US-Based Cloud Hosting: How to Keep Your Data in the US
What US-based cloud hosting means in practice, the four places data leaves the country without you noticing, and the questions that get it in writing.
What US-based cloud hosting means in practice, the four places data leaves the country without you noticing, and the questions that get it in writing.
Seven steps to host a website on a VPS: pick a server, connect over SSH, secure it, install a web server, upload your site, point your domain, and add HTTPS.
How to upload a PDF, a photo, or a long paste to a free AI chat without an account, what happens to the file, and what the free tier won't do with it.
The six jobs a free AI chat does well for a small business, the two it shouldn't touch, and how to pick one without handing over a card or your customer data.
US-based cloud hosting means your servers, the copies of your data, and the people who can reach them are all inside the United States. Picking a US region in a provider's dropdown gets you the first of those three. The other two are where most "we host in the US" claims quietly fall short, and they're what a customer, an auditor, or a contract will ask about.
This matters to more businesses than it used to. A healthcare practice, a county contractor, a law firm, or a company with a clause in a customer agreement that says "data will remain in the United States" needs to know the answer and be able to show it. Pew Research Center found in 2023 that 73% of Americans feel they have little or no control over what companies do with their data (Pew Research Center), and the businesses holding that data feel it from the other side: the customer asks where it is, and "the cloud" isn't an answer.
This guide covers what keeping data in the US involves, the four places it leaks across a border without anyone deciding it should, and the questions that get a provider to say so in writing. If you're choosing between residency and sovereignty as concepts, Data Sovereignty Is About to Matter More Than You Think covers the distinction.
Data stays in the United States when the server runs here, every backup and snapshot is stored here, the logs and metrics about your workload are kept here, and support staff who can access it are located here. A provider that can say yes to all four has US-based hosting. One that can say yes to the first has a US region.
The difference shows up in a contract. "Primary storage in us-east" is one line. "No copy of customer data is stored or processed outside the United States" is a different line, and it's the one a compliance officer wants. Before you can ask for the second, you need to know what it covers.
Data leaves the country through backups replicated to a cheaper region, support tooling hosted abroad, third-party services the provider uses for logging or email, and traffic that routes through another country on its way to the user. None of these shows up in the region picker. All of them are a question you have to ask.
The four:
What cloud hosting costs per month for a small website, what drives the number, the line items that surprise people, and how to size a plan you won't outgrow.
A provider that owns its facilities and employs its own staff can answer all four with "here." A provider that resells someone else's cloud has to go and ask, and the answer may change.
Ask for the physical address of the data center, the location of backup storage, the location of support staff with access, and the sub-processor list, and ask for the answers in writing. A provider that keeps data in the US can answer all four in an email. One that can't will offer you a region name instead.
The questions, as you'd write them:
As the concrete example of how a provider answers: Carpathian owns and operates two facilities in Des Moines, Iowa, a production site in service since 2024 and a recovery site since 2025, and its policies state that its systems are based and operated in the United States (Carpathian data centers). The limitation to read in the same breath is that two facilities in one metro are site redundancy, not geographic redundancy. If your requirement is "data in the US and in two separate regions," one metro doesn't meet the second half, and a provider with multiple US regions does.
No. US-based hosting answers where the data is, not who can see it. US law applies to data held by a US company, and a lawful request reaches it. Encryption you control, access logging, and a provider that limits who can reach your storage are what answer the privacy question, and they're a separate checklist.
Three things to separate:
For a business that needs both residency and privacy, the usual shape is a US provider for the first and your own encryption and access control for the second. The provider's job is to tell you, in writing, what it does and doesn't do on each.
US-based hosting doesn't matter for a public marketing site, a blog, documentation, or anything with no personal data on it. A brochure site hosted anywhere serves the same page. Paying more for residency on data that has no residency requirement is money spent on a line in a checklist nobody asked for.
Where it does matter, roughly in order of how often it comes up:
If none of those applies, pick a host on the other criteria, and How to Evaluate a Web Host and Pick the Best One has the list.
Take the four questions above, send them to whichever provider you're considering, and keep the reply. If you want Carpathian's answers, they're on https://carpathian.ai/data-centers and in the policies linked from it, and a server in Des Moines is a few minutes away at https://carpathian.ai/signup?service=cloud. If your requirement includes a second US region, say so when you ask, so the answer you get is the one you need.