gridscale vs Leaseweb

IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required.

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates.

Claimed on compliance/about materials; request current scope.

No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard).

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report.

Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation.

German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation.

Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording.

Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only.

BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone.

Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services).

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.