Where your data is stored, who can be compelled to hand it over, and what a certificate actually proves are three different questions. This guide separates them and gives you 10 questions to ask any cloud provider.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). A company that holds the certificate has shown, through an audit by an independent certification body, that it identifies information security risks and manages them in a structured, documented and continuously improving way.
Three things are worth knowing before you rely on a certificate. First, it covers a defined scope: check that the services and sites you will use are inside it. Second, it is not a guarantee that incidents never happen; it shows that the process is in place. Third, certificates run for three years with surveillance audits in between, so check the validity dates and the name of the certification body.
| Term | The question it answers | Why it matters |
|---|---|---|
| Data residency | In which country are the servers? | Decides which physical location and local law applies to the hardware. Backups and metadata count too. |
| Data sovereignty | Whose laws can reach the data? | Data can sit in the EU and still be subject to foreign law if the provider is headquartered elsewhere. |
| Jurisdiction and ownership | Who owns and operates the provider? | The US CLOUD Act, for example, lets US authorities request data from US-headquartered providers wherever it is stored. |
This is general information, not legal advice. Ask your legal counsel or data protection officer to assess your situation.
Use these questions in a tender, a security review or a supplier assessment. A provider who has done the work answers them in writing.
The Netherlands has dense connectivity, a large datacenter market and an Autoriteit Persoonsgegevens that supervises the GDPR. For a European company the practical advantage is simple: data stays under EU law and close to the internet exchanges that move your traffic.
These are the sites vBoxx uses. Two are in the Netherlands and one is in Germany for disaster recovery.
| Site | Operator and location | Role | Certifications |
|---|---|---|---|
| AMS-1 | maincubes AMS01, Schiphol-Rijk (NL) | Primary region: production storage and compute | ISO/IEC 27001:2017, ISO 9001, ISO 14001, ISO 50001, SOC 1 and SOC 2 |
| NLD-1 | Greenhouse Datacenters, Naaldwijk (NL) | Secondary region: synchronous replica and backups | ISO/IEC 27001, ISO 9001, ISO 14001, PCI-DSS, ISAE 3402 |
| FRA-1 | maincubes FRA01, Frankfurt (DE) | Disaster recovery and EU-DE region | ISO/IEC 27001:2017, ISO 9001, ISO 14001, ISO 50001, DIN EN 50600, SOC 1 and SOC 2 |
Source: operator documentation, see our datacenters page.
vBoxx itself is certified, not only the datacenters. Download the certificate (PDF).
Data, metadata, backups and support tooling stay inside the EU. No US CLOUD Act exposure.
Available for all services. See legal documentation.
Files in vBoxxCloud are encrypted in transit and at rest.
100% renewable or green electricity at all three sites. See green hosting.
Ask us for the Statement of Applicability or a security questionnaire and we will help.
No. ISO 27001 certifies an information security management system. It supports the GDPR requirement for appropriate security, but it is not a GDPR certificate. You still need a data processing agreement and a lawful basis for processing.
Check the company name, the scope, the validity dates and the certification body. Ask whether the services and sites you will use are inside the scope. Certification bodies often publish their issued certificates.
Not necessarily. If the provider is headquartered outside the EU, foreign law such as the US CLOUD Act can apply to data it controls, wherever it is stored. Ownership and operator matter as much as location.
The Netherlands combines EU legal protection, strong connectivity (AMS-IX) and a mature datacenter market. vBoxx uses sites in Schiphol-Rijk and Naaldwijk, with a disaster-recovery site in Frankfurt.
Need the certificate or a security questionnaire answered?
Talk to us about hosting that stays in Europe.