Web Hosting

Your site is live. Then traffic spikes, a region goes down, or compliance auditors ask where your data lives. Hosting isn't just buying server space — it's building the foundations for performance, security, and regulatory peace of mind. The right hosting strategy means your infrastructure scales with growth, your data stays secure and localised, and your team sleeps soundly.

Whether you're running a bootstrapped SaaS, managing patient records for a healthtech, or processing payments for an e-commerce brand, the hosting layer touches everything: speed, uptime, security, compliance costs, and ultimately, revenue. Legal Suvidha's web hosting service pairs infrastructure planning with regulatory rigour — ensuring your site runs fast, stays up, and never finds itself on the wrong side of a SEBI or RBI compliance ruling.

At a Glance

• Who needs this: E-commerce, SaaS, healthtech, fintech, and media platforms moving beyond shared hosting or migrating between clouds.
• Governing frameworks: RBI Payment Systems data localisation (2018); SEBI broker/RIA rules; IRDAI insurance data residency; DPDP Act 2023 (cross-border transfer, consent, grievance officer).
• Setup timeline: 5–10 working days for provisioning, migration, and DNS cutover.
• Server options: Shared (low-traffic brochure sites) → VPS (mid-traffic production apps) → dedicated (high-traffic, data-intensive) → cloud (auto-scaling, multi-region, managed databases).
• Compliance regions: AWS Mumbai / Hyderabad, Azure Pune, GCP Mumbai, DO Bangalore for regulated data; global edges via CDN for non-regulated audiences.
• Uptime SLA tiers: 99.9% (shared), 99.95% (VPS/cloud), 99.99% (multi-AZ) with PagerDuty/Slack alerts and monthly reports.
• Included infrastructure: SSL (auto-renewing), CDN (Cloudflare/CloudFront), WAF (OWASP top-10), daily backups to separate region, firewall and SSH hardening.

What's New for FY 2026-27

Hosting in 2026-27 means compliance-first infrastructure, not a retrofit add-on. Here's what changed.

• DPDP Act compliance now mandatory: All sites processing Indian personal data must have explicit consent, published grievance officer email, and documented cross-border transfer justification. We now configure grievance-officer mailbox infrastructure and consent-management ready templates.
• RBI sectoral data rules firmed up: Payment-system data (PCI-DSS cards, UPI logs, settlement data) must stay in India; stockbrokers (SEBI) and insurers (IRDAI) must localise customer records. These are no longer grey areas.
• AWS Hyderabad region now production-ready: Adds redundancy for Mumbai; full stack of services; same compliance as Mumbai. Multi-region deployments between Mumbai / Hyderabad are now standard for high-SLA workloads.
• CDN WAF integration tightened: Cloudflare and CloudFront WAF now require explicit OWASP rule tuning per sector; generic rules no longer pass audit. We tune rules for your vertical (fintech vs. media vs. healthcare).
• India's DDoS activity surge: Hit-and-run DDoS on SME e-commerce has doubled YoY. WAF + CDN rate-limiting is now non-negotiable, not optional.

Why You Need Guided Hosting

• One bad hosting decision kills revenue: If your site goes down on a Saturday, customers bounce. If it's slow, Google ranks you lower. If it's hacked, you lose trust. Hosting is not a cost line — it's infrastructure that protects revenue.
• Compliance is now infrastructure: RBI, SEBI, IRDAI, and DPDP rules mandate where data sits, how it moves, and how long you log it. Violating these means penalties, audit notices, and customer data-protection issues. Your hosting layer must bake compliance in from day one.
• Self-service clouds are risky: AWS / Azure / GCP are powerful, but poorly configured deployments rack up costs (overspend 2-3×), leave security holes (missing WAF, public databases), and violate sector rules (data in US region by default). You need guided provisioning, not just an account number.
• Migrations are failure-prone: Moving from shared to VPS, or from one cloud to another, breaks DNS, loses email, exposes your old data, or puts your site down during cutover. We test every step, script DNS cutover, and roll back if needed.
• Backups are worthless if untested: 40% of companies discover mid-incident that their backups are corrupt or not actually restorable. We test restore procedures quarterly and document the runbook in your language.
• Monitoring and alerting must be automatic: Waiting for a customer to report your site is down is unacceptable. We set up continuous monitoring, PagerDuty escalation, and Slack / SMS alerts so your team knows about outages in seconds, not hours.

