EU adequacy decision and the United States only benefits from the EU-US Data Privacy Framework for participating organisations. In line with the Schrems II ruling (CJEU C-311/18) any transfer to these regions through Zeabur must rely on SCCs, a Transfer Impact Assessment and supplementary measures such as strong encryption and customer-managed keys. ### Does Zeabur disclose its sub-processors? Zeabur, like most PaaS providers, relies on underlying IaaS sub-processors for compute, storage, CDN and observability. EU controllers should request an up-to-date sub-processor list, ensure the DPA grants prior notification and a right to object to new sub-processors, and confirm that flow-down SCCs exist down the chain. ### Which Zeabur cookies are strictly necessary? On the Zeabur dashboard the strictly necessary cookies include the authentication session cookie (typically 'zeabur\_session'), a CSRF protection token and a small number of preference cookies. These cookies do not require prior consent under Article 5(3) of the ePrivacy Directive because they are needed for the service explicitly requested by the user. ### Are there European alternatives to Zeabur? Yes. For EU-only hosting, operators can consider Scalingo (France), Clever Cloud (France), OVHcloud (France) and Hetzner Cloud (Germany), as well as fly.io restricted to EU regions. These providers operate compute and storage from EU data centres and typically simplify GDPR transfer obligations. ### What should be included in a DPIA when using Zeabur? A DPIA should document: the categories of personal data processed via the hosted application, the selected Zeabur region and the resulting third-country transfer risk, the sub-processor chain, retention of build logs and telemetry, encryption and key management, access controls for Zeabur staff, and the incident response timeline agreed in the DPA. Same category ## More services: Hosting [See the whole category](https://www.flowconsent.com/en/services/hosting) ### [Yandex Cloud](https://www.flowconsent.com/en/services/hosting/yandex-cloud) [Yandex.Cloud is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Yandex.Cloud provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Yandex.Cloud ensures optimal performance at scale.](https://www.flowconsent.com/en/services/hosting/yandex-cloud) [Hosting](https://www.flowconsent.com/en/services/hosting/yandex-cloud) · ### [Raspbian](https://www.flowconsent.com/en/services/hosting/raspbian) [Raspbian is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Raspbian integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Raspbian helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/hosting/raspbian) [Hosting](https://www.flowconsent.com/en/services/hosting/raspbian) · ### [Open-Xchange App Suite](https://www.flowconsent.com/en/services/hosting/open-xchange-app-suite) [Open-Xchange App Suite is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Open-Xchange App Suite integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Open-Xchange App Suite helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/hosting/open-xchange-app-suite) [Hosting](https://www.flowconsent.com/en/services/hosting/open-xchange-app-suite) · ### [Hostens](https://www.flowconsent.com/en/services/hosting/hostens) [Hostens is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hostens offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hostens empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/hostens) [Hosting](https://www.flowconsent.com/en/services/hosting/hostens) · ### [One.com](https://www.flowconsent.com/en/services/hosting/one-com) [One.com is a digital analytics solution that helps businesses measure and understand their online performance through comprehensive data collection and analysis. It provides visitor tracking, behavioral insights, and conversion metrics across websites and applications. One.com supports custom event tracking, audience segmentation, and automated reporting. With intuitive dashboards and visualization tools, One.com enables informed decisions that improve experience and drive results.](https://www.flowconsent.com/en/services/hosting/one-com) [Analytics](https://www.flowconsent.com/en/services/hosting/one-com) · ### [Hypercloudhost](https://www.flowconsent.com/en/services/hosting/hypercloudhost) [Hypercloudhost is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hypercloudhost offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hypercloudhost empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/hosting/hypercloudhost) [Hosting](https://www.flowconsent.com/en/services/hosting/hypercloudhost) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)