What we ship, as we ship it.

The data platform now has a price list, and most of it reads "included". Databases, dashboards, Jobs & Pipelines and a warehouse at your plan's tier cost nothing beyond your plan: Warehouse XS on Starter (2 databases, 5 GB, 30 job minutes a month), S on Pro (10 databases, 25 GB, 120 minutes), M on Business (20 databases, 75 GB, 600 minutes). Bought separately — a hosted database, a pipeline tool and a dashboard tool — the same would come to about €50 a month.

A bigger warehouse is a flat add-on you switch on yourself from the plans page in Manage: Warehouse M (2 GB of memory, 75 GB, 20 databases, 600 job minutes a month) for €12 a month on Starter and Pro — included on Business — and Warehouse L (4 GB, 200 GB, 50 databases, 2,000 minutes, every-minute schedules) for €29 a month on any plan. Need room rather than power? Extra disk comes in blocks of 100 GB for €5 a month each, on any tier. Your container is resized in place; nothing is re-created.

Job runs above your monthly allowance are metered at €0.02 per minute, billed per second — a nightly pipeline stays inside the free minutes on every plan; only hourly-or-faster schedules pay. You set a spend cap on the billing page (€10 a month by default, €50 on Business), we tell you at 50, 80 and 100 % of it, and at the cap scheduled runs are skipped and manual runs are refused until you raise it — so nothing above the cap is ever billed. A run that fails for a reason on our side is never billed. Whatever you did use appears as one line on your next invoice, and the Runs page shows minutes used, minutes included and the cap at all times.

Nothing else is metered: opening a dashboard, running a query in the workbench or importing a file costs nothing beyond your plan. Prices are ex VAT; annual billing is 10 months, as for plans. The plans page, the data platform page, the warehouse and Jobs & Pipelines docs all carry the same numbers.

Databases, dashboards, Jobs & Pipelines and a warehouse of your own now come with every plan, Starter included. What differs per plan is the warehouse tier: Warehouse XS on Starter (512 MB of memory, 5 GB, 2 databases, 30 job minutes a month), S on Pro (1 GB, 25 GB, 10 databases, 120 minutes) and M on Business (2 GB, 75 GB, 20 databases, 600 minutes — with the hour-long runs over 5 million rows and every-minute schedules Business already had). The Databases page names your tier and what a bigger one would give; the plans page shows the ladder side by side and the warehouse and Jobs & Pipelines docs carry the numbers.

A Starter site's database is queryable in the read-only workbench like any other, and a Starter account's first warehouse database creates an XS container — the third database is refused with the tier's message rather than silently. Bigger tiers (Warehouse M, and Warehouse L: 4 GB, 200 GB, 50 databases) and extra disk are self-service add-ons from the plans page in Manage — see what the data platform costs for the prices.

Two new articles in the documentation. Warehouse: a database of your own covers creating MariaDB or PostgreSQL databases, the table builder, the two-step CSV and Parquet import and why it refuses values that would be silently changed, writable SQL with the confirmation dialog, moving a whole database in, and the API and MCP tools. Jobs & Pipelines: from raw tables to reports, on a schedule explains that a pipeline is SQL — CREATE OR REFRESH TABLE … AS SELECT … — with the graph and lineage derived from it, then walks through job steps, triggers, budgets and the Runs page.

The Databases article moved from /docs/jobs-and-pipelines to /docs/databases, where it should have been all along; the old address redirects. All three articles exist in Dutch too, and the portal links to them from the workbench, the pipeline editor, the jobs list and the Runs page.

veldhost is no longer only a place your site runs. Every Pro and Business account now has a data workbench next to its sites. Databases lists every database your sites run on — MariaDB and PostgreSQL alike — with tables, sample rows and a SQL editor that is read-only by design: a separate login, a read-only transaction, and only reading statements accepted. Save the queries you keep coming back to and export results as CSV or Excel.

The warehouse is a database of your own, MariaDB or PostgreSQL per database, that you can write to. Fill it from a CSV, a gzipped export or a Parquet file of up to a gigabyte — uploaded straight into EU object storage and typed column by column before a row is written — or move a whole MySQL, MariaDB or PostgreSQL database to us with row counts compared table by table.

