Leaseweb vs Scaleway

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.