| Independent security / no-logs audit | —Not applicableIaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim. | —Not applicableIaaS/data-center provider—not a consumer no-logs VPN. Assurance is via ISO/ISMS and sector qualifications rather than a no-logs report. |
|---|
| ISO 27001 | ✅VerifiedISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy. | ⚠️Vendor claimedVendor certifications page: ISO/IEC 27001:2022, AXE REGISTER cert IT18-27702D, valid until 28 Nov 2027; locations Milan & Frosinone. Re-verify serial in procurement. |
|---|
| SOC 2 / SOC 3 | ❌Not foundNot listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1). | ❌Not foundNo SOC 2/3 report advertised on the official certifications page at research time. |
|---|
| HDS (French health data hosting) | ⚠️Vendor claimedVendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture. | Not listed |
|---|
| CSA STAR Level 1 | ⚠️Vendor claimedTrust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ). | ⚠️Vendor claimedStated for Virtual Private Cloud and Foundation Server PRO (6 July 2022 on certifications page). |
|---|
| ANSSI SecNumCloud | ⚠️PartialQualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed. | Not listed |
|---|
| GDPR / EU data protection | ⚠️Vendor claimedEU controller/processor with published privacy policy and DPA; French entity. Not legal advice. | ⚠️Vendor claimedItalian controller/processor entity, European hosting messaging, privacy policy, ISO 27018 claim, CISPE; confirm DPA for your processing roles. |
|---|
| US CLOUD Act exposure (indicative) | ⚠️PartialFrench SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim. | ⚠️PartialItalian Seeweb S.r.l., Italian DHH parent, no known US parent; primary hosting on European DCs (not AWS/GCP/Azure). Third-party Swiss/BG facilities and global transit carriers exist. Indicative only—not legal advice. |
|---|
| Data processing agreement (B2B) | ⚠️Vendor claimedDPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs. | ⚠️Vendor claimedArt. 28 DPA language used for Seeweb-operated services (e.g. published for Regolo); request current signed DPA + TOMs + subprocessors for core cloud/IaaS contracts. |
|---|
| EU AI Act | —Not applicableInfrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim. | ⚠️PartialInfrastructure/GPU provider and Rethic.AI partnership messaging; AI Act duties mainly fall on customer AI systems. Not a full provider high-risk AI assessment by EuropeanStack. |
|---|
| ISO/IEC 27017 (cloud security) | Not listed | ⚠️Vendor claimedAppendix to ISO 27001 certificate on certifications page; same validity window stated. |
|---|
| ISO/IEC 27018 (cloud PII) | Not listed | ⚠️Vendor claimedAppendix to ISO 27001 certificate on certifications page; same validity window stated. |
|---|
| CISPE Data Protection Code of Conduct | Not listed | ⚠️Vendor claimedVendor states CISPE registry presence and European data storage under the Code (since 31 May 2017 on certifications page). |
|---|
| ACN Qualified CSP (QI2/QC2) | Not listed | ⚠️Vendor claimedIaaS qualification for Italian PA; QI2 infrastructure and QC2 for listed products including AI/supercomputing infrastructures (19 Jan 2023 on certifications page). |
|---|