In Jobs & Pipelines a pipeline is SQL you can read: CREATE OR REFRESH TABLE … AS SELECT … from source tables into a warehouse table. The platform derives the graph and lineage from it, previews the first rows before anything is written, and rebuilds or upserts each table on schedule. Jobs put pipelines, dashboard refreshes, SQL steps and email or webhook notifications in order and run them on a schedule, by hand, or after another job, with a ledger of every run. Dashboards turns any table into time series, bars, stats, gauges, tables and pies, with a time picker, variables and auto-refresh.

Everything is also available through the API and the MCP server behind an opt-in data token scope. The published limits are the standard offer; larger customers are accommodated on request. The marketing site has a new Data platform page, in English and Dutch, that says the same thing to someone who is not a customer yet.

The customer API grows up a little for scripts, CI and AI agents. Every list endpoint now pages with ?limit= (up to 100) and ?cursor=, answering with meta.next_cursor and meta.has_more beside the array you already read — a site with hundreds of deploys or backups is no longer cut off at 20. Every error, from a bad token to a full rate bucket, has the same body: error.type to branch on, error.message to read, error.details per field on validation, and error.request_id, which every response also carries as X-Request-Id so support can find your exact request.

Actions that queue work — deploy, backup, restore, staging, cron and DNS writes — accept an Idempotency-Key header: retry a timed-out call with the same key within 24 hours and you get the stored first answer back instead of a second deploy. The OpenAPI spec (version 1.3) now carries full response schemas, the failure responses, the rate-limit headers and a written deprecation policy: breaking changes only under /api/v2. On the API tokens page each token now shows the address it was last used from, and points to Security → Connected apps for OAuth-connected assistants.

Three new pages answer the questions people put to search engines and AI assistants before they contact us. The apps page (/apps) renders the runtime matrix and every app from the same catalogue the dashboard uses, with its real status — available, in progress, planned, or set up on a Business plan — and lists the available ones as structured data. The comparison page (/compare) sets veldhost beside budget shared hosting, a local traditional host and a hyperscaler or DIY VPS on the questions that matter later — who operates it, the data path, backups and restore, security, SLA, support, price band and exit — and says plainly when not to choose us. The Baltics page (/for/baltics) gives businesses in Latvia, Lithuania and Estonia the measured latency from Falkenstein to Riga, EU invoicing with VAT reverse charge, which Baltic domains we register, GDPR and NIS2 alignment, the support languages, and what we do not have.

Home, plans, the apps page and the Baltics page now emit FAQPage structured data from the same FAQ arrays they display; the "Runs on" strip on the platform page and the runtime section of llms.txt are generated from the catalogue, so they change when a status does. All three pages have Dutch versions.

Monitoring → Audit log in veldhost Manage now lists every sign-in, security change, purchase, portal action and API write recorded under your account — with the time, the address it came from, and the credential that made it (you, a named API token, or a connected app). Filter by event family and date, load more as you go, and export the filtered log as CSV or JSON: timestamps are ISO-8601 with timezone, exports cover up to 10,000 rows and a date range you choose.

The same log is available to your own tooling as GET /api/v1/account/audit?since=&until=&cursor= on the read scope, alongside a new GET /api/v1/account/invoices?cursor= that returns the invoice list the billing page shows. Both are documented in the OpenAPI description.

Account → Compliance shows every document that governs your account — Terms, Privacy Policy, DPA, sub-processor register, SLA and AUP — with the version in force today and the version you accepted, when, and by whom. Acceptance at checkout is recorded automatically; when we change a document you see a notice on your dashboard until you re-accept, and the history stays append-only. From the same page you can request a countersigned DPA (it lands with legal@ together with your account details) and download a plain-text acceptance record for your audit file.

On Billing, a new "Invoice details" form takes a purchase-order reference, a cost centre and a footer note; they are saved on your account and pushed to your invoice provider so they print on every invoice from now on.

Every DNS zone in veldhost Manage now has a Download zone file button that gives you a standard BIND zone file — every record exactly as our nameservers serve it, ready for any other DNS provider or for your own backups. Below the records you can paste or upload a zone file to import: you see a preview of what would be added, updated, left alone or refused (with the reason per line) before anything is written, and an import never deletes a record. The same is available over the API as GET /dns/{zone}/export and POST /dns/{zone}/import with a dry run by default.

