When a procurement or privacy officer asks "which version of your DPA did we sign, and when?", the answer is on Settings → Compliance. Everyone on the account can read it. Accepting documents and requesting a countersigned DPA are for the account owner and administrators (see Team roles).
What the documents are
The page lists six documents, each with the version in force and a link to read it: the Terms of Service, Privacy Policy, Data Processing Agreement, Sub-processor register, Service Level Agreement and Acceptable Use Policy.
The Data Processing Agreement (DPA) covers what you host with us. From our Terms (section 7): "For Customer Content and customer personal data that we process as your processor, the DPA applies. For Account Data, billing, support, abuse handling, website analytics, and our own legal compliance, the Privacy Policy applies and we act as controller." The DPA itself says it "is incorporated into your contract by reference (Terms §2). It is drafted to meet GDPR Article 28(3)."
What the SLA promises on each plan is explained in Uptime, the status page and the SLA.
Check where your account stands
Open Settings → Compliance. The Agreements tile counts how many documents your account has accepted at their current version, and the DPA and Sub-processors tiles show the versions in force.
In the Agreements table, This account says one of:
- Accepted: your account accepted the version in force.
- New version: your account accepted an earlier version, and the document has changed since.
- Outstanding: no acceptance is recorded for this account.
Accepted and By show the version, the date and who accepted it. History lists every acceptance ever recorded, newest first, with the IP address it came from.
When a document has changed, the page says "Some documents changed since you last accepted them." and adds "Nothing on your account is paused in the meantime."
Accept the current versions
- Open Settings → Compliance and choose Accept … outstanding at the top (it shows how many).
- The confirmation lists the documents and versions, and says the acceptance is "Recorded with your name, the time and your IP address". Choose I accept.
Each acceptance is added to the history; nothing earlier is overwritten.
Download the record
Choose Download record (.txt). You get a plain-text file with the documents in force, your account's acceptance status for each, and the full history with who accepted, when and from which IP address. It is the file to send a customer or auditor who asks for evidence.
Request a countersigned DPA
- In the Countersigned DPA panel, choose Request countersigned DPA.
- Under Anything we should know, add anything that should appear on it, for example the legal entity for the signature page. This is optional.
- Choose Send request.
The page confirms: "We countersign and return the DPA to" your email address, "usually within two working days."
Commitments and evaluation
The side panels sum up what the DPA and SLA commit to, with a link to the Trust centre, and list what we do not hold. For your evaluation links to our Security questionnaire and Vendor profile. Two of the DPA's commitments, in its own words:
- Section 10: "veldhost will notify you without undue delay and in any event within 48 hours after becoming aware of a personal-data breach affecting Customer Content".
- Section 9: audits "on reasonable prior written notice and no more than once per 12 months (or after a personal-data breach affecting you)".