Skip to content
EuroVPSEuroVPS
Client area

EuroVPS policies

Security & Compliance

Independently certified

Our management systems are audited and certified by RIGCERT, a certification body accredited by ESYD, the Hellenic Accreditation System, a signatory of the European co-operation for Accreditation (EA) agreement. Every certificate is issued to Euclid Services Ltd, the company behind EuroVPS, with one scope: managed data center hosting service. Each is audited every year, and copies with the accreditation certificate of the issuing body are available on request.

ISO/IEC 27001:2022, with ISO/IEC 27017 and ISO/IEC 27018

Information security, for cloud services and the personal data in them.

ISO/IEC 27001 certifies how we manage information security: risk assessment, access control, operations security, supplier management, incident handling and continual improvement, all audited against the 2022 edition including its 2024 amendment. Our certificate also covers the controls of ISO/IEC 27017, security for cloud services, and ISO/IEC 27018, protection of personal data processed in cloud services. For you, that means the platform your data lives on, and the people who run it, are held to an audited security standard written for hosting providers.

Certificate 1710GR1330IS. Valid to 25 September 2027.

ISO 9001:2015

Quality management.

ISO 9001 certifies that the way we deliver and support our service is defined, measured and improved: documented processes, clear responsibilities, tracked customer feedback and corrective actions that are followed through. It is the reason our builds, migrations and support follow the same proven method every time, whoever is on shift.

Certificate 1710GR1330Q. Valid to 25 September 2027.

ISO 14001:2015

Environmental management.

ISO 14001 certifies that we manage the environmental side of running a hosting platform: efficient use of power and space, responsible handling of hardware across its whole life, and certified data erasure and recycling when equipment leaves service.

Certificate 1710GR1330E. Valid to 25 September 2027.

ISO 37001:2025

Anti-bribery management.

ISO 37001 certifies that we prevent, detect and respond to bribery: due diligence on partners and suppliers, clear rules on gifts and hospitality, financial controls and a way to raise concerns. Certified to the current 2025 edition, it gives procurement and compliance teams, including public-sector tenders, the integrity evidence they are asked to collect.

Certificate 1710GR1330AB. Valid to 29 September 2027.

Our datacenters carry their own

Alongside our certificates, the datacenters we operate in hold their own certifications, which we include in an assurance packet for your auditor on request.

Our datacenter operators hold PCI DSS attestations, and we support customers' own PCI DSS scopes with network segmentation, logging and hardening evidence.

GDPR

Data Protection

GDPR by design. A European-owned company; data at our Athens and Amsterdam sites stays inside the EU, on hardware we own. DPA and technical and organisational measures available on request.

Physical security

Digital Realty Athens

  • 24/7 on-site security personnel
  • Biometric access controls (fingerprint + badge)
  • CCTV surveillance with 90-day retention
  • Mantrap entry with two-factor authentication
  • Dedicated cages with individual locking
  • Redundant power (2N UPS + diesel generators)

Digital Realty Amsterdam

  • 24/7 on-site security personnel
  • Multi-layer access control (card + PIN + biometric)
  • CCTV coverage
  • Private cages with dedicated power feeds
  • Fire suppression (gas-based, server-safe)

Network security architecture

Perimeter Defense

Cisco Firepower next-generation firewalls with IPS/IDS, application visibility, and advanced malware protection at our datacenter edges.

Network Segmentation

EVPN/VXLAN fabric with per-tenant VRF isolation. Tenants are isolated at the network layer; there is no configured path between customer VRFs.

DDoS Mitigation

Traffic anomaly detection at the edge routers. Automated blackhole routing for volumetric attacks. Scrubbing capabilities for application-layer attacks.

Encrypted Transit

All inter-datacenter traffic encrypted with AES-256. DMVPN mesh with IPsec between all sites. WireGuard tunnels for high-throughput L2 extensions.

Backup and data protection

  • Daily automated backups, included with every managed server
  • Retention agreed per workload, with 30 days as the default
  • Offsite Replication: backups stored at a separate physical location
  • Unidirectional Data Flow: backup servers pull data; production cannot reach backups
  • Encrypted at Rest: all backup data encrypted on dedicated storage
  • Tested Recovery: restores tested as often as weekly

Server hardening, included

Every server we deploy goes through our hardening checklist before handover.

OS Hardening

SELinux enforcing, kernel parameters tuned, automatic security updates configured.

Access Control

SSH key-only authentication, root login restricted, fail2ban configured.

Quarterly Audits

Regular security reviews of your server configuration, patch status, and access logs. Findings reported with remediation steps.

Need compliance documentation?

We provide DPA agreements, technical measures documentation (Art. 32 GDPR), and ISO certification copies upon request.