We are not a design agency reselling a cloud account. Garan Cloud Solutions, our own infrastructure division, runs the servers your site lives on, which is why we can put our hosting commitments in the contract.
Most hosting answers in a tender file stop at the first one. Here are our answers to all four.
Where your data physically sits
Servers located in France and the European Union. No replication, no backup and no processing outside the EU, including for logs, monitoring and email. The location is named in the contract, not left to a general policy page.
Who can be compelled to hand it over
Location is only half the answer. An EU datacenter operated by a company with a US parent can still be reached through extraterritorial law. Our infrastructure is operated by a European company, so that exposure does not exist.
Who can technically access it
Administrative access is limited to a named list of our engineers, with individual accounts, strong authentication and full logging. The list is given to you and updated when it changes.
What happens to it when you leave
On termination you get a full export, and we provide written confirmation of deletion from production and backups once your retention period has run out.
These figures go into the contract. If you need stronger levels for a critical service, tell us in the specification and we will price them.
Data location
France and the European Union
Operator jurisdiction
European, outside the US Cloud Act
Uptime target
99.9% monthly
Backup frequency
Daily, encrypted, 30 day retention
Restore time
Under 4 hours for a full site
Support hours
Business hours, monitoring and alerting 24/7
Reporting
Monthly uptime, performance and security report
Reversibility
Full export of code, database and media on request
You remain the data controller. Our job is to make that role easy to hold, with the documents and the technical measures ready rather than promised.
Processing agreement
A data processing agreement covering our role as processor, our obligations and our subprocessors, listed by name.
Data minimisation
Forms and services collect only what the procedure legally requires, with a defined retention period for each field.
Consent management
A compliant cookie banner with real refusal, and audience measurement configured to run without consent.
Resident rights
Access, rectification and erasure requests handled through a documented route your teams can actually operate.
Breach notification
A defined procedure and contact chain so you can meet the notification deadline if an incident ever occurs.
Support for your DPO
The technical documentation your data protection officer needs for the processing register, provided without having to chase us.
Garan Cloud Solutions hosts the group's own portfolio companies and their traffic, with monitoring, daily backups and tested restores already in place. Your site joins an infrastructure we depend on ourselves every day.
Visit Garan Cloud Solutions
