Skip to content
Log In
Oh Dear

EU-hosted data. Signable DPA.

GDPR uptime monitoring.

When a client's DPO asks where monitoring data lives, you need a specific answer. Oh Dear is Belgian, stores monitoring data in Belgium, and publishes its DPA and subprocessor list. Uptime checks run every minute from locations worldwide.

10-day free trial · No credit card required

See how it works
Capterra
4.9 (73) G2
4.7 (33)
Data stored in Belgium Signable DPA
  • Bitmovin
  • HBO Nordic
  • Obsidian
  • Laravel
  • Fathom Analytics
  • PHP 8
  • Stanford University
  • Takeaway.com
  • IGN
  • VRT NWS
  • spatie

The vendor questionnaire

Procurement asked where the monitoring data lives.

Where does the monitoring data live? Which company holds it? Which courts can compel it?

You need an answer you can forward the same day.

You manage a portfolio of client sites: unrelated domains, different CMS setups, different contracts. One of those clients is an EU company, or a public-sector body. Their DPO or procurement team writes in.

They are not asking whether you take privacy seriously. They want a data map, a DPA they can file, and a subprocessor list they can read without an NDA. A checkbox on a pricing page does not survive that review.

With Oh Dear, GDPR applies by default, not through an adequacy decision or a framework, because the company is Belgian. The Data Processing Agreement and the subprocessor list are public pages. That is the pack you send.

The tools that run Oh Dear are mostly European too: hosting at Combell (Belgium), performance metrics in ClickHouse Cloud's EU region, error tracking by Flare (Belgium), newsletters via Mailcoach (Belgium). US subprocessors are on the same public list.

You still need website uptime monitoring on those client sites. GDPR uptime monitoring is that same job, with a vendor who will name where the monitoring data lives.

Rik Konings
Positive and easy to use, good interface and easy to integrate with other tools.

Rik Konings, Founder at Kings Digital

Said about Oh Dear in general. This quote is not about GDPR and makes no compliance claim.

The whole data map

Where the monitoring data lives.

Oh Dear will name where the data is stored. The rest of the map is public too, and not all of it is in Belgium. Read it before you tell a DPO that everything is in the EU.

Stored in Belgium.

Monitoring data and settings · Combell Check results, uptime history, sites, settings, and team members, on servers in Belgium run by Combell.
ISO 27001 · ISO 27701 Combell is certified ISO 27001 and ISO 27701. Those certificates cover Combell's hosting. They are not Oh Dear certificates.

Stored in the EU.

Performance metrics · ClickHouse Cloud Performance metrics are stored in ClickHouse Cloud's EU region.

Worldwide and global.

Uptime probe nodes · AWS, DigitalOcean, Vultr Worldwide.
Backups and check reports · AWS Global.
CDN and DDoS protection · Cloudflare Global.

Documents for the vendor file

The paperwork procurement asks for.

Procurement does not want a blog post. They want documents they can attach to the vendor file. Oh Dear acts as a data processor.

GDPR Article 28 DPA

A Data Processing Agreement, pre-signed.

The DPA covers the personal data processed, retention, security, subprocessors and your rights as a controller. Every customer can use the pre-signed PDF. A countersigned copy is available on request.

Data Processing Agreement Pre-signed PDF
1. Personal data processed
2. Retention
3. Security controls
4. Subprocessors: engaged and notified
5. Controller rights
Read the DPA
No NDA Public list

A subprocessor list you can open without a call.

The subprocessor list is public and kept current. It shows which subprocessors sit outside the EU, including US subprocessors.

Combell Belgium
ClickHouse Cloud EU region
AWS · DigitalOcean · Vultr US providers
See every subprocessor
Transfers outside the EU SCCs

Standard Contractual Clauses.

Transfers outside the EU rely on the Standard Contractual Clauses (Decision 2021/914), in line with EDPB guidance on international transfers.

EU SCCs · 2021/914 Outside the EU
Export · correction · deletion DSRs

Data-subject requests, answered from Europe.

