Exoscale vs Leaseweb

Vendor states regular independent audits and publishes multi-framework certs via Compliance Center; not a VPN-style no-logs audit. Download current reports under account/NDA for verification.

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

Vendor asserts ISO/IEC 27001:2022 ISMS certification since 2018; certificates via Compliance Center.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

Listed on compliance site as certified cloud security controls.

Listed on compliance site for personal data protection in public cloud.

SOC 2 listed on compliance marketing; obtain report via Compliance Center / NDA.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

BSI C5 listed among national/international standards on compliance page.

HDS listed on compliance page; confirm scope and zones for health workloads.

CSA STAR listed on compliance page.

Swiss entity; GDPR + Swiss FADP claims; EU zones; public DPA. Not legal advice.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

Swiss operator, no known US parent, European workload zones, and no third-party processor for compute/storage/SKS customer data. Medium residual path via US ops providers (AWS archival, Twilio auth, PayPal) listed for client data. DBaaS uses Aiven (Finland). Not legal advice.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

Public DPA for Akenes SA as processor; Swiss law; Aiven listed for DBaaS.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

Primary product is IaaS/managed infrastructure; customer AI workloads remain customer-controlled. Concrete AI offerings may need separate review if used as an AI system.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Privacy policy lists AWS (US) data archival, Twilio (US) authentication, and PayPal (US) among client operations providers. Vendor states customer-uploaded service data is not transferred to these providers, but account/ops data paths still matter for CLOUD Act and transfer diligence.

Managed databases depend on Aiven Oy (Finland) for orchestration while instances run on Exoscale. Confirm contractual chain, access model, and zone placement for sensitive data.

ISO/SOC/C5/HDS claims are strong marketing signals, but full certificates and SOC reports typically require Compliance Center access or NDA—not fully public PDFs for all frameworks.

Expect solid IaaS, SKS, DBaaS, storage, and GPU—not the global proprietary service catalog of AWS/Azure/GCP. Validate feature gaps early for serverless, global edge, and specialized managed services.

Public materials discuss further European expansion (e.g. Spain via A1 Digital messaging). Treat the live datacenters page as source of truth for residency commitments.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.