bunny.net vs Leaseweb CDN

Compare bunny.net y Leaseweb CDN en capacidades, jurisdicción, garantías y encaje para compradores europeos.

Ambos figuran como alternativas a: Cloudflare

bunny.net

Slovenia· Web Hosting and Cloud Computing

Needs review

Shortlist bunny.net when you want a Slovenian-operated CDN plus storage and Stream, with an official EU pull-zone routing filter and prepaid pay-as-you-go billing. Skip it when you need Cloudflare Workers or Zero Trust as the control plane, or when account data must stay off US-group SaaS (Slack, OpenAI, SendGrid, Mixpanel, Salesforce, Braintree). Consider Cloudflare if the platform surface matters more than EU HQ.

EU-operated (Slovenia)Pay-as-you-go CDNEU pull-zone routing filterMulti-region edge storageManaged video (Stream)ISO 27001 (claimed)

Ver ficha Visitar sitio web

Leaseweb CDN

Netherlands· Web Hosting and Cloud Computing

Needs review

Shortlist when you want a Dutch (or other local Leaseweb) B2B contract that fronts four partner CDNs with NS1 Pulsar steering and included Amsterdam or Washington, D.C. origin shields. Skip when you need EU-only processors, named partner inventory up front, Cloudflare-class WAF or Workers, or signed URLs without a shield hop. Consider Cloudflare for a single global edge platform, or OVHcloud if you want a French-operated CDN attached to EU datacentres.

Dutch sales entityMulti-CDN (4 partners)Origin shield (AMS + WDC)Portal + REST APIISO 27001 (company, claimed)

Ver ficha Visitar sitio web

Las filas resaltadas diferencian a los dos productos.

bunny.net vs Leaseweb CDN: Resumen
Característica	bunny.net	Leaseweb CDN
País de origen	Slovenia	Netherlands
Categoría	Web Hosting and Cloud Computing	Web Hosting and Cloud Computing
Código abierto	No	No
Autoalojado	No	No
Sede	Slovenia	Netherlands
Entidad legal	BunnyWay d.o.o., Dunajska cesta 165, 1000 Ljubljana, Slovenia	Leaseweb Netherlands B.V. (KvK 30141839, Amsterdam). Website: Leaseweb Global B.V. (KvK 60593652). Other local sales entities exist.
Matriz / control EE.UU.	Sin matriz estadounidense conocida	Sin matriz estadounidense conocida
Exposición CLOUD Act (indicativa)	Medio	Medio
Alojamiento / residencia	Operator-advertised global PoPs (Standard 119, Volume 10) and 15 storage regions, including EU (London, Stockholm, Frankfurt, Madrid, Prague) and US (New York, Miami, Los Angeles, Seattle). EU Routing Filter can pin CDN pull-zone traffic to 24 EU PoPs. DNS stays global. Account path uses Slack, OpenAI, MailChannels, SendGrid, Mixpanel, Salesforce, and Braintree. Privacy page claims EU residency for BigQuery, dbt Cloud, Lemlist, Loqate, and Kickscale.	Delivery is a mix of four unnamed third-party CDNs (global PoPs). Leaseweb origin shields in Amsterdam and Washington, D.C. Request steering via NS1 Pulsar. Origins may be customer HTTP hosts or S3-compatible buckets (including AWS). Raw logs (including client IP) collected from partners and optionally written to customer S3. No public CDN subprocessor list naming the four partners.
Resumen	Slovenian edge platform from BunnyWay d.o.o.: pay-as-you-go CDN, multi-region object storage, video streaming, and Shield WAF on an operator-run global PoP network.	Dutch Multi-CDN that steers traffic across four partner networks with NS1 Pulsar, plus included origin shields in Amsterdam and Washington, D.C. Sold under local Leaseweb sales entities.
Etiquetas	cdn gdpr privacy infrastructure	cdn gdpr multi-cdn content-delivery iaas netherlands origin-shield

