EU-hosted vs. EU-controlled: What it means for Server-side Tracking

Client security questionnaires and DPIAs often ask who operates your infrastructure, where the provider’s parent company is established and which subprocessors receive data. Questions like these used to be handled by legal teams, but now they are a regular part of vendor reviews.

For a lot of software, these questions are a formality. For Server-side Tracking, the answers matter more, because visitor data reaches the server container in its most complete form.

This article explains what data a container receives, why the infrastructure under it shapes what you can say about that data and why we moved our own infrastructure to UpCloud, a Finnish cloud provider.

What does “EU-hosted” tell you?

EU hosting describes data residency, meaning the region where data is stored and processed. This is still a useful feature, since data kept in the EU avoids the most common questions about international transfers.

Sovereignty adds two further questions: who operates the infrastructure, and which country’s authorities can legally require that operator to hand over data. Those obligations follow the company, wherever its servers are. A US-owned provider running an EU region gives you residency, while an EU-owned provider operating its own infrastructure in the EU gives you both. UpCloud explains how this works, including the role of the US CLOUD Act, in their article.

The EU is starting to put this difference into law. The Cloud and AI Development Act, proposed by the European Commission in June 2026, would rate cloud services on four levels of sovereignty, from where data is stored up to who owns and controls the provider. It is still a proposal and only covers cloud services used by public bodies, but the levels are already a useful way to judge any provider.

What data passes through a server-side tracking container

A server container receives the data collected by your website before it’s sent to your marketing or analytics tools. Each event arrives at the container first, where it is processed. The container then forwards a tailored version of the data to each destination, such as an analytics platform, Google Ads, Meta or your CRM.

The request that reaches the container carries more than the event name. A typical page view or conversion event includes:

• The visitor’s IP address, which comes with every HTTP request
• The user agent, which identifies the browser, device and operating system
• The full page URL, including the query string
• The referrer
• First-party cookie values, such as client and session identifiers and stored click IDs like gclid and fbclid
• The event parameters you configured, such as product IDs, cart contents, order values and transaction IDs

Conversion events that feed Enhanced Conversions in Google Ads or Meta’s Conversions API also include customer data, such as an email address, phone number or name. Both platforms require these values to be hashed with SHA-256, which converts them into a code the platform can match to its own users without seeing the original value. In a server-side setup, hashing usually happens inside the container. The container first receives the email address as readable text, then hashes it and forwards only the hashed version.

The query string, which is the part of a URL after the question mark, can carry more information than your tracking setup was meant to collect. A password reset or account confirmation link can contain an email address. An internal site search adds the search term to the URL. Booking and filter pages can include travel dates, destinations, the number of travelers or the size and color of a product. This information ends up in the URL because of how the website is built and the container receives it with each page view.

The steps that make this data safer to share take place inside the container. They include hashing identifiers, shortening or removing IP addresses, stripping parameters from URLs, renaming events and checking consent before anything is forwarded. Data enters the container in full and leaves it reduced, which makes the container the place where the complete, unfiltered version of the data exists.

For you, this means the container is where you decide what each platform receives. You can send the full dataset to an EU-hosted analytics tool and only the conversion signals that Google Ads or Meta need to optimize. Consent is checked in one place before anything is forwarded, so a visitor’s choice applies to all your platforms at once. Because the rules live in one configuration, you can also show a client or DPO exactly which fields go where.

The complete data can also be stored or accessed in places outside the container itself:

• Logs: Request and error logs can contain full URLs and fragments of the payload.
• Preview and debug sessions: The complete incoming request is visible to whoever is running the session.
• Backups and snapshots: Copies of the environment contain whatever was stored at the time they were taken.
• Administrative access: The hosting provider’s staff with access to the underlying servers are able to view all of the above.

A web server that hosts your website keeps pages and files you chose to publish. A tracking container holds a running record of what identifiable people do on your website, in the form it was collected. This is why the infrastructure under the container deserves a stricter standard than the infrastructure under your website.

