| Independent security / no-logs audit | ❌Not foundVendor describes internal pentests and a HackerOne-style responsible disclosure programme. No public independent audit PDF found. | ❌Not foundIaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports. |
|---|
| ISO 27001 | ⚠️Vendor claimedTrust Center and security article claim ISO/IEC 27001:2022. Certificate download requires Trust Center access. Not independently verified here. | ⚠️Vendor claimedVendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass. |
|---|
| SOC 2 / SOC 3 | ❌Not foundNo public SOC 2 or SOC 3 report found on Trust Center overview or legal pages. | ⚠️PartialSOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting. |
|---|
| GDPR / EU data protection | ⚠️Vendor claimedEU/UK/Luxembourg contracting entities; privacy policy cites GDPR; DPA includes EU SCCs and UK addendum. Confirm entity on the invoice. | ⚠️Vendor claimedNL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions. |
|---|
| US CLOUD Act exposure (indicative) | ⚠️PartialEuropean group, no known US parent. Exposure is medium because customers may select US data centers and the DPA names US-group processors (AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint). Not legal advice. | ⚠️PartialDutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice. |
|---|
| Data processing agreement (B2B) | ⚠️Vendor claimedPublic DPA incorporated into the Terms of Service. Parties: Hostinger International Ltd, Hostinger UK Limited, or Hostinger Global S.a r.l. | ⚠️Vendor claimedPrivacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4). |
|---|
| EU AI Act | —Not applicableCore product is hosting. Horizons, Kodee, and Reach are AI features inside that product, not an AI-centric system of record. | —Not applicableIaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product. |
|---|
| HIPAA / PCI environment | —Not applicableHosting agreement: services are not intended to provide a PCI or HIPAA compliant environment. | Non indiqué |
|---|
| PCI DSS | Non indiqué | ⚠️PartialVendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default. |
|---|
| NEN 7510 | Non indiqué | ⚠️Vendor claimedVendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer. |
|---|
| CISPE IaaS Code of Conduct | Non indiqué | ⚠️Vendor claimedHistorical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass. |
|---|