De un vistazo: bunny.net vs Leaseweb CDN
De un vistazo	bunny.net	Leaseweb CDN
HQ	Ljubljana, Slovenia	Amsterdam, Netherlands
Legal entity	BunnyWay d.o.o.	No indicado
Product family	CDN, Storage, Stream, Shield, DNS, Optimizer, edge compute	No indicado
Hosting model	Hosted operator PoPs (not self-hosted)	No indicado
Commercial model	Prepaid pay-as-you-go, trial without credit card	B2B traffic tiers, annual commitment
Open source	No public core license found	No indicado
Website operator	No indicado	Leaseweb Global B.V. (KvK 60593652)
Typical NL contract	No indicado	Leaseweb Netherlands B.V. (KvK 30141839)
Founded	No indicado	1997 (vendor, 2023 press)
Product type	No indicado	Managed Multi-CDN (not self-hosted, not open source)
Edge	No indicado	Four unnamed partner CDNs, 400+ PoPs (vendor claim)
Shield locations	No indicado	Amsterdam and Washington, D.C.
Steering	No indicado	NS1 Pulsar (Volume: cost; Premium: QoE)

Key capabilities: bunny.net vs Leaseweb CDN
Key capabilities	bunny.net	Leaseweb CDN
EU-operated (Slovenia)	Sí	No indicado
Pay-as-you-go CDN	Sí	No indicado
EU pull-zone routing filter	Sí	No indicado
Multi-region edge storage	Sí	No indicado
Managed video (Stream)	Sí	No indicado
ISO 27001 (claimed)	Sí	Sí
Dutch sales entity	No indicado	Sí
Multi-CDN (4 partners)	No indicado	Sí
Origin shield (AMS + WDC)	No indicado	Sí
Portal + REST API	No indicado	Sí

bunny.net

Pull-zone CDN with Perma-Cache
Create a pull zone, attach an origin, and cache on the vendor-stated Standard network (119 PoPs) or the smaller Volume network (10 PoPs). Perma-Cache can store objects permanently on Edge Storage so the zone aims for a full cache hit ratio. Let's Encrypt, instant purge, Edge Rules, SafeHop origin retries, and real-time logs are part of the CDN product. Limit: this is a hosted network, not a self-hosted cache you run in your own racks.
EU Routing Filter for pull zones
Docs describe a Pricing and Routing toggle that sends all pull-zone traffic only through PoPs in EU member states (24 locations listed). Users outside the EU are also sent to those EU PoPs, which raises latency. The filter applies to CDN pull-zone traffic, not to the global DNS network. Combine this with EU storage regions if residency is the purchase filter.
Multi-region edge object storage
Bunny Storage is object storage you upload over FTP, SFTP, HTTP API, or the web file manager, then replicate to chosen regions. The Storage page lists 15 regions spanning EU, US, APAC, LATAM, and Africa, with standard HDD and SSD Edge tiers. Traffic from Storage into Bunny CDN is described as free of API request and API egress fees. You pick each replica region. A US replica is optional, not forced, but global CDN delivery can still cache copies at non-EU PoPs unless filtered.
Bunny Stream transcoding and player
Stream accepts uploads (including TUS resumable API), transcodes multiple resolutions, replicates video, and ships a customizable player or raw HLS. Token authentication, hotlink protection, watermarking, and optional Media Cage multi-DRM are documented product features. Encoding and the player are included in the Stream commercial model. If you enable Transcribe AI or related AI features, audio or prompts can be sent to OpenAI in the United States.
Signed URL tokens and access controls
Token authentication blocks pull-zone requests unless a signed token is present. Basic tokens use MD5 with expiry and optional IP checks. Advanced tokens use SHA256 and add geo restrictions, directory tokens, and speed limits. The same security toolbox includes geo-blocking and hotlink protection. Enabling token authentication disables IPv6 on that zone, per the docs.
Bunny Shield WAF and DDoS
Shield is a separate security product in front of the same edge: managed WAF rules, DDoS mitigation, global rate limits, bot controls, access lists, and upload scanning. Basic WAF rules are available on a free Shield tier. Custom rule counts and request allowances rise on paid tiers. It is not a substitute for Cloudflare Zero Trust or a full SOC platform.

