Leaseweb vs TransIP

IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.

IaaS/hosting provider, not a no-logs VPN. Assurance is via ISMS certifications and responsible disclosure (Intigriti), not a public no-logs audit.

Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.

Vendor publishes ISO 27001:2022 PDF (team-blue-nl-bv naming). Independent registry re-check not completed in this draft.

SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.

No clear TransIP product-level SOC 2/3 claim found on primary legal/security pages reviewed.

NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.

Dutch controller/processor entity; privacy policy and control-panel DPA. Residency depends on selected product/zone.

Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.

EuropeanStack assessment: Dutch entity / no known US parent / NL-first hosting, but privacy names Google Analytics, reCAPTCHA, and PayPal, and OpenStack KB names Equinix colo. Not a vendor safety claim. Not legal advice.

Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).

Processor agreement available to view/accept in the control panel per knowledge base.

IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.

Infrastructure hosting/registrar; not marketed as an AI system provider. Optional third-party AI assistant images on VPS are customer-chosen workloads.

Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.

Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.

Vendor publishes NEN 7510:2017 certificate PDF; accounts processing medical data can be marked for extra handling per cert page.

Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.

NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).

ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.

Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

Brand is TransIP B.V.; certificates use team.blue NL B.V. Procurement should map the exact contracting entity, DPA signatory, and cert scope to the services purchased.

Privacy policy discloses Google Analytics, reCAPTCHA, and PayPal. These are not described as the VPS storage backend, but they affect overall vendor diligence and CLOUD Act style questionnaires.

OpenStack facility list includes Equinix AMS3 (US-parent colo operator). Workloads remain in Amsterdam physically; treat as partial EU-hosted diligence, not AWS-region hosting.

No broad multi-continent region map or hyperscaler-class managed database suite on the pages reviewed. Teams needing those should plan self-managed stacks or another cloud.

Diligence relies on privacy policy, product pages, and DPA rather than a dedicated exhaustive subprocessor HTML table. Request an up-to-date schedule under NDA if required.