Sovereignty · Updated 10 November 2026 · 9 min read

Where a European fintech should host its app in 2026

DORA, card data and certificates decide the host before price does. Six European options for a fintech, with what each one can show an auditor today.

View as Markdown

If your app is the regulated service itself, pick a European platform that already holds ISO 27001 and runs a managed database: Scalingo and Clever Cloud for a Git-push workflow, Upsun if you want a preview environment per branch and a published PCI and SOC 2 list. OVHcloud and Exoscale fit teams that run their own servers or Kubernetes and need PCI DSS or BSI C5 at the infrastructure layer. Eurobase suits the parts around the core, such as the marketing site, docs and dashboards that don't hold card or account data, until its certifications are done.

Fintech hosting options at a glance

Platform	Company	Certifications stated on its own site	Managed Postgres	Starts at
Scalingo	Strasbourg, France	ISO 27001, HDS option, SecNumCloud region on Outscale	Yes	€7.20 a month for 256 MB, excl. VAT
Clever Cloud	France	ISO/IEC 27001:2022, HDS, SecNumCloud zone with a partner	Yes	Free credits, then by instance size
Upsun	Paris, France	ISO 27001, SOC 2 Type 2, PCI Level 1	Yes	€9 per project and €10 per user a month, plus resources
OVHcloud	France	PCI DSS on Hosted Private Cloud Premier	Sold separately	Not stated for PCI products
Exoscale	Lausanne, Switzerland	ISO 27001, BSI C5, SOC 2	Yes	Billed by the second
Eurobase	Warsaw, Poland	ISO 27001 and SOC 2 in progress, none held	No	Free, then €10 a month + VAT

Certifications and prices are from each provider's own page, checked on 9 and 10 November 2026.

What a fintech should check first

Whether DORA applies to you. Payment and e-money institutions, credit institutions, investment firms, crypto-asset service providers and other financial entities have been under DORA since 17 January 2025. If you sell software to banks, expect them to ask for DORA terms. The NIS2 and DORA guide lists them.
Which function the app supports. DORA's strictest contract rules, such as unrestricted audit rights and an exit plan with a transition period, apply when a service supports a critical or important function. You make that classification yourself.
Whether card numbers ever touch your servers. If they do, your hosting falls inside PCI DSS scope.
What the host will sign. Ask for the SLA, the DPA, the subprocessor list and the audit clause before you build.
Who owns the company and where data, logs and backups live. A European region on a US cloud is a different answer from a European company. See EU region vs EU company.

Keep card data off your host

Most fintech teams can shrink the hosting question by never handling raw card numbers. Stripe's security guide says its low-risk integrations send payment details straight to Stripe without passing through your servers, which reduces your PCI obligations. The card type, last four digits and expiry date it returns are outside PCI scope, so you can store them in your own database. PCI compliance stays a shared duty: you still attest each year, but the host underneath your web app no longer has to be a PCI DSS service provider.

1. Scalingo

A Heroku-style platform from Strasbourg. Its home page states ISO 27001 certification, an HDS option and a SecNumCloud IaaS region on Outscale, with all data centres in Europe and no data transfer outside the EU. Its site footer links an SLA and a DPA.

Best for: a payment or lending app built around Postgres that must answer bank-grade security questionnaires.
Price: a 256 MB container from €7.20 a month excl. VAT, or €8.64 in the SecNumCloud region, and the smallest Postgres from €7.20 a month excl. VAT for 512 MB and 10 GB. You can try it free for 30 days.
What it lacks: a PCI DSS or SOC 2 report on its home page.

2. Clever Cloud

A French Git-push platform. Its security page lists ISO 27001:2022 and HDS certification, says each application runs in its own virtual machine, and offers a SecNumCloud zone hosted with a certified partner. Its home page says it operates its own data centres in France, while the security page also lists partner sites, a few of them PCI DSS certified.

Best for: teams that need many languages and add-ons next to an ISO-certified host, with a path to SecNumCloud for French clients.
Price: free credits at sign-up, then by instance size and count.
What it lacks: a PCI DSS certification for the platform itself. Its security page shows PCI DSS only next to some of the data centres it uses.