Leaseweb CDN

Four-provider Multi-CDN (400+ PoPs claimed)
Leaseweb sells a managed mix of four unnamed third-party CDNs and claims more than 400 points of presence. One distribution CNAME (examples in docs: di-xxxx.leasewebultracdn.com, *.pr.lswcdn.net, *.vo.lswcdn.net) fronts the mix. Features are limited to the common subset all four support. You cannot pin a user to a specific PoP.
NS1 Pulsar Volume and Premium steering
Leaseweb says it connects partner performance to NS1 Pulsar real-user metrics. Volume tier chooses the most cost-effective partner at similar latency. Premium tier chooses on latency and quality of experience. Regional DNS logic can still send a whole region to a single partner when that path is faster.
Origin shields in Amsterdam and Washington, D.C.
Shield CDN distributions add a Leaseweb cache layer so partner edges do not all hit origin. Marketing states shields are included on Volume and Premium and sit in Amsterdam and Washington, D.C. Shields support multiple path policies, origin groups (up to 10 hosts, round-robin, consistent, sticky, or failover), and tokenized URLs. Wildcard invalidation is not supported on shields. A Multi-CDN invalidation does not clear the shield automatically.
HTTP, S3, and object-storage origins
Simple origins take a hostname or IP. AWS Signature Version 4 can authenticate S3-compatible buckets (Leaseweb Object Storage or AWS). Advanced origins (custom ports, subdirectory) work only behind shields and do not support Sig V4. Authenticated object storage cannot join an origin group. Each origin is HTTP or HTTPS exclusively, not mixed.
Portal, REST API, and raw logs to S3
Distributions, origins, certificates, and invalidations are managed in the Leaseweb Customer Portal (CDN menu, active contract required) or via the documented REST API on developer.leaseweb.com. Raw logs from all partners can be normalized to JSON and uploaded as .gz files to a customer S3 bucket. Leaseweb states logs are informational only and may be delayed or incomplete versus billing records.
Cache templates and edge ACLs
Web, live, and VoD templates set methods, TTL, compression, and stale-serve defaults. Operators can force CDN-controlled or origin-controlled cache, passthrough or static headers, geo blocking, IP-subnet blocking, and referrer allowlists. HTTP/2 is default on all partners. Gzip delivery compression applies only to files up to 20 MB. CORS Access-Control-Allow-Origin is stripped unless you passthrough or set it.

Assurance & compliance: bunny.net vs Leaseweb CDN
Assurance & compliance	bunny.net	Leaseweb CDN
Independent security / no-logs audit	Not found Vendor mentions continuous penetration testing in the ISO blog. No public independent no-logs or infrastructure audit PDF was found.	Not found Multi-CDN collects partner access logs (IP, URI, cache status) and can ship them to S3. No public independent audit of CDN logging or routing found.
ISO 27001	Vendor claimed September 2024 blog claims certification and links a UKAS cert-check URL. The registry page is JavaScript-only, so this draft does not mark verified. Trust Center also lists an ISO 27001 certificate. Human should open the live UKAS entry and confirm scope and expiry.	Vendor claimed ISO 27001:2022 via EY CertifyPoint for multiple entities including Leaseweb Netherlands B.V. and Leaseweb Global B.V. Published certified services omit CDN (bare metal, VPS, cloud, colo, web hosting, domains). Ask for SoA / CDN scope.
SOC 2 / SOC 3	Not found Trust Center text about reviewing vendor SOC 2 reports refers to BunnyWay's suppliers, not a BunnyWay SOC 2. No BunnyWay SOC 2/3 report found.	Partial SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability). Not a Multi-CDN report. Several entities have SOC 1 Type II (EY) covering cloud, dedicated, colo, and web hosting, not CDN.
GDPR / EU data protection	Vendor claimed EU entity; public GDPR page; processor role; log anonymisation claims; DPA in dashboard. Global PoPs and US subprocessors remain material.	Vendor claimed EU sales entities; privacy page states GDPR is taken into account. DPA in sales terms. Transfers to US entity via DPF (Leaseweb USA, Inc.). Multi-CDN partners unnamed.
US CLOUD Act exposure (indicative)	Partial EU entity and no known US parent. Exposure is medium because default CDN/storage maps include US regions and because Slack, OpenAI, MailChannels, SendGrid, Mixpanel, Salesforce, and Braintree sit on the account or feature path. Not legal advice.	Partial Dutch group, no known US parent, but path includes Washington, D.C. shields, Leaseweb USA, Inc., NS1 Pulsar, and four unnamed global partner CDNs. Assessment row, not a vendor claim. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Vendor says the DPA is in the customer panel. Trust Center lists a DPA document. Retrieve and review the signed version rather than relying on the marketing page.	Vendor claimed Vendor: DPA incorporated as Clause 8 of local sales terms; additional standalone DPA on request when appropriate. Confirm Multi-CDN partners and NS1 are scheduled.
EU AI Act	Not applicable Core product is CDN, storage, and streaming. Optional OpenAI-backed transcription, chatbot, and image generation exist as features, not as the primary product.	Not applicable Content delivery and traffic steering product, not an AI system offering.
PCI DSS	No indicado	Partial Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, WDC-02, SIN-01, Montreal). Not a card-data or CDN application control.
CISPE IaaS Code of Conduct	No indicado	Vendor claimed Company says it registered products with CISPE. Confirm whether Multi-CDN is on the public CISPE register.

