| Independent security / no-logs audit | —Not applicableIaaS platform—not a no-logs consumer VPN. Independent assurance is via ISO/SOC/C5-style audits rather than a no-logs report. | —Not applicableIaaS/hosting provider, not a no-logs VPN. Assurance is via ISMS certifications and responsible disclosure (Intigriti), not a public no-logs audit. |
|---|
| ISO 27001 | ⚠️Vendor claimedVendor certifications page links ISO/IEC 27001 umbrella certificate PDF for download; re-verify serial/date in procurement. | ⚠️Vendor claimedVendor publishes ISO 27001:2022 PDF (team-blue-nl-bv naming). Independent registry re-check not completed in this draft. |
|---|
| ISO/IEC 27017 (cloud security) | ⚠️Vendor claimedClaimed with downloadable attestation PDF on certifications page. | Not listed |
|---|
| ISO/IEC 27018 (cloud PII) | ⚠️Vendor claimedClaimed with downloadable attestation PDF on certifications page. | Not listed |
|---|
| SOC 2 / SOC 3 | ⚠️Vendor claimedSOC 2 Type II (request report); SOC 3 public PDF linked on certifications page. SOC 1 Type II also claimed. | ❌Not foundNo clear TransIP product-level SOC 2/3 claim found on primary legal/security pages reviewed. |
|---|
| BSI C5 Type II | ⚠️Vendor claimedVendor claims BSI C5:2020 Type II (ISAE 3000); detailed report typically on request via audit-reports download flow. | Not listed |
|---|
| TISAX Level 3 | ⚠️Vendor claimedVendor states TISAX Level 3 for Germany and Netherlands regions. | Not listed |
|---|
| GDPR / EU data protection | ⚠️Vendor claimedEU operator, EU/CH regions, ISO 27018/27701 claims, DPA language on marketing pages—confirm signed DPA for your entity. | ⚠️Vendor claimedDutch controller/processor entity; privacy policy and control-panel DPA. Residency depends on selected product/zone. |
|---|
| US CLOUD Act exposure (indicative) | ⚠️PartialGerman Telekom/T-Systems operator, no known US parent of the cloud business, primary hosting on Telekom EU/CH data centers (not AWS/GCP/Azure). Not a legal clearance of zero extraterritorial risk. Historical Huawei tech partnership is separate supply-chain diligence. Not legal advice. | ⚠️PartialEuropeanStack assessment: Dutch entity / no known US parent / NL-first hosting, but privacy names Google Analytics, reCAPTCHA, and PayPal, and OpenStack KB names Equinix colo. Not a vendor safety claim. Not legal advice. |
|---|
| Data processing agreement (B2B) | ⚠️Vendor claimedVendor GDPR pages state DPA, TOMs, and audit reports available for B2B; obtain current signed pack—not fully self-serve public template verified here. | ⚠️Vendor claimedProcessor agreement available to view/accept in the control panel per knowledge base. |
|---|
| EU AI Act | ⚠️PartialPlatform offers AI services (ModelArts) that may fall under customer AI Act obligations; OTC itself is infrastructure—not an automated high-risk AI system assessment by EuropeanStack. | —Not applicableInfrastructure hosting/registrar; not marketed as an AI system provider. Optional third-party AI assistant images on VPS are customer-chosen workloads. |
|---|
| NEN 7510 (Dutch healthcare information security) | Not listed | ⚠️Vendor claimedVendor publishes NEN 7510:2017 certificate PDF; accounts processing medical data can be marked for extra handling per cert page. |
|---|