IONOS vs Seeweb

BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope.

IaaS/data-center provider—not a consumer no-logs VPN. Assurance is via ISO/ISMS and sector qualifications rather than a no-logs report.

Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here.

Vendor certifications page: ISO/IEC 27001:2022, AXE REGISTER cert IT18-27702D, valid until 28 Nov 2027; locations Milan & Frosinone. Re-verify serial in procurement.

SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed.

No SOC 2/3 report advertised on the official certifications page at research time.

Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope.

German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors.

Italian controller/processor entity, European hosting messaging, privacy policy, ISO 27018 claim, CISPE; confirm DPA for your processing roles.

German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice.

Italian Seeweb S.r.l., Italian DHH parent, no known US parent; primary hosting on European DCs (not AWS/GCP/Azure). Third-party Swiss/BG facilities and global transit carriers exist. Indicative only—not legal advice.

Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex.

Art. 28 DPA language used for Seeweb-operated services (e.g. published for Regolo); request current signed DPA + TOMs + subprocessors for core cloud/IaaS contracts.

Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence.

Infrastructure/GPU provider and Rethic.AI partnership messaging; AI Act duties mainly fall on customer AI systems. Not a full provider high-risk AI assessment by EuropeanStack.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Vendor states CISPE registry presence and European data storage under the Code (since 31 May 2017 on certifications page).

IaaS qualification for Italian PA; QI2 infrastructure and QC2 for listed products including AI/supercomputing infrastructures (19 Jan 2023 on certifications page).

Stated for Virtual Private Cloud and Foundation Server PRO (6 July 2022 on certifications page).

Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews.

Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.).

Facility partners and network carriers are described on DC pages, but a consolidated customer-content subprocessor list was not found as one public document. Request annex under NDA for regulated workloads.

Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports.

Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor.

SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU.

Region set is European (IT/CH/BG) with a mid-size operator catalog. Multi-continent apps or niche managed PaaS may force multi-cloud or a larger EU peer.

ISO and ACN claims include certificate numbers and dates on seeweb.it, but EuropeanStack did not re-download every registry PDF. Re-verify serials and scope statements in formal assurance reviews.

Vendor documents ~2-minute notice before Spot termination when On-Demand needs capacity. Architect batch/checkpointing; do not run sole critical control planes only on Spot.

Lugano, Zurich, and Sofia are presented via partner facilities (Swisscom, Global Data Centers Switzerland AG, Evolink). Italy-only residency must be contracted explicitly if required.