STRATO
Cloud infrastructure · strato.de · last read 2026-11-09
At a glance
- Is STRATO GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what STRATO itself publishes, each answer linked to its source and the date we read it.
- Does STRATO have a data processing agreement (DPA)?
- Yes. STRATO publishes a data processing agreement at strato.de. It describes how a new subprocessor is announced but states no notice period. It promises breach notification "without undue delay", with no number of hours. Source and date
- Is STRATO ISO 27001 certified?
- STRATO states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. In STRATO's words (in German): “Die jährlich unabhängig ausgeführte TÜV-Zertifizierung nach DIN ISO 27001 belegt die höchsten Sicherheitsstandards von STRATO.” We read this on 2026-11-09. Source and date
- How does STRATO transfer personal data out of the EU?
- STRATO's agreement relies on the EU standard contractual clauses. Source and date
- Does STRATO offer EU data residency?
- The EU is the default region for this vendor. Source and date
- Who are STRATO's subprocessors?
- STRATO lists 14 third-party subprocessors; 4 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
- How do you report a security vulnerability to STRATO?
- STRATO publishes a security.txt at www.strato.de naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | STRATO GmbH |
|---|---|
| HQ | DE |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 391200NI7XX02EZ49K32 |
| US CLOUD Act reach | Not determined from the sources read |
| Source | strato.de · 2026-11-09 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
STRATO data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | strato.de | 2026-11-09 |
EU: STRATO's security page says its data centres are in Germany ("Hosted in Germany"). For V-Server the customer can pick the server location when ordering: Germany, Spain or France. No plan or price is attached.
The same question for every vendor: where SaaS vendors store EU data.
Other European cloud providers, their registers and certifications: sovereign clouds.
Subprocessor chain
14 third parties · 4 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Acronis Germany GmbH | DE | Betrieb und Support Backup Produkt |
| Dropsuite Ltd. | SG | Entwicklung, Wartung, Pflege und Betrieb der STRATO Mail-Archivierungsoftware |
| Eleven GmbH | DE | Spamfilter für E-Mail |
| ePages GmbH | DE | Entwicklung, Wartung und Pflege der Webshopsoftware |
| Hewlett-Packard GmbH | DE | Support für eine V-Server-Plattform |
| IONOS SE | DE | Bereitstellung, Betrieb und Wartung von Produkten (AutoUpdater, Mail-Archivierung Umgebung, Server/Cloud-Plattform, KI-gestützter Telefonassistent) |
| Open-Xchange GmbH | DE | Nutzung von OX App Suite und OX Premium Postfächern |
| Plesk International GmbH | CH | Bereitstellung der Server Administrations Software PLESK |
| rankingcoach GmbH | DE | Anwendungen zur Verbesserung der Sichtbarkeit einer Website in Suchmaschinen |
| ServerGuard24 GmbH | DE | Betrieb eines Monitoring Services für dedizierte und virtuelle Server |
| SiteLock, LLC | US | Erkennung und Beseitigung von Malware |
| Virtuozzo International GmbH | CH | Virtualisierungssoftware für V-Server inklusive Support |
| Voiceable GmbH | DE | Bereitstellung eines KI-gestützten Telefonassistenten für Sprachinteraktionen in der Telefonumgebung |
| we22 Solutions GmbH | DE | STRATO Homepage-Design-Service; Entwicklung, Wartung und Pflege des Homepagebaukastens |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-11-09 · strato.de
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | Vendor informs the customer of an intended addition or replacement of subprocessors; no notice period or method stated |
| If you object to one | Customer may object for an objective reason within 14 days of receiving notice; vendor may then either provide the service without the change or, if that is unreasonable for the vendor, stop the affected service after at least 14 days, at which point the customer stops paying for it |
| Breach notification | without undue delay |
| Audit | Vendor provides information to show compliance and allows audits/inspections by the customer or its auditor (NDA may be required; competitors can be refused). The ISO 27001 certificate is normally enough. On-site checks only where there are justified doubts or a breach incident, during business hours and usually with advance notice. Vendor may charge a reasonable fee unless the vendor breached the law or the contract. |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Is STRATO ISO 27001 certified?
STRATO states ISO/IEC 27001 on its own page, but does not say there how to get the certificate. We read this on 2026-11-09.
- Claimed “Die jährlich unabhängig ausgeführte TÜV-Zertifizierung nach DIN ISO 27001 belegt die höchsten Sicherheitsstandards von STRATO.” (in German)
Source: strato.de, 2026-11-09
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| DSGVO · GDPR | Claimed | STRATO als Internet-Service-Provider seit 2018 | strato.de | 2026-11-09 |
| DIN ISO 27001 · ISO27001 | Claimed | Rechenzentren von STRATO; jährlich unabhängig ausgeführte TÜV-Zertifizierung | strato.de | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | STRATO GmbH · STRATO GmbH | ISSUED | DE | 2027-02-09 | 2026-11-09 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under STRATO; STRATO GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under STRATO; STRATO GmbH
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under STRATO; STRATO GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under STRATO; STRATO GmbH
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under STRATO; STRATO GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under STRATO; STRATO GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2028-02-10; read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-11-09 |
| dpa | Public | full | 200 | 2026-11-09 |
| residency | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.