Dedicated Server Compliance: GDPR, HIPAA, PCI DSS

Dedicated servers enable compliance with GDPR, HIPAA, PCI DSS through full infrastructure control. Configure encryption, audit logging, data residency, and monitoring to meet regulatory requirements. Full responsibility on customer—coordinate with legal and compliance teams.

Compliance Overview

Compliance frameworks applying to hosting:

• GDPR: EU data protection (personal data)
• HIPAA: US healthcare data protection
• PCI DSS: Payment card industry standards
• SOX: Financial reporting controls
• CCPA: California consumer privacy

GDPR Requirements

• Data encryption: AES-256 at rest
• Transit encryption: TLS 1.3 minimum
• Data residency: EU servers for EU residents
• Deletion rights: Remove all copies within 30 days
• Audit trails: Log all access, changes

HIPAA Compliance

Business Associate Agreement (BAA) required:

# Contact UnderHost sales for BAA
# Verify before signing up

• Encryption in transit & at rest
• Access controls (authentication, authorization)
• Audit logs of all access
• Breach notification procedures
• Data destruction procedures

PCI DSS Compliance

Level requirements by transaction volume:**

Key controls:

• Firewall configuration
• No default credentials
• Data encryption in transit
• Vulnerability scanning
• Access control & logging

Audit Trail & Logging

# Enable syslog for compliance
/etc/rsyslog.conf:
*.*     @@remote-log-server:514

# Log all user access
/var/log/auth.log    # Authentication events
/var/log/sudo        # Sudo commands
/var/log/audit/      # System audit logs

Encryption Requirements

• Full disk encryption: LUKS/BitLocker
• Database encryption: MySQL TDE
• Transport encryption: TLS 1.2+ for all services
• Backup encryption: AES-256

Data Residency

Geographic requirements:**

• GDPR: EU data must stay in EU
• Russia/China: Some regulations require localized hosting
• Australia: Sovereign data rules for government

Check data location:**

verify server location in contract
ensure backups stored in same region
confirm no cross-border transfers

Compliance Audits

• Internal audits: Monthly review of logs, access controls
• Third-party audits: Annual by qualified auditor
• Penetration testing: Annual security test
• Vulnerability scans: Quarterly minimum

Related: GDPR compliance | HIPAA compliance | PCI DSS compliance | Audit logging