You can present our certification to your auditors to verify quickly and easily that the services provided by LeaseWeb meet the very latest requirements.

How the LeaseWeb Trust model works

The LeaseWeb Trust model uses our portfolio of services, expectations from external and internal stakeholders, and risk assessment workshops as the foundation and starting point of our compliance approach. Based on these inputs we created one custom framework which is divided into building blocks (right column) and the different industry standards (top row).

 

With this multi-audit approach we use the “test-once test-many” principle. It enabled three independent audit firms to work closely and made it location and LeaseWeb company independent. But more importantly it provides a completely custom tailored framework that aligns with our services, business needs and risk landscape – as well as with your expectations as a customer. Every building block is now covered and independently audited by at least one certification/assurance report.

 

LeaseWeb Trust Model
* Full documentation can be read on https://kb.leaseweb.com.

 

Overview per independent LeaseWeb company

Certificates / assurance reportsLeaseWeb Netherlands B.V.LeaseWeb Deutschland GmbHLeaseWeb USA, Inc.LeaseWeb Asia Pacific Pte. Ltd.
ISO 27001ISO 27001:2013ISO 27001:2013 ISO 27001:2013 ISO 27001:2013 
SOC1 SOC1 Type II SOC1 Type II SOC1 Type II SOC1 Type II 
PCI DSSAMS-01 DC
AMS-10 DC
Data center FRA-10Data center WDC-01Data center HKG-10
Data center SIN-11
HIPAA  HIPAA 
NEN 7510NEN 7510:2011   

The building blocks of the LeaseWeb Trust Model

Normally, SOC1 is associated with financial controls but, given the type of our business we broadened the remit of our assurance reports to reflect our close connection with IT issues. This also enhances their relevance to our customers and their operations.

 

Objective areaObjective description
Logical securityControls provide reasonable assurance that logical security is appropriately implemented, administered and logged to safeguard against unauthorized access to or modifications of the customer portal that our clients are using to administer their infrastructure and administration.
Physical securityControls provide reasonable assurance that physical access to the data centers is restricted to authorized individuals to prevent unauthorized use, disclosure, modification, damage or loss of data.
Service deploymentControls provide reasonable assurance that services to clients are appropriately deployed and managed to ensure a timely and standardized delivery.
Customer supportControls provide reasonable assurance that the customer support teams timely and effectively act on client’s infrastructure problems to minimize service disruptions.
Incident managementControls provide reasonable assurance that incidents on the shared infrastructure are appropriately managed, resolved and analyzed to minimize disruption and impact of the services.
Change managementControls provide reasonable assurance that changes on the shared infrastructure are appropriately managed to minimize the disruption and impact of the services.
Operational resilienceOperations are appropriately managed to safeguard the data center facilities to avoid and minimize service disruptions.