On the Account page, Export everything prepares one zip with all your zone files, a JSON of your registered domains and the list of your restore points with a download link for each, behind a signed link that expires after 24 hours. Site archives are not bundled — each restore point already has its own download.

Support now works in Latvian as well as English and Dutch — the founder speaks it — and the Baltics page, the contact page and the vendor profile say so. EcoTrend, a Latvian drinks brand, has agreed to be named: its web shop at zavetaji.lv runs on veldhost.

A pre-launch review of every marketing page found the same facts stated differently depending on when a page was written. The site now says one thing everywhere: backups are weekly on every plan and nightly with the daily add-on, with every backup replicated nightly to a second region; production runs in Falkenstein and Nuremberg, both in Germany, on servers we rent from Hetzner and operate ourselves; health checks run every five minutes. The acceptable-use policy now names the right abuse mailbox, the legal texts no longer carry an internal milestone codename, and the plans page gained a plain-language billing FAQ. During the public testing phase the header and plan buttons say when ordering opens instead of leading into a closed checkout.

Under the hood every page now carries a canonical URL, Open Graph tags and language alternates where a Dutch version exists, blog posts publish their article schema, the sitemap lists every help article, and the Dutch plans page is fully translated.

Bringing a domain you already own is now the first door, not the third. Under Domains → Use a domain you already own, a five-step wizard reads your domain's live records off the public internet (apex, www, the common subdomains, MX, SPF, DMARC, DKIM, CAA, SRV), shows you the zone we would serve with a reason on every line, and writes it into your veldhost DNS through the same rules as the editor — before anything changes. If you pick a site, its records are laid over the top; if the domain has a mailbox here, the mail records come with it, with your SPF merged rather than replaced.

Then it tells you exactly where the nameserver setting is at your registrar — GoDaddy, Namecheap, TransIP, Hostnet, Mijndomein, Versio, one.com, IONOS, OVH, Openprovider and more, with a general guide for the rest — warns you first when DNSSEC is on at your current provider, and watches for the change to land: every ten minutes for three days, with an email the moment it does. The domain stays registered where it was; nothing here touches your registrar. Registering a new domain and transferring one in are still there, and now say plainly that they are optional.

The same probe is available as a dry run over the API (POST /api/v1/dns/zones/probe, dns scope) and to AI assistants as the probe_domain_dns MCP tool. Documented under Docs → Move your DNS to veldhost.

Five Node.js apps join the "What are you building?" picker as one-click installs: Ghost (publishing and newsletters, on MariaDB), Strapi and Directus (headless CMS on PostgreSQL), n8n (workflow automation on PostgreSQL, running on Node.js 24) and Umami (privacy-friendly analytics on PostgreSQL). Each is installed from a pinned release into your own container, started as a systemd service on the Node.js runtime, and your first administrator or owner account is created for you — the sign-in address and password appear on your site page for seven days, with a note on how to update.

Picking Next.js, Nuxt, SvelteKit or Astro (Node adapter) now gives you the framework's own minimal starter, built and running on your address, instead of a placeholder page — connect your repository on the Deploy tab and every push replaces it. Ghost, Strapi, Directus and n8n need the memory of a Pro plan (1 GB); Umami and the starters run on Starter. Every installer was exercised end to end on our staging sandbox before it was marked available; the docs carry a "first steps" guide for each app.

veldhost now runs JavaScript apps. Pick JavaScript app when you create a site and you get a container with Node.js 22 (or 24) behind nginx, run as a supervised system service: connect a Git repository and we run your install and build commands, install production dependencies, start the app on the PORT we hand it and wait for it to answer before calling the deploy done. Files in public/ are served by nginx directly; everything else — including WebSockets — goes to your app.

The site page gets a Node.js card in place of the PHP one: switch between Node 22 and 24, and set a start command when your framework needs one (node build for SvelteKit, node .output/server/index.mjs for Nuxt). Environment variables, the managed PostgreSQL/MariaDB database and Build & deploy work exactly as for PHP sites, and the Logs tab shows your app's own output. Next.js, Nuxt, SvelteKit and Express are marked available in the app catalogue; one-click installs for Ghost, Strapi, Directus, n8n and Umami follow. Read Node.js apps for the details.

