[{"data":1,"prerenderedAt":211},["ShallowReactive",2],{"seo-verification":3,"blog-gdpr-processor-register-web-agency-hosting-dns-email-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-gdpr-processor-register-web-agency-hosting-dns-email-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":26,"featuredImage":28,"bgImage":29,"posterImage":30,"relatedSolution":28,"intro":31,"sections":32,"ctaTitle":154,"ctaBody":155,"ctaButton":156,"ctaUrl":157,"relatedPosts":158},542,"gdpr-processor-register-web-agency-hosting-dns-email",{"fr":12,"en":10,"ar":13,"es":14},"rgpd-sous-traitants-hebergeur-agence-registre","سجل-المعالجين-من-الباطن-اللائحة-العامة-لحماية-البيانات-للوكالات","registro-encargados-tratamiento-rgpd-agencia-hosting-dns-correo","GDPR processor register for web agencies: a working model","A client asks for your processors and the data processing agreement? Register columns, services to list, agreement points to check. A practical guide.",10,0,false,"2026-10-30T00:00:00+00:00","2026-10-31T01:54:06+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},"Compliance & Regulation","conformite","bg-amber-500\u002F10 text-amber-400",[27],{"id":17,"name":23,"slug":24,"color":25,"icon":24},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Frgpd-sous-traitants-hebergeur-agence-registre-poster.svg","A client writes: \"Send us the list of your processors and the data processing agreement that goes with it.\" The agency opens its files and finds it cannot say where its portfolio's data sits: host, DNS, mailboxes, off-site backup. The subject does not fall on the host alone, and it is not reserved for lawyers. This article offers a simple register, column by column, the list of services to inventory, the agreement points to check and a way to tie it all to each client. It is a practical guide, not legal advice.",[33,37,69,72,75,86,89,100,128,131,141,145,148,151],{"type":34,"title":35,"body":36},"h2","Who is controller, who is processor, and why the agency is in the chain","Regulation (EU) 2016\u002F679 distinguishes the controller, which decides the purposes and means of processing, from the processor, which processes personal data on its behalf. Your client, who runs a site, a shop or a newsletter, is generally the controller. As soon as you host, administer or back up that site, you process that data for the client: the agency then usually acts as a processor. The host, the email provider or the backup service you use in turn work for you. They are the agency's sub-processors, and they should act only with the client's written authorization.\n\nThe qualification is not chosen at will. The CNIL reminds us that the principal and the provider analyze their roles together, based on what each actually does with the data. An agency that reuses a client's data for its own needs, for example its prospecting, becomes a controller for that use alone. The common objection, \"this is the host's problem\", forgets that the chain runs through you: the client questions the agency, and the agency must know which links it added.",{"type":38,"title":39,"headers":40,"rows":44},"comparison","Roles in the chain, from client to host",[41,42,43],"Party","Most frequent role","What it owes the party above",[45,49,53,57,61,65],[46,47,48],"End client (site, shop, newsletter)","Controller","Give written instructions and choose providers knowingly",[50,51,52],"Agency that hosts, maintains or backs up the site","Processor for the client","A processing agreement, the list of its own processors and where they process",[54,55,56],"Host, server provider","Agency's sub-processor","An equivalent agreement, described security measures, information on its own providers",[58,59,60],"DNS provider, registrar","Sub-processor, depending on the data handled","Handle records and query logs according to your instructions",[62,63,64],"Mail service, off-site backup","Sub-processor","Encryption, retention period, deletion on exit",[66,67,68],"Agency reusing the data for itself","Controller, for that use alone","A legal basis and information to individuals, independent of the client contract",{"type":34,"title":70,"body":71},"The day the client asks for the list","The scenario is ordinary. The client prepares an audit, answers a tender or fills in a large customer's questionnaire, and asks for the agency's processors with the matching agreement. Without a register, the agency rebuilds from memory: the server is at one host, the mailboxes at another, the backup in storage created one night during an outage, the DNS at the original registrar. This rushed work takes days and leaves gaps. An up-to-date register fits on one shared sheet plus one sheet per client, and can be produced in minutes. It also serves the agency itself: the day of a vulnerability or a leak, you know where to look and whom to warn.",{"type":34,"title":73,"body":74},"The register columns","The register does not need a specialized tool. A shared spreadsheet, readable by the clients concerned and writable by two people at the agency, is enough to start. Keep one row per service and per client rather than one row per provider: the host of a thirty-site portfolio is a single provider, but thirty distinct data scopes. Here are the columns to plan.",{"type":76,"title":77,"items":78},"ul","Seven columns are enough",[79,80,81,82,83,84,85],"**Service** — the provider and the service: server hosting, DNS, mailboxes, off-site backup, monitoring.","**Role** — controller, processor or sub-processor, from the agency's point of view and for this specific service.","**Data concerned** — categories of data and individuals: shop customer accounts, contact forms, mailboxes, access