A UK/EU-based, GDPR-friendly stack for UK small businesses in 2026: Vercel, Resend, Plausible, Capsule

Sooner or later, a careful customer (or their accountant, or their data-protection adviser) asks the same question of a small-business website: where does the data physically sit, and what is your sub-processor list? The answer “AWS US-East, behind a proxy, with Google Analytics and HubSpot forms” is awkward to defend. The Schrems II ruling (Court of Justice of the EU, July 2020) did not ban US vendors. It made the business defend the choice in writing.

This is the UK/EU-based, GDPR-friendly stack that UK Web Marketing prefers to build on: four vendors, each picked against the obvious US default, each easy to explain. Pure vendor cost runs roughly £24 to £71 per month per site depending on traffic and whether you add a CRM. That cost sits underneath the website management that keeps the site built and maintained, which is quoted to your business and starts from £49 per month with no lock-in.

If your business is in a regulated profession (a law firm, an accountancy practice, a clinic, or a school) the bar is higher, and the people who run those reviews want documentation that goes well beyond a tidy vendor list. That deeper work starts with our EU-sovereign by design approach and the CLOUD Act explainer for UK businesses. This article is the plain version for everyone else.

The four vendors, the four US defaults

Layer	The pick	Region	The US default	Why the pick reads better
Hosting	Vercel	London (lhr1)	AWS US-East	Per-project region pin to London; DPA signed by default
Email	Resend	EU region	SendGrid (US)	EU region option, GDPR-clean defaults, no US-only data plane
Analytics	Plausible	EU-hosted	Google Analytics 4	Cookieless, no IP store, no consent banner needed
CRM	Capsule	Manchester, UK	HubSpot (US)	UK-resident data; UK-incorporated processor

Each line on this table is something the business can hand to whoever asks. Each US default is a vendor you would have to write a transfer impact assessment to keep using comfortably under UK GDPR Article 46. Schrems II is the reason: standard contractual clauses are no longer sufficient on their own, and the data importer’s country has to be evaluated. The four picks above mostly skip that evaluation by sitting inside the EEA or the UK.

Vercel London vs AWS US-East

The pick. Vercel Pro, with every project pinned to the lhr1 region (London). Functions, edge handlers, and ISR cache all serve from London. The DPA is signed by default during onboarding. (For the deeper hosting comparison, see Vercel vs Netlify vs Cloudflare Pages.)

The US default. AWS US-East-1 (N. Virginia). Default region for most AWS resources, the cheapest, the largest. Functions, S3 buckets, RDS databases all serve from Virginia unless explicitly moved.

The difference that reads well. When someone asks “where does the request render,” the Vercel answer is “London, every time, by configuration in the project’s vercel.json.” The AWS-default answer is “US-East unless someone remembered to override it, and we would need to audit each resource individually.” The first is a posture; the second is a project.

Cost. Vercel Pro is $20 per seat per month. For a single-seat UK Web Marketing client site that is roughly £16 at current FX. AWS US-East is cheaper in absolute terms, but the cost of being able to defend it (a transfer impact assessment, supplementary measures, ongoing review) tends to eat the saving for any business that gets asked the question.

Resend EU vs SendGrid

The pick. Resend, with the EU region selected in the dashboard. Transactional email for booking confirmations, contact-form acknowledgements, magic-link logins. The Free tier covers up to 3,000 emails per month; the Pro tier is $20 per month for 50,000.

The US default. SendGrid (Twilio). The most widely used transactional email vendor. Data plane is US, with limited EU support behind enterprise contracts.

The difference that reads well. Resend was built EU-native from the start. The EU region is a checkbox, not a contract negotiation. SendGrid’s EU residency is genuinely possible but requires Twilio Enterprise pricing, typically four-figure monthly commitments that no small business takes. So in practice SendGrid means US-resident customer email metadata, which is the precise thing GDPR Article 44 (“transfers to third countries”) regulates.

The smaller point: contact-form and booking emails carry personal data by their nature (a name, an email address, sometimes the reason for the enquiry). Keeping that email flow inside the EU is the easy default, and Resend makes it the easy default.

Plausible EU vs Google Analytics 4

The pick. Plausible, EU-hosted, on the Pro plan (€19 per month for the up-to-100k-pageviews tier). Cookieless by design: no client identifier, no IP store, no fingerprinting. No cookie banner required, because Plausible is not processing personal data.

The US default. Google Analytics 4. Free, ubiquitous, and awkward under UK GDPR after the Schrems II, Austrian DSB, and French CNIL findings. Multiple EU regulators have ruled GA4 unlawful as commonly deployed, because client IPs and cookie IDs constitute personal data exported to the US.

The difference that reads well. Plausible’s data flow is: page view, then EU server, then an aggregated counter increment. No personal data ever leaves the EU because no personal data is ever collected. GA4’s data flow is: page view, then cookie set, then client ID plus IP, then Google US infrastructure, then reporting via Google Cloud. The first answers the question cleanly; the second invites it.

Cost saving. Plausible Pro is €19 per month (about £16). GA4 is “free,” but on a business that gets asked the question the real cost of running it is the cost of writing a CNIL-style supplementary-measures document, which any external adviser will quote at four figures.

Capsule Manchester vs HubSpot

The pick. Capsule CRM (Zestia Ltd, Manchester). UK-incorporated, UK-resident data, hosted on UK infrastructure. Plans from £15 per user per month (Starter) through £36 per user per month (Growth). On UK Web Marketing builds, Capsule is an optional add-on when the site needs to track contacts and enquiries, rather than a standing part of every build. (Full comparison: Capsule vs Pipedrive vs HubSpot.)