"What are you building?" now shows the whole app catalogue, grouped into shops, websites, business apps, frameworks and bring-your-own, with an honest status on every entry: what you can order today, what is still being validated, what is planned, and what we set up per order on a Business plan. Four new apps install themselves the moment your site is provisioned, the way WordPress already did:

• WooCommerce — WordPress with WooCommerce and the Storefront theme, shop pages created, prices in EUR including VAT, no demo products.
• PrestaShop 9 — the current stable release with an empty catalogue and a randomly named back office.
• Nextcloud — data folder outside the web root, APCu and Valkey caching, real cron every five minutes, CalDAV/CardDAV discovery.
• Matomo — your site registered, IP anonymisation and Do-Not-Track on, hourly archiving from cron.

Every install is pinned to a release we verified against the project's published checksum or PGP signature, gets its own database in your container, nginx rules from the project's own documentation, and reports its admin address, version and a generated admin password to the site page's new App card, where the password stays readable for seven days. Apps that need more memory than a plan offers say so in the picker and are refused server-side — Nextcloud and PrestaShop start at Pro. The API and the MCP quote_new_site tool accept an app key, validated against the same catalogue. Each shipped app has its own guide under Docs → Publishing.

Every destructive action in veldhost Manage now asks before it acts — removing a scheduled task or redirect, cancelling a team invitation, turning off SSH or password login, disconnecting GitHub — and closing your account asks you to type your email address first, the way deleting a site already asks for its name.

Times across the portal (restore points, migration timelines, SSH time limits, invitation and domain expiry dates) are shown in your own timezone in one format, with the exact UTC moment on hover. Confirmation and error messages appear in one place at the top of every page instead of in nine slightly different banners, empty lists say what to do next, and the site page's tab bar now works properly with screen readers and keyboard focus.

The Security page in veldhost Manage now lists every browser signed in to your account, with device, address and last activity, and lets you sign out any one of them or all others at once. Below it, every AI assistant or other application you authorised over OAuth is listed with its scopes and can be disconnected in one click; personal API tokens stay on their own page.

Two smaller fixes: a second click on Deploy while a deploy is already running no longer queues a phantom second deploy, and the dark theme no longer renders error banners and "Delete" links in light pink.

The platform status page at veldhost.eu/status, and every public per-site status page, now has an Atom feed (/status/feed.atom, /status/<site>/feed.atom) with one entry per incident update, and an email subscription box. Subscribing is double opt-in — we send a confirmation link first — and once confirmed you get an email when an incident is opened and when it is resolved. Every email carries a one-click unsubscribe link.

veldhost Manage now has account-level roles. The new Team page (Account › Team) lists everyone on your account, lets you invite colleagues by email as admin, billing, developer or viewer, change their role or remove them, and shows who has two-factor sign-in switched on. An owner does everything; an admin manages every site and the team but never sees billing or deletes the account; billing sees the sites and handles invoices, the card and the plan; a developer deploys and changes settings and backups; a viewer only looks.

Owners and admins can also require two-factor sign-in for every member of the account — anyone without an authenticator app or passkey is sent to the Security page to set one up before they can open a site.

Per-site invites keep working exactly as before for outside collaborators, and every site you can reach — your own, your account's, or one shared with you — now appears on the dashboard and on the Monitoring page alike.

veldhost Manage can now push what happens to your sites to your own systems. Under Account → Integrations, add a webhook URL and pick the events you want: deploys succeeding or failing, backups and restores finishing, a site going down and coming back, incidents opening and resolving, a domain approaching expiry, and invoices being paid or failing. Every delivery is a signed JSON POST (X-Veldhost-Signature, HMAC-SHA256 with a secret shown once), retried three times, and listed in a per-endpoint delivery log with the response code and any error.

The same pipeline feeds chat: choose Slack or Microsoft Teams as the kind, paste an incoming-webhook URL, and events arrive as readable messages in the channel. Endpoints that fail twenty events in a row are paused and you get an email; a "Send test event" button checks a new one in seconds. Everything is also available over the API (/api/v1/webhooks, manage scope) and documented under Docs → Webhooks, Slack and Teams.

