Security, privacy & compliance no asterisks
A Dutch company, an EU-only stack, and the paperwork your security team needs, all on one page.
EU-only data residency
All customer data is stored in Tier-3 datacentres in the Netherlands and Germany. No replicas leave the EU, ever.
ISO 27001 certified
Our ISMS follows ISO 27001. Annual third-party audit reports available under NDA.
Encryption everywhere
AES-256 at rest, TLS 1.3 in transit, per-tenant key separation. Customer-managed keys on Enterprise.
MFA built in
TOTP, WebAuthn and hardware-key MFA included on every plan.
Full audit trail
Every read, write, share and admin action logged for 365 days. Export to SIEM via webhook.
99.95% uptime SLA
Status page with historical data. Credits issued automatically on SLA breaches.
Owned hardware, audited racks, EU operators
vBoxxCloud runs on bare metal we own, hosted in Tier-3 datacentres in the Netherlands and Germany operated by EU citizens. No hyperscaler dependency means no CLOUD Act, no FISA 702, no Schrems-style headaches.
- Biometric access, 24/7 guarded, N+1 power & cooling
- Per-tenant encryption keys, isolated storage pools
- Daily off-site backups inside the EU, 30-day retention
Granular policies, no surprises
Set link-expiry defaults, allowed download domains, geo restrictions and password requirements org-wide. Override per team when you need to.
Certification & Compliance
ISO/IEC 27001 certified hosting
vBoxx operates an Information Security Management System (ISMS) audited and certified by TÜV NORD CERT in accordance with ISO/IEC 27001, the international standard for information security. The original certificate can be downloaded below.
27001
Sub-processors
We use the smallest possible vendor list. Every sub-processor is contracted, GDPR-bound and EU-located.
| Vendor | Purpose | Location |
|---|---|---|
| maincubes AMS01 (Amsterdam) | Datacentre 1, primary | NL |
| Greenhouse Datacentres (Naaldwijk) | Datacentre 2, secondary | NL |
| maincubes FRA01 (Frankfurt) | Datacentre 3, DR / EU-DE region | DE |
| Fiberring (Amsterdam) | Connectivity / transit | NL |
| Worldstream (Naaldwijk) | Connectivity / transit | NL |
| euNetworks (Frankfurt) | Connectivity / transit | DE |
| Matomo (self-hosted) | Privacy-friendly analytics | NL |
| HetrixTools | External uptime monitoring (no customer data, public endpoints only) | EU |
Documents
Agreements and certificates.
Privacy means people know what they're signing up for, in plain language, and repeatedly.