100% EU. By design, not by toggle.
Your data lives on Dutch and German hardware, owned and operated by a Dutch company. No US parent, no US Cloud Act exposure, no surprises.
- EU infrastructure in the Netherlands and Germany
- Dutch-owned since 2012
- GDPR-aligned by design
100% EU-owned, EU-hosted and EU-operated, your data is never accessible under the US CLOUD Act.
US-controlled cloud providers cannot guarantee EU data sovereignty
- The US CLOUD Act can compel American companies to hand over data, even on European servers.
- For public sector, healthcare and legal organisations, that conflicts with GDPR and sectoral law.
- Organisations need to know exactly who can see their data.
- Owned by a Dutch company and operated by Dutch staff on EU-owned infrastructure.
- A published subprocessor list, including where each one is established.
- Changes announced 30 days in advance, so you can review or object.
How sovereignty is guaranteed
vBoxx B.V. is a 100% privately held Dutch company with no foreign shareholders, no US parent, and no investment from non-EU funds.
Servers run in Tier-3 data centres owned by EU companies (TrueServer, Hetzner). No AWS, Azure or Google Cloud anywhere in the stack.
Support, engineering and operations staff are based in the Netherlands. No US-controlled subprocessors handle your data, full list published in our Trust Center.
Where sovereignty is non-negotiable
Dutch municipalities and German state agencies use vBoxxCloud for citizen data that cannot be exposed to non-EU jurisdictions.
vBoxxCloud can support NEN 7510 requirements for hospitals and clinics, with EU-only processing for patient records.
Law firms and M&A teams keep privileged material outside the reach of foreign data-access laws.
Sovereignty guarantees
- 100% Dutch-owned, no foreign shareholders
- EU-based engineering and support staff
- EU-only subprocessors, full list published
- EU-owned Tier-3 data centres (the Netherlands, Germany)
- No AWS, Azure or Google Cloud in the stack
- Annual independent ISO 27001 audit
True sovereignty vs 'EU region' marketing
- Outside the scope of US CLOUD Act and FISA 702
- GDPR Schrems II-compliant by default, no SCCs required
- Built to help meet the BIO and can support NEN 7510 requirements
- Operated by US-headquartered Microsoft Corp.
- Subject to CLOUD Act regardless of data location
- Partnership with EU partners but governed by US law
- Subprocessor list includes US entities
Frequently asked questions
The CLOUD Act allows US authorities to compel any US-based company to disclose customer data, including data stored on EU servers. Because vBoxxCloud has no US presence and no US subprocessors, it falls outside this jurisdiction.
Yes. Because no personal data is transferred outside the EU, no Standard Contractual Clauses or Transfer Impact Assessments are required. We provide a ready-made GDPR Article 28 DPA on request.
Yes. The full subprocessor list is published in our Trust Center and updated 30 days before any change. All subprocessors are EU-based.
vBoxxCloud is built to help Dutch government organisations meet the BIO. Our ISO 27001 certification covers many of the same controls. We do not currently hold a BSI C5 attestation. German public-sector customers can request our ISO 27001 certificate and security documentation.
We provide a GDPR Article 28 DPA covering EU-only processing. We can also review reasonable customer-supplied addenda as part of the contracting process.
You can export all data at any time. After contract termination we delete data within 30 days and provide a written deletion confirmation on request.