Every WordPress and WooCommerce site now comes with an admin gate: an extra browser login (HTTP basic auth) in front of /wp-admin/ and /wp-login.php, checked at our edge before the request reaches WordPress. Automated scripts never get to your login page or your plugins; visitors, admin-ajax.php and the scheduled tasks are untouched. New sites get a generated gate login next to the WordPress one; the Settings tab of the site page shows it (with an audit-logged reveal) and lets you change the username or password, regenerate it, or turn the gate off. The App card on the Overview tab points to it too.

Two things are blocked on every WordPress site regardless of the gate: the /wp-json/batch/v1 REST endpoint, which lets one request carry many and was recently exploited in the wild, and /xmlrpc.php, the old remote-publishing interface that mostly serves password guessing today. /wp-login.php is also rate-limited per address underneath the gate.

Sites on their own domain can log in to their admin again. The edge used to treat /wp-admin and /wp-login.php on any host outside the *.apps.veldhost.eu zone as a probe and refuse it, which locked customers with a custom domain out of their own dashboard. That rule now applies only to our own platform hosts; customer sites are protected per site instead. Docs: WordPress: your first steps, Security at veldhost.

The DPA sub-processor register is now at v1.1. Cloudflare, Inc. has been removed: veldhost.eu and the Manage portal have been served directly from our own EU infrastructure and our own authoritative nameservers since July 2026, so no edge, CDN or third-party DNS provider sits in front of any veldhost property. The privacy policy and the sovereignty page say the same thing, and the register now carries a change log so an evaluator can see what changed and when.

Evaluating veldhost for a tender, an RFP or a supplier due-diligence file no longer means collecting facts from six pages. The new trust centre gathers legal identity, EU data residency, security controls, sub-processors, contract terms, continuity and exit in one place — every line linked to the published document it is quoted from, and the things we do not have (ISO 27001, SOC 2, a published pen test) stated just as plainly.

It ships with a one-page vendor profile that also comes as JSON and plain text for supplier registers, and a pre-answered security questionnaire organised the way SIG-Lite and CAIQ questionnaires are. The site's structured data now carries the legal name, KvK and VAT identifiers, registered office and role-specific contacts, so vendor-research tools can read them directly.

SSH/SFTP access to your site can now be enabled for a window you choose — an hour, a day, a week, or until you turn it off — and switches itself off when the time is up. For quick sessions without key setup there's a temporary password login: one hour by default, 24 hours with an explicit risk acknowledgment, revoked automatically at expiry.

The platform now has a public status page with live component health and uptime history measured every five minutes, and a security page documenting our infrastructure, encryption and account-security posture — including what we don't have yet.

Behind the scenes, every site backup and the platform databases are now replicated nightly to storage in a second region, physically separate from the servers that run customer sites.

AI assistants can now operate your hosting directly: a built-in MCP server with OAuth sign-in lets tools like Claude check site health, read logs, manage DNS and deploy on your behalf — anything that spends money or deletes data always hands back to you. The same capabilities are available over a documented REST API with scoped tokens, plus live log streaming and monthly traffic figures in the dashboard.

Deploying from GitHub is now a two-click flow: connect the veldhost GitHub App, pick a repository (private ones included), and every push deploys with history and one-click rollback. Upload limits were also raised fleet-wide to 64 MB for file and media uploads.

Every site now ships with opcode caching, an in-memory object cache (wired automatically into WordPress), long-lived asset caching, and a short page micro-cache for WordPress front pages. No configuration needed — existing sites were upgraded in place.

Domains are now registered under their real owner's verified contact details, with email confirmation, EU VAT validation for businesses and identity verification for individuals — meeting registry requirements and making sure your domain is legally yours.

Transfer a domain in with just its auth code — pre-checks, payment and progress tracking included — and transfer out whenever you want: unlocking and revealing the auth code is self-service, always. DNSSEC signing on our EU nameservers is now self-service too.

A big safety release: one-click restore from daily backups (a full production-site restore completes in under a minute), private staging copies of your site, per-site team members with their own logins, scheduled tasks, deploy history with rollback, and a free assisted migration service for moving existing sites over.

The platform moves to its permanent home: veldhost.eu, with the dashboard at manage.veldhost.eu and our own European nameservers at ns1/ns2.veldhost.eu. One brand, one promise — your site, looked after, with data in the EU.