Why sovereignty matters most in a server container

A common tracking setup sends data to three kinds of systems: the server container, an analytics platform and one or more ad platforms. Each one receives a different amount of data and for some of them you can choose a provider that is owned and operated in the EU.

The container receives the most data. It’s also the step where the hosting decision is entirely yours. That combination is why we treat it as the most important place to get your sovereignty right.

When the container runs on EU-owned and EU-operated infrastructure, the data it receives stays in the EU, including the fields you filter out. Data leaves the EU only when you send it to a platform such as Google Ads or Meta, and those transfers rely on the EU-US Data Privacy Framework. The framework is valid today, but it is being challenged in court. The two frameworks before it, Safe Harbor and Privacy Shield, were both invalidated. If that happens again, a setup with an EU-owned container only needs to change what it sends to US platforms, while a container on US-controlled infrastructure would need to move.

Why we moved our infrastructure to UpCloud

Here at TAGGRS, our customers’ server containers run on the infrastructure we manage. To back up our sovereignty claims, the company providing that infrastructure also had to be European, both in terms of who owns it and who operates it.

UpCloud is a European-owned cloud provider, founded and headquartered in Helsinki, Finland. TAGGRS containers run on UpCloud’s European data centers. Because UpCloud has no non-EU owner, a government outside the EU cannot reach the data through a parent company. This protection comes from the ownership structure itself, which makes it more reliable than a clause in a contract.

This means both companies that handle your complete tracking data are based in the EU. TAGGRS manages the container and UpCloud provides the infrastructure it is hosted on.

Many of the organizations that choose TAGGRS do so because we are fully European, including banks and healthcare organizations. As we grew, these customers asked for more clarity about where their data was handled, and we also needed infrastructure that could keep up with demand.

The move changed how we run that infrastructure. Before, we managed more than 300 virtual machines with an orchestrator we had built ourselves to move workloads between them. We now use UpCloud Managed Kubernetes, a standardized system that automatically places each client’s configuration on the right server. When a server goes down, its workload moves to the other servers without manual work, which has led to higher uptime for our clients. The servers are also larger than before, so we can handle more traffic than we could previously. Together with UpCloud’s managed databases, load balancing, storage and backups, this has reduced the time our team spends on maintenance. We now have roughly 30% more time for product development.

How to answer client and DPO questions about your tracking setup

Clients and data protection officers (DPOs) tend to ask a few key questions about tracking infrastructure. The comparison below compares the answers you can give when you only know where your servers are with what you’re able to tell them when your setup runs on EU-owned and EU-operated infrastructure.

What remains your responsibility

EU-owned infrastructure gives your tracking setup a solid base, but several parts of compliance still depend on how you use it.

• Consent. The consent rules under the GDPR and the ePrivacy Directive are the same wherever your container is hosted. A cookie set by your own server is still stored on the visitor’s device, so it needs consent when you use it for analytics or advertising.
• Data sent to US platforms. Sending data to Google Ads or Meta from a container in the EU still counts as a transfer outside the EU, and your documentation should describe it that way. The container lets you decide which fields are included in that transfer.
• Filtering rules. A container protects data only as well as it is configured. If it forwards everything it receives to each platform, the data stays in the EU only until that moment. In TAGGRS, you set these rules in Data Enricher, which turns your list of allowed fields for each platform into a rule the container follows.
• Documentation. Your privacy notice, data processing records and DPIA need to list each platform you send data to, and you need to update them whenever you add or remove one.

Conclusion

Saying “our servers are in Europe” is accurate for many vendors and it addresses a real concern. But it only describes where the data is stored, while who operates the infrastructure and who owns that company determines who can access the data.

For Server-side Tracking, these questions deserve as much attention as the data center location, because the container receives the most complete version of visitor and customer data before anything has been filtered out or hashed. UpCloud provides infrastructure that is European in ownership and operation, while at TAGGRS we build the tracking layer on top of it. Your complete data stays under EU law and you control what data leaves your systems.

To see what your current setup sends and where, run our free website tracking checker. It scans your domain and scores your tracking on pixels, server-side coverage, cookies and consent.

Frequently asked questions