Guides / Django hosting for NIS2 and DORA clients: what suppliers must show, with Django Cloud
Peter van Doorn
Django hosting for NIS2 and DORA clients: what suppliers must show, with Django Cloud
If you build software for banks, energy firms, hospitals or public bodies, your client's security rules reach you. Two EU laws come up most: NIS2 and DORA. Neither tells you which web host to use, but both make your client responsible for the suppliers behind their software. This is general information, not legal advice.
NIS2 in one paragraph
NIS2 is an EU directive on cybersecurity. It applies to "essential" and "important" entities in sectors such as energy, transport, health, digital infrastructure and public administration. Those organizations must manage cyber risk, including the security of their supply chain. A web application built and hosted by a supplier is part of that chain.
DORA in one paragraph
DORA is an EU regulation on digital operational resilience for financial entities such as banks, insurers and payment firms. It has applied since January 2025. It asks the entity to keep a register of its ICT third-party providers, to put required terms in their contracts, and to plan for failures and exit.
What your client will probably ask you
- Where is the application hosted, and under whose control?
- Which companies handle our data, and where are they based?
- How are access, changes and incidents logged?
- How quickly will you tell us about a security incident?
- How do we get our data and our system back if we end the contract (exit plan)?
- Can you show evidence: certifications, test reports, an audit?
How hosting choices help you answer
- Client-owned cloud account. The client sees the resources, the bill and the access logs without asking you. The exit plan is short: remove your access and the system keeps running.
- Role-based access instead of shared keys. Temporary credentials and a log of every action answer the "who can do what" question.
- Region control. You can state where data is stored.
- Release history and rollback. A record of what was deployed and when helps with change management.
- Documented dependencies. Every supplier in the chain is listed with its role.
What a platform cannot give you
A hosting platform does not make your client compliant. Compliance is about the client's whole organization: policies, risk assessments, training, incident handling. Ask any provider, us included, for the evidence it can show, and do not assume a certificate that is not on the table. Django Cloud does not currently claim ISO 27001, NIS2 or DORA certification.
Prepare a short supplier pack
- An architecture sketch: where each component runs.
- The list of sub-processors and their locations.
- The data processing agreement.
- An access model: who can reach what, and how it is logged.
- An exit plan: what the client does to take over.
Having this ready before the question arrives often decides whether a regulated client chooses a small supplier. See also the data processing agreement guide.
Or skip it
Django Cloud Self-hosted keeps the app in the client's own AWS account, with role-based access and every action in their CloudTrail. We do not currently claim ISO 27001, NIS2 or DORA certification.
pip install djangocloud-cli
djangocloud deployFree plans are available for students, AWS Activate startups, open-source, non-profit and research projects. See how Django Cloud compares with other ways to host Django.
Django is a registered trademark of the Django Software Foundation. Django Cloud is not affiliated with or endorsed by it. Found a mistake in this guide? Tell us and we will fix it.