Your SaaS works, you have 10 small customers, and then a company with 400 employees sends you a security questionnaire with 60 questions. Where is the data stored, who can access it, which DPAs have you signed. If you cannot answer, the deal stalls for weeks or dies quietly. This guide covers what the GDPR demands from a B2B SaaS, how to set up EU hosting, and what an enterprise due diligence actually checks.
Why does GDPR decide B2B SaaS deals?
When you sell software to a European company, the GDPR makes you the data processor and your client the data controller. Article 28 obliges them to verify that their supplier provides sufficient guarantees, so their legal team will review where you host the data, which subprocessors you use and which security measures you apply before anything gets signed. This is not a formality. If you cannot prove compliance with concrete documents, the contract gets stuck in procurement or legal and never moves.
The numbers matter because the risk is real for your client. GDPR fines reach 20 million EUR or 4 percent of global annual turnover, whichever is higher, and Spain's regulator, the AEPD, is among the most active enforcement authorities in Europe. That is why a company with 200 employees treats its SaaS vendor as a risk to audit. The earlier you prepare your answers, the shorter your sales cycle, which in enterprise B2B already runs 3 to 9 months.
What does EU data residency actually mean?
Data residency means personal data is stored and processed in data centres located inside the European Union. It is not the same as data sovereignty, which additionally requires the provider to be subject only to European law. For most B2B SaaS products, hosting production, backups and logs in an EU region of a provider with a solid DPA covers what clients ask for. One important nuance: transfers to the United States are legal today under the Data Privacy Framework, but its two predecessors were struck down, Safe Harbor in 2015 and Privacy Shield in 2020.
In practice, EU residency touches more pieces than you expect. The database and the application server are the obvious ones, but backups, the CDN, the transactional email provider, the analytics tool and the support system all count. A SaaS with a server in Frankfurt that sends emails through a provider processing in the United States without safeguards has an international transfer to document. Build the complete supplier list before answering any questionnaire.
What do enterprise clients ask for in due diligence?
An enterprise client's technical due diligence usually arrives as a questionnaire with 40 to 100 questions. The recurring blocks: exact location of data and backups, a signed DPA with a subprocessor list, encryption in transit and at rest, access management with auditable logs, an incident response plan with the 72-hour notification duty from Article 33, and a retention and deletion policy. Some add certifications such as ISO 27001, although for small companies documented evidence is usually enough.
The best way to avoid improvising is having the answers ready before the questionnaire lands. A 4 or 5 page security document covering architecture, encryption, subprocessors and procedures answers 80 percent of the usual questions. We have published a GDPR and security checklist for web applications you can use as a starting point for that document.
A real example from the logistics sector: a SaaS with 6 employees lost 2 months with a 300-employee prospect because it had no subprocessor list and no centralised access logs. Preparing both took 3 weeks of work. The contract was signed in the end, but that delay would have been avoided with a security dossier prepared in advance.
How do you build the architecture on AWS or Hetzner in an EU region?
On AWS, the typical architecture for a B2B SaaS with EU residency uses a European region such as eu-west-1 in Ireland or eu-south-2 in Aragon, Spain. An RDS database with encryption enabled, S3 with server-side encryption for files, KMS for key management and CloudTrail for access auditing. Check that no auxiliary service moves data out of the region: metrics, queues and backups must stay in the EU. AWS includes the Article 28 DPA clauses in its own service terms.
Hetzner is the European alternative most startups pick on price. It is a German company with data centres in Nuremberg, Falkenstein and Helsinki, and a cloud server with 8 GB of RAM costs around 15 EUR per month, 3 to 5 times less than the AWS equivalent. In exchange, you manage more yourself: backups, updates and high availability. For an MVP or a SaaS with fewer than 50 customers it is a solid option, and migrating to AWS later is a project of weeks, not months.
Whichever provider you choose, three measures survive every questionnaire: TLS 1.2 or higher in transit, AES-256 at rest, and centralised access logs with at least 12 months of retention. If you do not know where your application stands, our cybersecurity service covers exactly this review: encryption, access control, dependencies and infrastructure configuration.
Which DPAs do you need with your suppliers?
The DPA, or data processing agreement, is the Article 28 contract you must have signed with every supplier that touches your customers' personal data: hosting, transactional email, analytics, support, monitoring and payments. AWS, Hetzner and most serious providers include it in their terms or offer it for online signature in minutes. Your job is keeping an up-to-date register with supplier name, service, data location and DPA date. That register is one of the first things a due diligence asks for.
With suppliers processing outside the EU you need more than the DPA: standard contractual clauses approved by the European Commission plus a transfer impact assessment. That is paperwork you can avoid by choosing European alternatives where they exist. For transactional email, analytics and support there are options with 100 percent EU processing at equivalent prices. Every US supplier you remove from the list is one less page to justify in every security questionnaire.
How much does it cost to make a B2B SaaS GDPR-ready?
If you are building the product now, EU residency done right costs almost the same as doing it wrong: pick the region, enable encryption and sign DPAs from day one. We cover this in our SaaS development guide from idea to MVP. Retrofitting an existing SaaS is another story: migrating data across regions, enabling encryption on a production database and building auditable logs usually lands between 1,500 and 5,000 EUR and 3 to 6 weeks of work, depending on the state of the code.
Our approach at ASD Solutions: the same senior engineer who assesses your architecture executes the work, with a fixed price agreed before starting and no subcontracting. One-off fixes, such as centralising logs or closing a specific questionnaire, start at 300 EUR. A full compliance project sits in the usual SME range, between 1,500 and 15,000 EUR. And the code and infrastructure stay in your name, with no dependency on anyone going forward.
Frequently asked questions
Is it legally mandatory to host my SaaS on EU servers?
No. The GDPR allows international transfers with safeguards such as the Data Privacy Framework or standard contractual clauses. But hosting in the EU removes that paperwork, which can mean 2 or 3 extra documents per supplier, and answers the most repeated due diligence question outright. Many enterprise clients make EU residency a purchasing requirement even though the law does not, so hosting elsewhere costs you deals.
What is a DPA and who do I need to sign one with?
A DPA is the data processing agreement required by Article 28 of the GDPR. You need one signed with every supplier that processes personal data on your behalf: hosting, email, analytics, support and payments. A typical SaaS has between 5 and 10 such suppliers. AWS and Hetzner include a DPA in their terms, and most tools let you accept one online in minutes.
AWS or Hetzner for an early-stage B2B SaaS?
Hetzner if budget rules: a cloud server with 8 GB of RAM costs around 15 EUR per month and the data centres are in Germany and Finland. AWS if you need managed services, broad certifications and automatic scaling, at 3 to 5 times the price. Both support full EU residency and sign DPAs, so the choice is about cost and operations, not compliance.
What should I check first when a security questionnaire arrives?
Three things, in this order: exactly where your data and backups live, whether you have signed DPAs with every subprocessor, and whether queryable access logs exist. These are the blockers that kill the most deals. Closing the typical gaps takes 2 to 6 weeks, and one-off fixes start at 300 EUR if you need outside help.
How much does it cost to adapt an existing SaaS to GDPR with EU hosting?
It depends on your starting point. Migrating to an EU region, enabling encryption at rest and setting up auditable logs typically costs between 1,500 and 5,000 EUR over 3 to 6 weeks. If the scope is unclear, a 190 EUR technical audit with an initial diagnosis in 72 hours tells you exactly what is missing, and it is deducted from the project if you go ahead.