Considerations & known limitations: bunny.net vs Leaseweb CDN
Considerations & known limitations	bunny.net	Leaseweb CDN
Default routing is global, including US and Moscow PoPs	Medium Without the EU Routing Filter, cached objects can sit at non-EU PoPs listed on the CDN map, including US cities and Moscow. The filter covers pull-zone traffic only and hurts latency for non-EU users.	No indicado
US-group account and feature subprocessors	Medium Support, mail, CRM, payments, product analytics, and optional AI features use Slack, OpenAI, MailChannels, SendGrid, Mixpanel, Salesforce, Braintree, and others. EU HQ does not isolate account data from those vendors.	No indicado
ISO 27001 not independently opened in this draft	Low The company publishes a UKAS link and a Trust Center certificate. This agent draft could not read the JavaScript registry page, so the checklist stays at claimed until a human confirms scope and dates.	No indicado
Optional OpenAI path for Stream and support	Medium Transcription, Fluffee/support chat, and CDN AI image generation send data to OpenAI in the United States. Disable those features for workloads that cannot use a US AI processor.	No indicado
Narrower platform than Cloudflare	Low Shield and Edge Scripting exist, but this is still primarily a delivery, storage, and video stack. Do not expect feature parity with Cloudflare Workers or Zero Trust.	No indicado
Unnamed partner CDNs and NS1 in the data path	No indicado	High Delivery and RUM leave Leaseweb facilities. The four partners are not named on public product or legal pages. NS1 Pulsar steers requests. Treat as a multi-processor design until sales produces a current list and DPA schedule.
Washington, D.C. origin shield	No indicado	Medium Included shields are in Amsterdam and Washington, D.C. Enabling a shield can place origin-pull traffic in the United States even when the sales entity is Dutch. Live streaming docs also advise against shields for latency reasons.
ISO / SOC reports do not list CDN	No indicado	Medium Published ISO 27001 and SOC 1 service lists omit CDN. SOC 2 is Canada colocation only. Do not assume Multi-CDN inherits those reports without a scoped letter.
Features limited to partner intersection	No indicado	Medium No Multi-CDN URL tokens, no PoP pin, Gzip-only compression with a 20 MB cap, no MPEG-DASH Gzip, mixed origin HTTP/HTTPS unsupported, invalidation rate-limited. SSL and stats propagate on partner clocks.
Raw logs not billed as complete	No indicado	Low Partner logs shipped to S3 are informational. Leaseweb states they may be late or missing versus invoice counters. Do not use them as a legal completeness record.