How It Actually Works

Hosting setup is a methodical 5–10 day process: assessment, provisioning, hardening, migration, and handover.

Step 1: Workload & Compliance Assessment (1–2 Days)

We start with a conversation: What's your current traffic, expected growth, technology stack, and regulated data? Are you in fintech, healthtech, e-commerce, SaaS? Do you process payments, patient records, stock trading logs? These answers determine your hosting tier (shared → VPS → cloud), region (India vs. global), and compliance posture. We document the workload profile and recommend a hosting path.

Step 2: Provider & Plan Selection (1–2 Days)

Based on the workload, we recommend AWS, Azure, GCP, DigitalOcean, or (for very small static sites) Hostinger / Bluehost. If regulated data is involved, we default to AWS / Azure / GCP with Indian regions. If the app is complex (microservices, managed database, auto-scaling), cloud is non-negotiable. If it's a simple WordPress blog, shared hosting or a small VPS may be enough. We provision the account, set up billing alerts, and configure IAM so your team has the right access levels.

Step 3: Server Hardening & Security (2–3 Days)

The server is spun up, but raw servers are targets. We harden: disable password SSH (keys only), configure firewall (ports 22/80/443 open, everything else denied), enable fail2ban (stop brute-force attacks), patch OS, enable auto-updates, and add CloudTrail / audit logging. If you're in fintech, we add secrets-management (AWS Secrets Manager / Azure KeyVault). The result is a server that is locked down but still operationally useful.

Step 4: SSL, CDN & WAF Configuration (1 Day)

Every production site must have HTTPS. We configure SSL (Let's Encrypt is free; paid CAs for wildcard or EV if needed) with auto-renewal via Certbot. DNS is pointed to a CDN (Cloudflare for simplicity, CloudFront for fine-grained control), which terminates SSL at edge, caches static assets, and compresses responses. WAF is enabled with OWASP top-10 rules; we tune rules for your sector so legitimate traffic isn't blocked but SQLi, XSS, and DDoS are caught.

Step 5: Backup, Monitoring & Disaster Recovery (1–2 Days)

Daily automated backups are shipped to a second region (Mumbai → Hyderabad, or Asia-region → Europe region if global). 30-day retention is standard; we offer 90-day for regulated workloads. Monitoring is continuous: UptimeRobot pings your site every 60 seconds from 10 global locations, and any breach of your SLA tier (99.9%, 99.95%, 99.99%) triggers PagerDuty escalation and Slack notification. We document the restore procedure — how to spin up from backup, how to point DNS, how to verify data — and test it quarterly.

Step 6: DNS Cutover, Migration & Handover (1–3 Days)

If migrating from old hosting, we provision the new infrastructure in parallel, copy your site code and database, test it fully (no users see it yet), and then cut DNS. TTL is lowered 48 hours before, so the switchover is fast. We run smoke tests (check homepage, forms, payments, email), and once everything is live, we hand over runbooks, Slack channels, and admin credentials. First month includes managed support for questions and tweaks.

A Real Example: E-Commerce Migration to AWS

A 3-year-old fashion e-commerce site on Hostinger shared hosting. Traffic grew from 1K visitors/month to 50K/month. Checkout was slow; the site went down during sales peaks; backups were manual; there was no CDN. The founder wanted to move to cloud, but was nervous about cost and complexity.

• Our recommendation: AWS Mumbai on a t3.medium EC2 (2 vCPU, 4 GB RAM), RDS MySQL in a Multi-AZ setup, S3 for product images, CloudFront CDN, and WAF for bot and DDoS protection. SSL is Let's Encrypt. Daily backups to us-west-1 (N. California) for geographic redundancy.
• Infrastructure cost: ~₹12,000/month (EC2, RDS, data transfer, CloudFront, backups).
• Setup cost: ₹24,999 (5 days of engineering: provisioning, migration, testing, DNS cutover, handover).
• Performance gain: Page load time drops from 2.8s to 0.8s (CDN + database indexing). Uptime improves from 98% to 99.95%.
• Revenue impact: Faster checkout and better mobile experience → Google ranking improves → payments per month: 60K → 90K transactions. New revenue: 30K additional transactions × ₹500 gross margin = ₹15 lakh/month new revenue. Setup cost breaks even in 2 weeks of increased sales.

The e-commerce founder realizes that cloud isn't expensive — it's a growth investment that pays for itself in weeks.