logs.","**Location** — country and processing site, backups included, and any remote access by a provider located outside the Union.","**Contractual basis** — the processing agreement, its terms or addendum, with the version and the location of the signed document.","**Review date** — the day of the last check and of the next: a register without a date does not say whether it is still true.","**Contact** — the person or address at the provider to reach for a request, an incident or an audit question.",{"type":34,"title":87,"body":88},"Services to list for a client site","The trap is listing only the host, because it is the one paid every month. Yet a client site sends data to many more places: the DNS zone, the mail service, the backup you connected, the tool that receives alerts, the service relaying traffic, the scripts loaded from a third party. Each can see IP addresses, email addresses or form contents. The list below is a starting grid; add whatever else your stack contains.",{"type":76,"title":90,"items":91},"Eight service families to review",[92,93,94,95,96,97,98,99],"**Hosting** — shared server, VPS or dedicated, and the hypervisor or region behind it.","**DNS** — the host of the zone, which may differ from the domain name registrar.","**Email** — the client's mailbox service, transactional sending relay, spam filter.","**Off-site backup** — the remote storage, its encryption and retention period.","**Monitoring** — the tool receiving logs and alerts, often hosted elsewhere than the site.","**CDN and WAF** — the service relaying traffic sees IP addresses and sometimes request contents.","**Analytics tools** — audience measurement, maps, fonts and scripts loaded from a third party.","**Application services** — payment, forms, newsletter, chat, plugins that send data to their publisher.",{"type":101,"title":102,"steps":103},"steps","Map a site in eight steps",[104,107,110,113,116,119,122,125],{"title":105,"body":106},"Identify the domain and DNS zone","Find the registrar and the name servers: `whois your-domain.com` then `dig +short NS your-domain.com`. Note who holds the zone and who can change it.",{"title":108,"body":109},"Find the host","`dig +short A your-domain.com` gives the site address, and `whois 203.0.113.10` (replace with the address you got) shows the network carrying it. If a CDN sits in front, the address is its own: ask the client for the origin or read it in your hosting panel.",{"title":111,"body":112},"Read the mail service and senders","`dig +short MX your-domain.com` names the receiving service. `dig +short TXT your-domain.com` shows the SPF record, which lists services allowed to send for the domain: newsletter, invoicing, forms.",{"title":114,"body":115},"List third-party resources the site loads","Open the site with the browser's Network tab and sort by domain, or run `curl -s https:\u002F\u002Fyour-domain.com | grep -o 'https:\u002F\u002F[^\"]*' | sort -u`. Each third-party domain is a candidate row.",{"title":117,"body":118},"Inventory backup and monitoring","On the server, `crontab -l` and `rclone listremotes` show where copies go. Add the monitoring agents and alert services you installed yourself.",{"title":120,"body":121},"Review plugins and integrations","For WordPress, `wp plugin list` gives the plugins; for another stack, read the dependency file. Keep those that send data outside.",{"title":123,"body":124},"Fill in the register and qualify each row","For each service, state the role, the data, the location and the contact. Whatever you cannot fill in becomes a written question to the provider.",{"title":126,"body":127},"Attach the agreement and set the review","Tie each row to its contract document, its version and the next review date. A row with no agreement stays flagged orange until one is obtained.",{"type":34,"title":129,"body":130},"Points of a processing agreement to check","An agreement is not signed with eyes closed, and it is not a box ticked in a client panel. For the host, the DNS or the backup, check that the document covers the seven points below. We cite no article of law here: the CNIL publishes a processor guide and a sample of clauses, to read with your counsel. If a point is missing, do not infer it from the contract's silence: ask in writing and keep the answer with the register row.",{"type":76,"title":132,"items":133},"What the agreement must cover",[134,135,136,137,138,139,140],"**Subject and nature of processing** — what the provider does with the data, for what purpose, on which categories of data and individuals.","**Duration** — the processing period, which in principle follows the service contract.","**Documented instructions** — the provider processes only on written instruction and flags any instruction it thinks breaches the rules.","**Security** — described technical and organizational measures, confidentiality of authorized staff, incident notification.","**Sub-processors** — general or specific authorization, a communicated list, prior notice of any change and a right to object.","**Return or deletion** — handing back or erasing the data at the end of the service, with a deadline and proof.","**Audit and assistance** — information to demonstrate compliance, possible audits, help answering requests from individuals.",{"type":142,"title":143,"body":144},"tip","Keep the evidence next to the row","For each provider, keep a link to the signed document, the acceptance date if the agreement is accepted online, and a copy of the sub-processor list it publishes. When that provider changes its list, the register row is reviewed the same day, not at the next deadline.",{"type":34,"title":146,"body":147},"Tying