Encaje

bunny.net

Best fit when

EU-headquartered teams that need a pull-zone CDN and can enable the EU Routing Filter when residency matters
Sites and APIs that want prepaid bandwidth billing without per-request CDN fees
Software, game, or firmware delivery that benefits from Perma-Cache and multi-region storage (see NZXT, System76, Nexus Mods case studies)
VOD or event video that can use Stream transcoding and the bundled player, without sending audio to OpenAI
Teams that want token-authenticated downloads, geo-blocking, and a separate Shield WAF on the same account

Poor fit when

Architectures built around Cloudflare Workers, Zero Trust, or Cloudflare as the primary application platform
Workloads with a hard ban on US-group subprocessors for billing, support, mail, or analytics
Buyers who need a self-hosted or open-source CDN they can run in their own data centers
Global audiences that must stay on the nearest PoP while also forbidding any non-EU cache (the EU filter trades latency for residency)
Regulated video that requires on-platform transcription without a US AI subprocessor

Consider instead when

When: You need Workers, Zero Trust, or a single US-scale security and compute control plane
Consider: Cloudflare
Cloudflare is US-headquartered. The tradeoff is platform breadth, not EU ownership.
When: Origin already lives on AWS and you need IAM, PrivateLink, or CloudFront contracts
Consider: Amazon CloudFront (with S3 or Media Services)
Bunny is faster to start for a standalone CDN plus Stream. It will not replace AWS account controls.
When: You want a European CDN peer that is not Cloudflare and bunny.net's US PoPs or US SaaS tools are disqualifying
Consider: KeyCDN or Myra Security (not yet in this catalog)
Re-check those vendors on their own legal and subprocessor pages. Do not assume they are cleaner.

Leaseweb CDN

Best fit when

Teams already on Leaseweb dedicated servers, object storage, or private cloud who want delivery on the same invoice
Media, ads, SaaS, or gaming publishers who want multi-CDN failover without four vendor contracts
Origins that can sit behind an Amsterdam or Washington, D.C. shield and pull over HTTP or HTTPS (or S3 with Sig V4)
Operators who will live with partner-subset features (HTTP/2, geo/IP/referrer ACLs, portal and REST API) rather than Workers-style compute
Buyers who can accept Volume (cost) versus Premium (QoE) steering instead of pinning a single CDN

Poor fit when

Organizations that require an EU-only edge with a public, named subprocessor list (partners are unnamed; WDC shield and NS1 are in path)
Sites that need signed URLs, a WAF, bot management, or edge functions on the same product
Teams that must purge thousands of URLs per minute or treat invalidation as the publish pipeline
Buyers who want a self-serve free tier or an open-source, self-hosted CDN
Workloads that need MPEG-DASH Gzip, mixed HTTP and HTTPS to one origin, or per-user PoP selection

Consider instead when

When: You need a single global edge with WAF, bot management, Workers, and a self-serve free tier
Consider: Cloudflare
US company. Broader edge platform. Different jurisdiction story.
When: You want CDN plus compute from one European infrastructure group and can diligence that group's own PoPs
Consider: OVHcloud
French operator. Own datacentres. Not a four-provider multi-CDN.
When: You mainly need EU origin compute and will add a CDN you can inventory yourself
Consider: Hetzner or Scaleway
Neither replaces Multi-CDN. They keep origin in EU facilities you can name.
When: You wanted Swiss-branded hosting with optional Cloudflare, not a multi-CDN fabric
Consider: Swissnode
Different product class. Optional Cloudflare on web plans.

Open questions for due diligence

bunny.net

Is the UKAS ISO 27001 entry still current, and what is the certified scope (which products and locations)?
Does the in-dashboard DPA include SCCs and a current annex that matches the public sub-processor list plus the longer privacy-policy vendor list?
Which products besides CDN pull zones honor an EU-only data path (Stream libraries, Shield logs, Optimizer, Edge Scripting)?
Can Mixpanel, Salesforce, SendGrid, or Slack be contractually excluded for a given account?
What is the legal relationship between BunnyWay d.o.o. and the UK and German hiring entities?
Is the Moscow PoP still active, and can it be excluded without the full EU filter?

Leaseweb CDN

What are the current four partner CDN legal names, and can they be listed in the DPA?
Can routing be constrained to EU (or named) partners and the Amsterdam shield only?
Is Multi-CDN in the current ISO 27001 statement of applicability?
Will Leaseweb sign a standalone DPA that covers NS1 Pulsar and each partner?
What is the current annual-commitment commercial offer (confirm on the official Multi-CDN page or with sales)?