| Independent security / no-logs audit | ❌Not foundNo public third-party no-logs or mail-specific penetration audit PDF found for Cloud Mail; ISO ISMS certs are separate. | ❌Not foundNo public third-party no-logs or product security audit PDF for Cloud Office located on official pages. |
|---|
| ISO 27001 | ⚠️Vendor claimedVendor certifications page: ISO/IEC 27001:2022, scope includes mail services; AXE REGISTER cert IT18-27702D (listed valid until 28 Nov 2027). Not independently re-verified in a public registry by this draft. | ❌Not foundCompany page describes the Glattbrugg data center as ISO- and FINMA-certified (facility). No Hostpoint-organization ISO 27001 certificate page found in this pass. |
|---|
| ISO 27017 / 27018 (cloud) | ⚠️Vendor claimedPublished on certifications page as appendices to the ISO 27001 certificate; mail services in process scope. | Not listed |
|---|
| SOC 2 / SOC 3 | ❌Not foundNot listed on the public certifications page. | ❌Not foundNo public SOC 2/3 report for Hostpoint Cloud Office found. |
|---|
| GDPR / EU data protection | ⚠️Vendor claimedItalian controller entity, named DPO, privacy policy under GDPR; product marketed as GDPR-oriented; CISPE CoC adherence claimed. | ⚠️Vendor claimedSwiss FADP primary; privacy states GDPR may apply in some processing. EU representative: Hostpoint Limited, Malta. Swiss–EU adequacy eases transfers. Customer remains controller for hosted content. |
|---|
| CISPE Code of Conduct | ⚠️Vendor claimedCertifications page: Seeweb cloud services adhere to CISPE; claims storage exclusively within European territories for covered services. | Not listed |
|---|
| US CLOUD Act exposure (indicative) | ⚠️PartialEuropeanStack assessment: EU entity, DHH European group, no known US parent; public hosting story is Seeweb EU DCs and CISPE EU territory claim; backups on Seeweb off-site DCs (Spectrum Protect software, not described as US cloud mailbox SaaS). Residual gaps: no full public subprocessor list; antispam uses external reputation services not named on the docs page. Not legal advice. | ⚠️PartialEuropeanStack assessment: Swiss AG, no known US parent, Swiss product residency claims → relatively low ownership exposure vs US SaaS mail. Residual factors: US-listed Digital Realty facility owner (colocation), possible US-group tools on full subprocessor/marketing stack, privacy exceptional-transfer language. Not a clean bill; not legal advice. |
|---|
| Data processing agreement (B2B) | ❌Not foundNo downloadable product DPA found on the marketing site; general conditions reference GDPR processing and the privacy notice. Request Art. 28 terms for mail content before go-live. | ⚠️Vendor claimedAnnex 2 DPA + TOMs published with web-hosting GTC PDF; sub-processor engagement rules and audit rights described. Confirm applicability to your E-Mail & Cloud Office order and obtain current Sub-Processor List. |
|---|
| EU AI Act | —Not applicableCloud Mail is conventional email hosting, not an AI product. | —Not applicableNot an AI product. |
|---|
| swiss hosting label | Not listed | ⚠️Vendor claimedCompany states Hostpoint bears the swiss hosting label (HQ + data location in Switzerland), with rankingCoach exceptions noted. |
|---|