How to Choose Secure Hosting for Records

Hosting a website is a performance problem. Hosting records is an evidence problem. The question is not only “is the data safe?” but “can you demonstrate, years from now, that it was safe, unaltered, and available only to the people who should have seen it?” This guide is the due-diligence process for answering that.

Start with the records, not the servers

Before comparing providers, write down four things for each class of record you hold:

1. What it is — patient files, matter files, transaction logs, personnel records.
2. How long you must keep it — and where that obligation comes from.
3. Who may see it — by role, not by name.
4. What happens if it leaks, is lost, or is altered — including who you must notify, and how quickly.

This single page determines everything downstream. A provider that is perfect for seven-year financial records may be entirely wrong for records that must stay in-country for twenty-five years. Without it, you are comparing feature lists against nothing.

Encryption and who holds the keys

Every credible provider now encrypts in transit (TLS 1.2 or 1.3) and at rest (AES-256). Those are table stakes and tell you almost nothing. The differentiating questions are about keys:

• Who holds the encryption keys? Provider-managed is the default; customer-managed keys (CMK) or bring-your-own-key put control in your hands and let you revoke access unilaterally.
• How often are keys rotated, and is rotation automatic?
• Is there a hardware security module behind the key store?
• Can provider staff decrypt your data? Ask directly. The honest answer for most platforms is “a small number of engineers can, under audited break-glass procedures” — which is acceptable if it is documented and logged.
• Is data encrypted between internal services, not just at the edge?

Retention, immutability and legal hold

A backup is not a retention control. Backups are designed to be overwritten; records retention is designed to prevent exactly that. What you want is:

• Object lock / WORM storage — a retention period that an administrator cannot shorten, enforced by the platform rather than by policy.
• Versioning so that an edit creates a new version instead of destroying the old one.
• Legal hold — the ability to freeze a set of records indefinitely, overriding any lifecycle rule, and to prove when the hold was applied and by whom.
• Defensible deletion — when retention expires, deletion should be deliberate, logged and certifiable, not a cron job nobody remembers writing.

Ask for a demonstration, not a data sheet: place a test object under a 30-day lock, then try to delete it as an administrator. A platform that lets you succeed has not implemented immutability; it has implemented a checkbox.

Data residency and who can see it

Three separate questions, and providers frequently answer only the first:

1. Where is the primary copy stored? Country and, ideally, region.
2. Where are the backups and replicas? Cross-region replication is a feature until it silently moves regulated data across a border.
3. From where can support staff access the data? A follow-the-sun support desk may mean administrators on three continents can view your records. Some regimes treat that as a transfer.

Get the answers in the contract, not in a chat transcript. If a provider will not commit to a region contractually, the region is a preference, not a guarantee.

Access control and audit logging

If a breach investigation cannot answer “who accessed this record, when, and from where”, the notification you send will have to assume the worst — which is expensive in every sense.

Backup, resilience and tested recovery

Define two numbers before you shop, then hold providers to them:

• RPO (recovery point objective) — how much data you can afford to lose, measured in time. Daily backups mean an RPO of up to 24 hours.
• RTO (recovery time objective) — how long you can be without the system.

Then ask the awkward questions. When was the last full restore test, and can you see the report? Are backups isolated from production credentials, so that ransomware which takes the live system cannot also encrypt the backups? Is there an immutable copy? Can you restore a single record, or only the whole dataset?

Contracts, certifications and evidence

• A data processing agreement naming purposes, sub-processors, transfer mechanisms and breach-notification timeframes.
• Sector agreements where relevant — a business associate agreement for protected health information, for example.
• Current SOC 2 Type II or ISO/IEC 27001 evidence. Ask for the report or Statement of Applicability under NDA, and check the scope covers the service you are buying — certifications are often narrower than the marketing implies.
• A sub-processor list with change notification, so you learn about a new third party before your data reaches it.
• Breach notification within a defined number of hours, not “promptly”.
• Right to audit or to receive audit summaries, and evidence of penetration testing.

The exit plan nobody writes

Write down, before you sign, how you would leave. It is the cheapest insurance in the whole process:

1. In what format can you export everything, including metadata and audit logs?
2. How long would a full export take, and what would egress charges be?
3. How long does the provider keep your data after termination, and how is deletion certified?
4. If the provider fails commercially, who can access the systems, and is there an escrow?

A provider that answers these calmly has been asked before. Hesitation here is itself an answer.

The due-diligence checklist