The team owner can cancel the subscription and delete the team in Team settings. Oh Dear handles formal erasure requests by email, and keeps the invoices that Belgian bookkeeping law requires.

  1. 1. Cancel the subscription
  2. 2. Team settings › General
  3. 3. Delete team
How do I delete my account?

Where checks run vs where data is stored

Checks run worldwide. Monitoring data stays in Belgium.

A check that only runs from Brussels cannot see what a visitor in Singapore sees. If the site is slow or down for that visitor, a Europe-only check stays quiet. That is why Oh Dear checks from several locations worldwide, every minute.

One check, two locations From the public data map

Where checks run

Probe nodes
Worldwide
Providers
AWS · DigitalOcean · Vultr
Cadence
Every minute
Primary location
Your choice per monitor

Where results are stored

Check results
Belgium · Combell
Uptime history & settings
Belgium · Combell
Performance metrics
ClickHouse Cloud · EU region
Backups & check reports
AWS · Global

Pick a primary check location per monitor, under Settings > Uptime check > Check location. There are cities on six continents, and in Europe: Frankfurt, Paris, London and Stockholm. When the primary location sees a failure, a different location checks again before you are alerted. Choosing a check location. The probe addresses are public if you need to allow the traffic: used IPs.

Not a wall of badges

What this page does not claim.

If a questionnaire asks for SOC 2, a contractual SLA, or an Oh Dear ISO certificate, the answer is no. Better to know that now than in round three of the review. Probe nodes, backups and check reports run on US providers, so Oh Dear does not claim immunity from the US CLOUD Act either. GDPR is where the compliance work goes. For a vendor review, use the Terms, the Privacy Policy, the GDPR DPA and the security page.

SOC 2 Not held
Formal SLA Not offered
ISO 27001 / 27701 held by Oh Dear No, Combell's hosting
US CLOUD Act immunity Not claimed
Are you SOC 2 verified?

Agencies first

Who needs GDPR uptime monitoring.

Oh Dear pairs website monitoring with a clear answer about where monitoring data lives.

Agencies Every client site

You get the questionnaire.

When a client's DPO reviews monitoring, you need a data map, a DPA and a subprocessor list you can send. Every client site you add gets the same answer about where its data lives.

client-one.be Data stored in Belgium
client-two.nl Data stored in Belgium
client-three.de Data stored in Belgium
client-four.fr Data stored in Belgium
Oh Dear for web agencies

Public sector: the strict version of the same job.

EU public-sector and government questionnaires are longer. Courts and subprocessors get named. Oh Dear monitors websites for official government bodies in Belgium and the Netherlands.

Procurement flagged your current tool.

Some teams land here after a review flagged Pingdom, UptimeRobot or StatusCake. Oh Dear checks your sites every minute from several locations worldwide, with every check and a status page on every plan. Compare Oh Dear vs Pingdom, vs UptimeRobot, vs StatusCake, or the full comparison.

SaaS teams with EU customers.

The same review, on the properties you actually run: the product, the marketing site, the docs.

No feature tiers

Every check.
Every plan.

GDPR uptime monitoring is included on every plan. The DPA is available to every customer, no enterprise plan required, and SSO is on every plan.

Start with everything on.

You pay for the number of sites, not per feature. One EU client with a strict DPO should not mean a second monitoring product and a second invoice.

  • Signable DPA for every customer
  • SSO on every plan
  • Every monitoring feature included
  • Plans scale by monitored site count
  • No credit card required
Start a free trial

10-day free trial. No credit card.

Before the procurement review

Questions about GDPR uptime monitoring.

Where the data lives, what you can sign, and what Oh Dear does not claim.

What is GDPR uptime monitoring?

Website uptime monitoring from a vendor that will name where the monitoring data lives, who processes it, and how transfers outside the EU are handled. With Oh Dear, that means a Belgian company, monitoring data stored in Belgium, and a signable DPA. The uptime checks still run from locations around the world.

Is Oh Dear GDPR compliant?