the register to clients and to a review rhythm","Keep the register on two levels. A shared sheet describes each provider once: agreement, location, contact, list of its sub-processors. One sheet per client shows which services touch its data and what scope they cover. When a client asks for its list, you extract its rows without rebuilding anything. Set a review at a regular pace, for example every quarter, and a review triggered by any change: new provider, server migration, new plugin calling an external service. The monthly audit of a client VPS and the restore test of a backup are good moments to spot these gaps, because you already look at what actually runs.",{"type":34,"title":149,"body":150},"What a single provider changes in the register","Each service taken from a separate party adds a row, an agreement to collect, a contact to maintain and a sub-processor list to follow. Grouping domain, hosting and DNS with one provider mechanically reduces the number of rows and what remains to reread. There is a counterpart: dependence on a single supplier is also noted in the register, with how to leave if needed. On ServOrbit.com, the pages \u002Fpourquoi\u002Fsecurite and \u002Fpourquoi\u002Finfrastructure describe what we operate and where. They do not replace a contractual document and this article claims no certification: to obtain the documents of a specific service, write to support@servorbit.com stating the scope concerned.",{"type":34,"title":152,"body":153},"Three actions this week, and the official sources","Create the spreadsheet with the seven columns. Fill it in for the client whose data is most sensitive, using the eight mapping steps. Then send a written request to each provider whose agreement or sub-processor list is missing. For reference texts, rely on official sources: the CNIL processor guide (https:\u002F\u002Fwww.cnil.fr\u002Ffr\u002Freglement-europeen-sur-la-protection-des-donnees-un-guide-pour-accompagner-les-sous-traitants), its page on the processor (https:\u002F\u002Fwww.cnil.fr\u002Ffr\u002Fqualification-juridique-sous-traitance) and the regulation text on EUR-Lex (https:\u002F\u002Feur-lex.europa.eu\u002Feli\u002Freg\u002F2016\u002F679\u002Foj). This article is a practical guide and is not legal advice: have your agreements and qualifications validated by a legal professional.","Fewer providers, fewer rows to maintain","Domain, hosting and DNS with a single provider: your processor register has fewer rows and fewer agreements to collect. With the agency offer from ServOrbit.com, you follow your clients' portfolio from a single space.","Discover the agency offer","\u002Fsolutions\u002Fagences",[159,176,197],{"id":160,"slug":161,"slugs":162,"title":166,"excerpt":167,"readTime":168,"views":169,"isPinned":19,"publishedAt":170,"updatedAt":171,"category":172,"categories":173,"featuredImage":28,"bgImage":29,"posterImage":175,"relatedSolution":28},328,"dora-what-the-regulation-requires-of-your-ict-contracts",{"fr":163,"en":161,"ar":164,"es":165},"dora-resilience-operationnelle-hebergement","dora-ما-يفرضه-النظام-على-عقود-تكنولوجيا-المعلومات","dora-lo-que-el-reglamento-exige-de-sus-contratos-tic","DORA: what the regulation requires of your ICT contracts","DORA (EU 2022\u002F2554) mandates specific clauses in every ICT contract. Articles 28 and 30 explained: mandatory provisions, audit rights, TLPT and data location.",12,2,"2026-09-04T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":17,"name":23,"slug":24,"color":25,"icon":24},[174],{"id":17,"name":23,"slug":24,"color":25,"icon":24},"\u002Fblog\u002Fcovers\u002Fdora-resilience-operationnelle-hebergement-poster.svg",{"id":177,"slug":178,"slugs":179,"title":183,"excerpt":184,"readTime":185,"views":18,"isPinned":19,"publishedAt":186,"updatedAt":187,"category":188,"categories":194,"featuredImage":28,"bgImage":29,"posterImage":196,"relatedSolution":28},523,"test-client-vps-backup-restore-agency-procedure",{"fr":180,"en":178,"ar":181,"es":182},"tester-restauration-sauvegarde-vps-client-agence-procedure","اختبار-استعادة-نسخة-احتياطية-vps-عميل-وكالة-إجراء","probar-restauracion-copia-seguridad-vps-cliente-agencia-procedimiento","Testing a client backup restore: an agency procedure","A quarterly procedure to restore a client site on a disposable VPS, measure the actual RTO and RPO, and hand the client a dated restore test log.",11,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:23+00:00",{"id":189,"name":190,"slug":191,"color":192,"icon":193},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[195],{"id":189,"name":190,"slug":191,"color":192,"icon":193},"\u002Fblog\u002Fcovers\u002Ftester-restauration-sauvegarde-vps-client-agence-procedure-poster.svg",{"id":198,"slug":199,"slugs":200,"title":204,"excerpt":205,"readTime":17,"views":18,"isPinned":19,"publishedAt":186,"updatedAt":206,"category":207,"categories":208,"featuredImage":28,"bgImage":29,"posterImage":210,"relatedSolution":28},521,"monthly-security-audit-checklist-client-vps-agency",{"fr":201,"en":199,"ar":202,"es":203},"checklist-audit-securite-mensuel-vps-clients-agence","قائمة-تدقيق-أمان-vps-شهرية-للعملاء-للوكالات","auditoria-seguridad-mensual-vps-clientes-agencia-checklist","Monthly client VPS security audit: a 45-minute checklist","Seven checks to run every month on a client VPS: updates, kernel, SSH accounts, ports, certificates, backups, logs. Includes a dated one-page report.","2026-10-29T03:10:22+00:00",{"id":189,"name":190,"slug":191,"color":192,"icon":193},[209],{"id":189,"name":190,"slug":191,"color":192,"icon":193},"\u002Fblog\u002Fcovers\u002Fchecklist-audit-securite-mensuel-vps-clients-agence-poster.svg",1793414234225]