IONOS vs Open Telekom Cloud

BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope.

IaaS platform—not a no-logs consumer VPN. Independent assurance is via ISO/SOC/C5-style audits rather than a no-logs report.

Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here.

Vendor certifications page links ISO/IEC 27001 umbrella certificate PDF for download; re-verify serial/date in procurement.

SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed.

SOC 2 Type II (request report); SOC 3 public PDF linked on certifications page. SOC 1 Type II also claimed.

Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope.

Vendor claims BSI C5:2020 Type II (ISAE 3000); detailed report typically on request via audit-reports download flow.

German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors.

EU operator, EU/CH regions, ISO 27018/27701 claims, DPA language on marketing pages—confirm signed DPA for your entity.

German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice.

German Telekom/T-Systems operator, no known US parent of the cloud business, primary hosting on Telekom EU/CH data centers (not AWS/GCP/Azure). Not a legal clearance of zero extraterritorial risk. Historical Huawei tech partnership is separate supply-chain diligence. Not legal advice.

Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex.

Vendor GDPR pages state DPA, TOMs, and audit reports available for B2B; obtain current signed pack—not fully self-serve public template verified here.

Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence.

Platform offers AI services (ModelArts) that may fall under customer AI Act obligations; OTC itself is infrastructure—not an automated high-risk AI system assessment by EuropeanStack.

Claimed with downloadable attestation PDF on certifications page.

Claimed with downloadable attestation PDF on certifications page.

Vendor states TISAX Level 3 for Germany and Netherlands regions.

Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews.

Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.).

Unlike some SaaS vendors, a complete public subprocessor inventory was not found on marketing pages. Request DPA annex and subcontractor list before high-assurance processing.

Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports.

Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor.

SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU.

Platform launched with Huawei hardware/software partnership; residual stack components may still matter for sensitive public-sector RFPs. T-Systems states independent operation. Review supply-chain docs under NDA.

Several services (e.g. ModelArts, bare metal, some database/analytics SKUs) are unavailable in NL or limited to DE. Design against the live regional matrix, not the full marketing list.

Expect fewer regions, fewer proprietary PaaS services, and a smaller marketplace than US hyperscalers. Migration tools and partner ecosystem exist but differ in depth.

Documentation, console URLs, and community still mix Open Telekom Cloud and T Cloud Public names. Factor rebrand into runbooks and vendor risk registers.