| Independent security / no-logs audit | ❌Not foundIaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports. | ❌Not foundNo public independent security audit report located on unomed.ch. |
|---|
| ISO 27001 | ⚠️Vendor claimedVendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass. | ❌Not foundNo ISO 27001 certificate or registry entry found on the official site. |
|---|
| SOC 2 / SOC 3 | ⚠️PartialSOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting. | ❌Not foundNo SOC 2/3 report referenced on public pages reviewed. |
|---|
| GDPR / EU data protection | ⚠️Vendor claimedNL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions. | ⚠️Vendor claimedSwiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case. |
|---|
| US CLOUD Act exposure (indicative) | ⚠️PartialDutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice. | ⚠️PartialSwiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice. |
|---|
| Data processing agreement (B2B) | ⚠️Vendor claimedPrivacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4). | ⚠️Vendor claimedGTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider. |
|---|
| EU AI Act | —Not applicableIaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product. | —Not applicablePACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system. |
|---|
| PCI DSS | ⚠️PartialVendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default. | Not listed |
|---|
| NEN 7510 | ⚠️Vendor claimedVendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer. | Not listed |
|---|
| CISPE IaaS Code of Conduct | ⚠️Vendor claimedHistorical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass. | Not listed |
|---|
| Diagnostic viewer certification | Not listed | ⚠️PartialDefault OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional. |
|---|