Leaseweb vs UpCloud

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

Vendor states cloud services audited against Finnish PiTuKri criteria by an independent firm; ISO 27001 ISMS regularly audited. Public PiTuKri report not fully reproduced on marketing pages—request artefacts.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

Vendor asserts ISO 27001 certified ISMS and publishes certificate PDF; independent registry re-check not completed in this draft.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

Facility providers list SOC reports; no clear first-party UpCloud SOC 2 Type II product claim found on compliance pages reviewed.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

Finnish controller/processor under GDPR; customer chooses region; DPA in ToS; CISPE Code of Conduct adherence claimed.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

Finnish entity / no known US parent; EU-region VMs can avoid US storage. Material exceptions: optional US DCs, US/SG support affiliates for account ops, US colocations if selected. Assessment not a vendor safety claim. Not legal advice.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

DPA incorporated into Terms of Service; binding on acceptance without separate signature per vendor.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

General-purpose IaaS/platform; not an AI system provider by primary product.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Vendor states adherence to CISPE data protection code for cloud infrastructure providers.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

US, Singapore, and Sydney zones are first-class options. Mis-pinned workloads or defaults can place Customer Data outside the EU. Account information is accessible to non-EEA support staff even when VMs stay in Europe.

Strong IaaS and focused managed services; missing many proprietary AWS/Azure/GCP PaaS and AI products. Multi-cloud or dual-vendor designs may still be required.

ISO 27001 and PiTuKri claims are published; a customer-facing SOC 2 Type II for UpCloud itself was not found. Enterprise questionnaires may need NDA artefacts or reliance on ISO plus facility reports.

Platform runs in third-party data centres. Facility certifications differ by site; treat them as complementary to UpCloud’s own ISMS, not a substitute for vendor due diligence.

Zero-cost egress is a commercial differentiator but is governed by a Fair Transfer Policy—extreme or abusive transfer patterns may fall outside the marketing promise. Validate for CDN-scale or bulk egress designs.