gridscale vs Seeweb

IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required.

IaaS/data-center provider—not a consumer no-logs VPN. Assurance is via ISO/ISMS and sector qualifications rather than a no-logs report.

Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification.

Vendor certifications page: ISO/IEC 27001:2022, AXE REGISTER cert IT18-27702D, valid until 28 Nov 2027; locations Milan & Frosinone. Re-verify serial in procurement.

Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Claimed on compliance/about materials; request current scope.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard).

No SOC 2/3 report advertised on the official certifications page at research time.

About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report.

Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation.

German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing.

Italian controller/processor entity, European hosting messaging, privacy policy, ISO 27018 claim, CISPE; confirm DPA for your processing roles.

EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice.

Italian Seeweb S.r.l., Italian DHH parent, no known US parent; primary hosting on European DCs (not AWS/GCP/Azure). Third-party Swiss/BG facilities and global transit carriers exist. Indicative only—not legal advice.

GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone.

Art. 28 DPA language used for Seeweb-operated services (e.g. published for Regolo); request current signed DPA + TOMs + subprocessors for core cloud/IaaS contracts.

Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model.

Infrastructure/GPU provider and Rethic.AI partnership messaging; AI Act duties mainly fall on customer AI systems. Not a full provider high-risk AI assessment by EuropeanStack.

Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de.

Vendor states CISPE registry presence and European data storage under the Code (since 31 May 2017 on certifications page).

IaaS qualification for Italian PA; QI2 infrastructure and QC2 for listed products including AI/supercomputing infrastructures (19 Jan 2023 on certifications page).

Stated for Virtual Private Cloud and Foundation Server PRO (6 July 2022 on certifications page).

100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation.

Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording.

Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only.

BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone.

Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services).

Region set is European (IT/CH/BG) with a mid-size operator catalog. Multi-continent apps or niche managed PaaS may force multi-cloud or a larger EU peer.

ISO and ACN claims include certificate numbers and dates on seeweb.it, but EuropeanStack did not re-download every registry PDF. Re-verify serials and scope statements in formal assurance reviews.

Facility partners and network carriers are described on DC pages, but a consolidated customer-content subprocessor list was not found as one public document. Request annex under NDA for regulated workloads.

Vendor documents ~2-minute notice before Spot termination when On-Demand needs capacity. Architect batch/checkpointing; do not run sole critical control planes only on Spot.

Lugano, Zurich, and Sofia are presented via partner facilities (Swisscom, Global Data Centers Switzerland AG, Evolink). Italy-only residency must be contracted explicitly if required.