3. Upsun

Platform.sh SAS, doing business as Upsun, is based in Paris. Its trust centre lists ISO 27001, SOC 2 Type 2, PCI Level 1 and an IBM Cloud for Financial Services validation, and financial services appears among its industries. Every branch can get a full copy of the stack, services included.

Best for: a fintech that wants SOC 2 and PCI on the vendor list today and tests each change on a full environment.
Price: €9 per project and €10 per user a month, plus resources billed per second.
What it lacks: a European-owned layer everywhere. Its regions run on AWS, Azure, Google Cloud or OVHcloud, and the regions page names the provider for each one, so pick the region with that in mind.

4. OVHcloud

A French cloud group. Its PCI DSS page says Hosted Private Cloud Premier has been PCI DSS certified since 2015, in data centres in France, Canada, the UK, Germany and Poland. OVHcloud supplies a responsibility matrix and the documents your assessor needs, while you stay responsible for the virtual machines and the application.

Best for: a team that handles card data itself and has the engineers to run a private cloud.
Price: not stated on the PCI DSS page.
What it lacks: a push-to-deploy platform. You build and operate the stack.

5. Exoscale

A Swiss cloud from Lausanne. Its compliance page states an ISO 27001 certified ISMS, plus ISO 27017, ISO 27018 and BSI C5, and names banking among the regulated sectors it supports. The same page lists SOC 2 and HDS, and its per-site table shows PCI DSS for several data centres.

Best for: fintechs serving Swiss, Austrian or German customers that want managed Kubernetes and databases under one European company.
Price: resources are billed by the second.
What it lacks: a Git-to-production workflow. You bring containers or Kubernetes.

6. Eurobase

Eurobase is a business registered in Warsaw, Poland, on European infrastructure run by Scaleway, a French provider. You connect a repository on GitHub, GitLab, Codeberg, Forgejo or Gitea; frameworks such as Next.js run on V8 isolates, servers run as containers, and an MCP server and a CLI let coding agents ship changes too.

Best for: a fintech's public website, documentation, status or onboarding pages and internal tools that call a payment provider rather than store card or account data.
Price: a Free plan, then €10 or €20 a month + VAT for the workspace. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
What it lacks: ISO 27001 and SOC 2 are still being worked toward, and the terms give no SLA unless a signed agreement says so. The DPA limits audits to reasonable requests scoped to your data, which falls short of the unrestricted audit rights DORA wants for a critical function. There's no managed Postgres, MySQL or Redis. GitHub and GitLab Inc. are US subprocessors when you connect them.

How to choose

Map your services by function. Mark what supports a critical or important function under DORA and what touches card data.
Move card entry to your payment provider's hosted fields or checkout if you haven't already.
Put the regulated core on a host that holds the certificates today: Scalingo or Clever Cloud for a PaaS, Upsun if SOC 2 and PCI matter to your buyers, OVHcloud or Exoscale if you run the infrastructure.
Host the rest where it's cheapest to run well, Eurobase included, and record every ICT contract in your register of information.

Frequently asked questions

Does a fintech have to host in the EU?

GDPR and DORA don't require EU hosting as such. GDPR governs transfers out of the EU, and DORA asks you to know where services run and data is stored and to weigh risks from providers in third countries. Many supervisors and bank customers still expect European hosting, so it's the simpler path.

Is AWS, Azure or Google Cloud allowed under DORA?

Yes. DORA doesn't ban any provider. It sets contract, risk and exit rules for each ICT provider you use, and the European Supervisory Authorities oversee providers they designate as critical for the financial sector.

Does my web host need PCI DSS?

Only if card data passes through it. When card details go straight from the customer's browser to a payment provider, the provider's PCI certification covers the card data, and you still complete your own yearly attestation.

Which European hosts hold ISO 27001?

Among the options here, Scalingo, Clever Cloud, Upsun and Exoscale state ISO 27001 on their own sites. Eurobase is working toward it and doesn't hold it yet.

Can a small fintech start on a cheap host and move later?

Yes, if you plan the exit early: code in Git, standard runtimes and a database you can dump and restore. Check first whether your licence or a bank partner already requires a certified host.