Yes. Oh Dear is a Belgian company, so GDPR applies by default, not through an adequacy decision or a framework. Monitoring data is stored in Belgium on Combell, a host certified ISO 27001 and ISO 27701. Every customer can sign a DPA, and the subprocessor list is public.

Where is my monitoring data stored?

On servers in Belgium run by Combell. That includes check results, uptime history, sites, settings, and team members. Performance metrics are stored in ClickHouse Cloud's EU region.

Is Oh Dear hosted in the EU?

Monitoring data and settings are hosted in Belgium. Performance metrics are in ClickHouse Cloud's EU region. Uptime probe nodes, backups, check reports, and the CDN are not limited to the EU. The subprocessor list shows where each one runs.

Does Oh Dear sign a DPA?

Yes. Oh Dear publishes a Data Processing Agreement on standard terms, covering the processor obligations of Article 28 of the GDPR. Every customer can use it as a pre-signed PDF. No enterprise plan is required. For a countersigned copy, email from a company address with the legal entity name, the registered address, and the signatory's name. See Do you have a Data Processing Agreement (DPA)?

Where is the subprocessor list?

It is public at subprocessors, no NDA needed. It is kept current and shows which subprocessors sit outside the EU, including US subprocessors.

How does Oh Dear handle data transfers outside the EU?

Transfers outside the EU rely on the Standard Contractual Clauses (Decision 2021/914), in line with EDPB guidance on international transfers. Probe nodes, backups, and check reports use US providers. Oh Dear does not claim immunity from the US CLOUD Act.

Can I choose where Oh Dear checks my site from?

Yes. Pick a primary check location per monitor in Settings > Uptime check > Check location. European options include Frankfurt, Paris, London and Stockholm. London is outside the EU. A failure from the primary location is checked again from a different location before you are alerted. See Can I choose where Oh Dear checks my site from?

Is Oh Dear SOC 2 certified?

No. Oh Dear does not hold SOC 2. GDPR is where the compliance work goes. For a vendor review, use the Terms, the Privacy Policy, and the GDPR DPA. See Are you SOC 2 verified? and the security page.

Does Oh Dear offer an SLA?

No. Oh Dear does not offer a formal SLA. See the Terms.

How do I delete my data or make an erasure request?

The team owner cancels the subscription, then deletes the team under Team settings > General. Invoices are kept under Belgian bookkeeping law and pseudonymized after the retention period. A formal GDPR erasure request by email is honoured for everything the law does not require Oh Dear to keep. See How do I delete my account?

Can EU public-sector and government bodies use Oh Dear?

Yes. Oh Dear monitors websites for official government bodies in Belgium and the Netherlands. The same data map, DPA, and subprocessor list apply.

Is there a European alternative to Pingdom, UptimeRobot or StatusCake?

Yes. Oh Dear is a Belgian company, monitoring data is stored in Belgium, and every plan includes uptime, performance, SSL, cron job, DNS and domain monitoring, plus a status page on your own domain. If a procurement review flagged one of those tools, compare them on Oh Dear vs the competition.

Is SSO an extra cost?

No. SSO is included on every plan. It is not an enterprise add-on. Oh Dear supports SAML 2.0, and you can require SSO for everyone except the team owner. See single sign-on.

Can agencies use Oh Dear for EU client sites?

Yes. Add each client site, and send the data map and DPA when a DPO asks. GDPR uptime monitoring stays on the same plan as the rest of your website health monitoring. Start at Oh Dear for web agencies.

Is the DPA included on every plan?

Yes. The Data Processing Agreement is available to every customer, no enterprise plan required. Every feature is on every plan, and you can try it during the 10-day free trial without a credit card.

See all other FAQ items
Technical detail Read the DPA FAQ A different page Single sign-on on every plan

Get started

Answer the next DPO the same day.

Answer the next DPO request with a Belgian data location, a signable DPA and a public subprocessor list. Every feature on. No credit card.

Capterra
4.9 (73) G2
4.7 (33)