DPDP Compliance & Data Governance Post-Migration

Once your site is live, ongoing compliance is non-negotiable. We configure and monitor these.

• Consent management: Every form that collects email, phone, or behaviour must have explicit DPDP consent. We configure consent banners, track consent, and maintain audit logs.
• Grievance officer mailbox: The DPDP Act requires a published grievance officer email. We set up [email protected], configure auto-responses, and create an internal workflow to respond to data-principal requests (access, correction, erasure) within 30 days.
• Data localisation audit: Quarterly, we audit where your data actually lives (is it really in Mumbai, or did a misconfigured app backup to S3-us-east-1?). We fix misconfigurations and document the audit for your DPO.
• Cross-border transfer log: If you use third-party services (Intercom for chat, HubSpot for CRM, Stripe for payments), each one is a 'data processor.' We maintain the processor registry, ensure each has a Data Processing Agreement (DPA), and log the regulatory justification.
• Incident response: If your site is breached, DPDP requires you to notify affected data principals and the DPA within 72 hours. We provide template notifications and coordinate with your legal team.

Where It Goes Wrong: Common Hosting Mistakes

• Hosting in the US by default: Many startups click 'create AWS account' and default to us-east-1 (Virginia). Months later, audit season hits and they discover RBI is unhappy — payment data must be in India. Months of remediation follow. We check your sector rules upfront and default to Indian regions.
• No backup strategy: Backup is often an afterthought: 'We'll backup to the same region as production' is a disaster — one region outage kills both. Or: 'Backups run but we've never tested restores' means at 2 AM in a crisis, the backup is corrupt. We test restores quarterly.
• WAF disabled or misconfigured: WAF is turned on but rules are set to 'log only' (not 'block'). Attackers know this and exploit. Or: rules are so tight that legitimate users are blocked. We tune rules to your vertical and monitor false-positive rates.
• SSL cert expires without renewal: Let's Encrypt is automatic if set up right, but manual certs expire in 90 days. Many sites go dark because the cert wasn't renewed. We use automated renewal and monitor expiry.
• CDN cache poisoning: CDN cache is set to 1 year for a file. A bug slips through QA and goes live. You patch it, but users see the old cached version for weeks. We set reasonable cache headers (static assets 1 month, HTML 5 minutes, API responses no-cache).
• Monitoring alerts are ignored: PagerDuty fires every time a database query is slow (false positive). The team silences the alert and stops reading them. When your site actually goes down, the alert is ignored. We tune monitoring to high-confidence alerts and regularly review alert fatigue.
• Team has no runbook: A key person knows how to deploy or restore, but the knowledge is not written down. They go on vacation, and the team is paralysed. We document everything in a runbook that stays with your team.

What You Receive at the End

• Provisioned cloud account (AWS / Azure / GCP / DO) with IAM users for your team and billing alerts configured
• Production server (EC2 / Compute Engine / App Service / Droplet) hardened, patched, and tested
• Deployed application code (migrated from old hosting, or newly configured)
• SSL certificate (Let's Encrypt with auto-renewal, or paid CA) with HTTPS enforced
• CDN configured (Cloudflare / CloudFront) with cache headers tuned for your app type
• WAF rules tuned for your sector (fintech, e-commerce, healthtech, etc.) with DDoS protection active
• Database (if applicable) set up on managed service (RDS, Cloud SQL, Azure Database) in Multi-AZ with automated backups
• Backup procedure documented (daily to separate region, 30-day retention, restore tested)
• Monitoring dashboard (UptimeRobot / Pingdom) and alerting (PagerDuty / Slack / SMS)
• DNS cutover completed and tested; site live on new infrastructure
• Runbook / operations guide (how to deploy, scale, restore, incident response)
• DPDP compliance checklist (consent, grievance officer email, processor registry, incident response)

How to Get Started

Reach out with a brief overview of your site: what it does, current traffic, technology stack (WordPress / Laravel / React / etc.), and any regulated data it handles (payments, health info, stock trading logs, customer personal data). We'll schedule a 30-minute call to map your workload, discuss compliance requirements, and scope the hosting recommendation and cost.

Once you're ready, we onboard you with a project kickoff: we create the cloud account in your name (so you own it fully), set team permissions, and begin provisioning. You'll have a Slack channel with your dedicated engineer, and we'll keep you posted on progress every 24 hours — you'll see your new infrastructure come to life, and then the cutover happens with minimal downtime.