Encryption you can evidence
TLS 1.2+ on every connection and AES-256 at rest is the baseline. What matters at audit time is who holds the keys, how they are rotated, and whether the provider can produce that statement on letterhead.
Compliance & security
Built for records that have to survive an audit
Most hosting is sold on speed and price. When you are storing patient files, client matters, financial ledgers or anything with a statutory retention period, the questions are different — and so are the answers you need in writing.
Retention & legal hold
Records law rarely says “keep a backup”. It says keep this class of record for seven years, or ten, or the life of the patient. Look for versioning, write-once storage and a defensible deletion process.
Contracts that carry weight
A signed BAA, a GDPR data processing addendum, or an Australian Privacy Principles schedule turns a marketing claim into an obligation. If a provider will not sign one, that is your answer.
Access control & MFA
Role-based permissions, enforced multi-factor authentication and named accounts — never a shared login — so that every action in the record system maps back to a single accountable person.
Immutable audit logs
Who opened the record, from where, and when. Logs should be tamper-evident, exportable and retained at least as long as the records they describe.
Data residency in writing
Ask which country the primary copy lives in, which country the backups live in, and whether support staff can view data from elsewhere. All three matter under most privacy regimes.
Features & infrastructure
What sits underneath a well-run hosting platform
These are the specifications worth comparing line by line before you judge a plan on its headline price.
NVMe storage
Solid-state NVMe drives with RAID redundancy. Ask what happens to your data when a drive fails, not just how fast it reads.
Tested backups
Daily automated backups held off-server, with a documented restore time. A backup nobody has ever restored is a hypothesis.
Redundant network
Multiple upstream carriers, DDoS filtering at the edge, and a status page with real incident history.
Meaningful SLA
99.9% uptime allows roughly 43 minutes of downtime a month. Check what the remedy is, and whether you have to ask for it.
Performance you will actually notice
- Server-side caching — object and page caching beats any plugin.
- HTTP/2 or HTTP/3 with Brotli compression enabled by default.
- Current PHP — PHP 8.2 or newer, switchable from the control panel.
- A CDN included or one click away for global audiences.
- Free TLS certificates issued and renewed automatically.
Operational maturity
- Staging environments so changes are tested before they go live.
- SSH and SFTP access, plus WP-CLI or Composer where relevant.
- Isolated accounts so one compromised site cannot reach another.
- Migration assistance included rather than sold as an extra.
- Support that owns the problem, 24/7, with published response times.
Hosting plans
Five ways to host, one right answer for you
Start with the workload, not the price list. Here is the short version of each plan type, with a full write-up behind every card.
Shared Hosting
Brochure sites, first websites, low-traffic blogs
$3.95 /mo*
*Indicative example pricing
- Cheapest way to get online
- Control panel, no server admin
- Resources shared with neighbours
WordPress Hosting
Business sites and blogs running WordPress
$8.95 /mo*
*Indicative example pricing
- Tuned caching and updates
- WordPress-specialist support
- Staging built in
Cloud Hosting
Growing sites, seasonal traffic, uptime-sensitive work
$17.95 /mo*
*Indicative example pricing
- Resources drawn from a cluster
- Survives single-node failure
- Scales without migration
VPS Hosting
Applications needing guaranteed resources and root
$24.95 /mo*
*Indicative example pricing
- Reserved CPU and RAM
- Root access and custom stacks
- Managed or unmanaged
Dedicated Servers
A whole physical machine, single-tenant, with no other customer's workload on the hardware. The usual home for large record archives, regulated workloads with hardware-isolation requirements, and databases that have outgrown virtualisation. Indicative pricing starts around $109/mo*.
Guides
Start here if you are not sure what you need
Hosting for Small Business
What a small business site actually needs, what it does not, and how to avoid paying for capacity you will never touch.
Hosting for WordPress
Managed versus generic hosting, the specifications that matter, and the plugins a good host makes unnecessary.
Shared vs VPS vs Cloud Hosting
The three architectures compared on isolation, scaling, failure behaviour, cost and the skills each one asks of you.
How to Choose Secure Hosting for Records
A due-diligence checklist for regulated data: encryption, retention, residency, contracts, logging and exit planning.
Industry use cases
Different records, different obligations
Retention periods, breach-notification duties and access rules vary by sector. Here is where the pressure usually sits.
Verified controls
Healthcare
Patient records carry some of the longest retention periods in existence and some of the strictest access rules. Encryption, audit logging and a signed business associate agreement are the entry ticket, not the differentiator.
Typical asks: BAA or equivalent, immutable logs, 7–25 year retention.
Verified controls
Legal & professional services
Matter files, discovery sets and trust-account records need legal hold, defensible deletion and a clean chain of custody. Conflicts of interest also make data residency and staff access questions unusually sharp.
Typical asks: legal hold, WORM storage, jurisdiction control.
Verified controls
Financial services
Transaction records and client communications must be reproducible years later, often in an unaltered form, with evidence that they have not been edited since capture.
Typical asks: write-once storage, time-stamping, export on demand.
Audit-ready
Government & education
Public-sector record-keeping standards tend to prescribe formats, metadata and transfer obligations to a national archive. Sovereignty requirements are usually non-negotiable.
Typical asks: in-country storage, metadata schemas, transfer formats.
Audit-ready
Construction & engineering
Drawings, certifications and site records may need to outlive the project by a decade or more, and are often demanded in a dispute long after the team has moved on.
Typical asks: large-file archives, long retention, cheap cold storage.
Growing business
Small business & startups
Fewer formal obligations, but the same practical risk: losing the records that prove what you did and when. Good hosting hygiene here is cheap insurance.
Typical asks: automated backups, MFA, sensible retention defaults.
Hosting FAQ
Clear answers for beginners and small business owners
What is shared hosting?
Shared hosting means your website is placed on a server that also hosts other websites. All users share the server's resources, such as storage and bandwidth. It is popular because it is affordable, easy to use, and ideal for beginners or small sites.
What’s the difference between cloud hosting and shared hosting?
Shared hosting uses one physical server. Cloud hosting uses multiple connected servers, allowing your site to draw resources from a cluster rather than a single machine — which generally means better uptime, more scalability and more stability under traffic spikes.
What is managed WordPress hosting?
A hosting environment built specifically for WordPress. Think of it like a custom-tailored suit — everything is optimised to fit WordPress perfectly: automatic updates, enhanced security, built-in caching, faster performance and WordPress-specialised support.