IONOS vs TransIP

BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope.

IaaS/hosting provider, not a no-logs VPN. Assurance is via ISMS certifications and responsible disclosure (Intigriti), not a public no-logs audit.

Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here.

Vendor publishes ISO 27001:2022 PDF (team-blue-nl-bv naming). Independent registry re-check not completed in this draft.

SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed.

No clear TransIP product-level SOC 2/3 claim found on primary legal/security pages reviewed.

Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope.

German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors.

Dutch controller/processor entity; privacy policy and control-panel DPA. Residency depends on selected product/zone.

German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice.

EuropeanStack assessment: Dutch entity / no known US parent / NL-first hosting, but privacy names Google Analytics, reCAPTCHA, and PayPal, and OpenStack KB names Equinix colo. Not a vendor safety claim. Not legal advice.

Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex.

Processor agreement available to view/accept in the control panel per knowledge base.

Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence.

Infrastructure hosting/registrar; not marketed as an AI system provider. Optional third-party AI assistant images on VPS are customer-chosen workloads.

Vendor publishes NEN 7510:2017 certificate PDF; accounts processing medical data can be marked for extra handling per cert page.

Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews.

Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.).

Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports.

Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor.

SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU.

Brand is TransIP B.V.; certificates use team.blue NL B.V. Procurement should map the exact contracting entity, DPA signatory, and cert scope to the services purchased.

Privacy policy discloses Google Analytics, reCAPTCHA, and PayPal. These are not described as the VPS storage backend, but they affect overall vendor diligence and CLOUD Act style questionnaires.

OpenStack facility list includes Equinix AMS3 (US-parent colo operator). Workloads remain in Amsterdam physically; treat as partial EU-hosted diligence, not AWS-region hosting.

No broad multi-continent region map or hyperscaler-class managed database suite on the pages reviewed. Teams needing those should plan self-managed stacks or another cloud.

Diligence relies on privacy policy, product pages, and DPA rather than a dedicated exhaustive subprocessor HTML table. Request an up-to-date schedule under NDA if required.