Leaseweb vs Webswing

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

Footer states regular security testing is available upon request; no public independent audit PDF found.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

Site footer: Webswing Limited maintains an ISO/IEC 27001-certified ISMS. Independent cert registry entry not verified in this pass.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

No SOC 2/3 claim found on public site pages reviewed.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

Privacy policy names WEBSWING LIMITED as Irish controller under GDPR; FAQ states GDPR alignment for company contact data.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

EU entity with no known US parent; self-hosted runtime keeps sessions on customer infra. Vendor website/portal lists US-group processor The Rocket Science Group LLC (email) plus Google/Meta/LinkedIn Ireland entities for analytics/ads. Not legal advice.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

Privacy policy references Art. 28 DPAs with Webswing's own processors; no public customer-facing DPA download found. Request during procurement.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

Core product is application delivery/runtime, not an AI system. Prague research affiliate explores AI; not the catalogued product.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

Docs state each browser session needs more server CPU/memory than a native web app. Capacity planning and Cluster Engine matter for large concurrent user counts.

Official overview: video not supported, limited sound, no 3D hardware acceleration, poor fit for real-time action games due to rendering latency.

Current releases require commercial license + SLA. AGPL/public source stopped after 20.2. Source access for licensed customers is via Client Portal rather than a public repo.

Privacy policy lists The Rocket Science Group LLC and major ad/analytics vendors for website/portal data. Irrelevant to on-prem session pixels, but relevant if you put sensitive personal data only into vendor portals.

Vendor claims ISO/IEC 27001-certified ISMS on the site footer. Ask for the current certificate and scope before treating it as verified.