IONOS vs Scaleway

BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope.

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here.

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed.

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope.

German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors.

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice.

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex.

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence.

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews.

Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.).

Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports.

Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor.

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU.

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.