The US default. HubSpot. The dominant small-business CRM globally; data resident in the US for most plans, with EU residency available only on enterprise tiers.

The difference that reads well. Capsule’s processor agreement names a single UK data centre. The sub-processor list is short and EU/UK-resident. HubSpot’s processor agreement names dozens of US sub-processors, and EU customer data is co-mingled with US customer data in the same logical tenants on the cheaper plans. If you ever have to explain where your contact data lives, the Capsule answer is a sentence and the HubSpot answer is a project.

The smaller story. Capsule is also a better tool for the actual small-business job. A five-person firm tracking 200 active contacts does not need HubSpot’s marketing automation pillar. It needs contacts, opportunities, and tasks. Capsule does that for less than half the price, in Manchester.

What the stack costs, monthly

A low-traffic site on this stack:

• Vercel Pro: about £16
• Resend (Free tier, enough for under 3,000 emails per month): £0
• Plausible (small-traffic site, Starter tier about €9 per month): about £8
• Cloudflare (DNS plus email routing, free): £0
• Low-traffic total: about £24 per month in pure vendor cost

A higher-traffic, CRM-enabled site adds:

• Resend Pro: about £16
• Plausible Pro (about 100k pageview tier): about £16
• Capsule Starter (one seat): £15
• Additional: about £47 per month

Total vendor cost on the heavier profile is roughly £71 per month. That sits underneath the website management that builds and maintains the site, which is quoted to your business and starts from £49 per month. On a fuller plan that also produces the articles, conversion experiments, and regular content, the all-in is the vendor cost plus that management fee. Compare even the heavier profile, roughly £71 in vendor cost plus £49 management, against HubSpot Marketing Hub Professional (£740 per month minimum) plus a US-hosted website plus GA4 plus SendGrid Enterprise plus a supplementary-measures write-up, all before anyone has driven a single visitor, and the cost question reverses entirely. Fully managed does not have to mean expensive.

One more note on how the work is priced: UK Web Marketing does not publish self-serve package prices. The path is a free audit of your current build, then, if it is worth going deeper, a paid Marketing and Automation Deep-Dive at £300 (a consultation, a written audit, and a fixed quote), and that £300 is credited against any build you go on to commission. From there the build is bespoke, paired with website management from £49 per month, quoted to your business. There is no lock-in, you can cancel any time, and the 14-day Consumer Contracts Regulations 2013 cooling-off period applies.

The sub-processor list

A serious site should ship with a page that names its vendors, their data-processor agreements, and the country each one operates in. The page exists because people sometimes ask for it, not because it converts.

You can see the live example at ukwebmarketing.com/sub-processors. The structure is:

1. Data controller, the client business, by company number.
2. Data processor, TicketWave HQ Ltd (company 17143167, trading as UK Web Marketing), plus the sub-processors named below.
3. Sub-processor list, one row per vendor: legal name, country, role, DPA link, contact for data subject requests.
4. International transfer mechanism, for each vendor, the legal basis (UK adequacy regulations for EU vendors; the UK International Data Transfer Agreement / Addendum where a parent company is US-incorporated; not applicable for UK-resident vendors).
5. Review date, annual, with the date logged.
6. Change notice, at least 30 days before adding a new sub-processor, by email to the address on file.

Having that ready, by default, is the difference between “we host on AWS, and the cookie banner mentions Google Analytics” and “here is our sub-processor list, dated, with the DPAs linked.”

What this stack does not do

Three honest call-outs:

1. It is not zero-risk. Vercel and several other vendors are US-incorporated even with EU or UK regions selected. A worst-case CLOUD Act request could in theory reach UK or EEA-resident data, which is why the UK IDTA Addendum sits behind those vendors. As a concrete example, the lead and client database (Neon Postgres, used via Vercel) currently sits in Frankfurt, inside the EEA (AWS eu-central-1); a migration to a London region is planned but not yet done, and until it completes the data stays in the EEA under intra-EEA safeguards. Cloudflare and Stripe operate global networks and are kept as documented exceptions by design.
2. It is not the cheapest option short-term. A WordPress plus shared-hosting plus GA4 plus HubSpot Free plus Mailchimp stack can be near-free. This stack is £24 to £71 per month in vendor fees. The case for spending the difference is the question someone will eventually ask, not the monthly invoice.
3. It requires ongoing review. Vendors get acquired. The annual sub-processor review exists precisely to catch that, and on a UK Web Marketing monthly retainer the review is done for you. (Start with a free audit of your current build to see where it stands.)

When this stack is the right answer

For most UK small businesses (a hospitality venue, a consumer brand, a trades business, an independent shop) this stack is a sensible default. It keeps the email and analytics inside the EU, it is genuinely faster than AWS US-East from any UK location, and it sidesteps the GA4 cookie-banner mess. The urgency is moderate, but the upside is real and the cost is small.

If your business is in a regulated profession (a law firm, an accountancy practice, a clinic, or a school), you need more than a tidy vendor list: you need documentation written to the standard your regulator and your professional body expect. The right place to start is the free website compliance checklist, which walks you through where your customers’ data actually ends up.

If you want this stack assembled on your site, run the free Site Score audit to find out which US-default vendors are on your current build, then, if it is worth going deeper, the paid Marketing and Automation Deep-Dive turns that into a written audit and a fixed quote.