Date: 2026-09-02
Scope: Dutch/EU data-sovereignty analysis for a Dutch financial-audit SaaS at MVP/pre-revenue stage
Status: Research only — no hosting changes proposed
Athena runs on a self-hosted k3s cluster on a single Leaseweb VPS (IP block 136.144.174.0/24, registered to AS60781 LeaseWeb Netherlands B.V.). The kubectl context is named transip-k3s but the IP block is definitively Leaseweb Netherlands. The data center is AMS-01 (Haarlem, Noord-Holland).
Security controls already in place (as of September 2026):
| Control | Status |
|---|---|
| TLS everywhere (Let's Encrypt, cert-manager) | ✅ Enforced |
| k3s NetworkPolicy enforcement | ✅ Active |
| Egress-restricted NetworkPolicy (DNS + postgres only) | ✅ Deployed |
| Non-root containers, runAsUser: 1000 | ✅ Enforced |
| Read-only root filesystem | ✅ Enforced |
| All Linux capabilities dropped | ✅ Enforced |
| SealedSecrets (1Password-backed) | ✅ In use |
| Two-user PostgreSQL (admin/Flyway + DML-only app role) | ✅ In use |
| Field-level AES-256-GCM encryption for sensitive data | ✅ Implemented |
| Trivy container image scanning in CI | ✅ Active |
| XSS/XXE/zip-bomb hardening in parsers | ✅ Implemented |
| Secret scanning in CI | ✅ Active |
Source: Leaseweb Knowledge Base — Compliance and Security Certifications
| Certification | Entity | Scope | |---|---|---| | ISO/IEC 27001:2022 | Leaseweb Netherlands B.V. | VPS, bare metal, private cloud, colocation — certified by EY CertifyPoint | | NEN 7510 | Leaseweb Netherlands B.V. | AMS-01 data center (Haarlem) | | PCI DSS v4.0 | Leaseweb Global B.V. | Physical security at AMS-01 | | SOC1 Type II | Leaseweb Netherlands B.V. | Logical/physical security, incident management | | ISO 27017 (cloud security controls) | Not held | — | | ISO 27018 (cloud PII protection) | Not held | — |
Leaseweb Netherlands B.V. is Dutch-incorporated. The AMS-01 data center is in Haarlem, the Netherlands. Leaseweb does not fall under the US CLOUD Act (unlike AWS, Azure, and GCP European regions, which are subsidiaries of US entities subject to US government data requests). Data processed on the Athena VPS stays in the Netherlands under Dutch and EU law.
NEN 7510 is a Dutch national standard for information security in healthcare (patient records, BSN numbers). It is legally mandated under the Wabvpz for healthcare providers since 2008 and extended to hospitals by 2023.
NEN 7510 is not legally required for Dutch financial-audit data. Dutch accountancy data is governed by:
That said, Leaseweb's NEN 7510 certification signals a mature ISMS and a security bar above the minimum ISO 27001 baseline — a positive indicator even outside the healthcare context.
ISO 27017 adds cloud-specific controls to ISO 27001 (e.g. shared responsibility clarity, customer data deletion procedures). ISO 27018 adds PII-specific controls for cloud processors.
Leaseweb does not hold these certifications. For a self-managed k3s deployment this is a partial gap: since Athena manages its own k8s control plane, the cloud-service responsibility model is less relevant (Leaseweb only provides the bare VPS). The gap matters more if Athena were using Leaseweb's managed cloud services directly.
| Requirement | Current Status | |---|---| | Data stored in EU/EEA | ✅ Netherlands (AMS-01) | | Hosting provider ISO 27001 certified | ✅ Leaseweb Netherlands | | TLS in transit | ✅ Enforced | | Encryption at rest (field-level) | ✅ AES-256-GCM implemented | | Verwerkersovereenkomst (DPA agreement) with hosting provider | ❓ Needs to be in place with Leaseweb | | Not subject to non-EU jurisdiction (CLOUD Act, FISA) | ✅ Dutch entity | | Adequate breach detection / logging | ⚠️ Partial — no runtime IDS yet | | Disk-at-rest encryption at VPS level | ❓ Needs confirmation via Leaseweb control panel |
These do not require a hosting migration:
Confirm VPS disk encryption. Leaseweb's VPS offering may or may not enable disk-at-rest encryption by default. Verify in the Leaseweb control panel. If not active, this is the single most impactful remaining gap for data-at-rest.
k3s etcd encryption at rest. k3s supports --encryption-provider-config to encrypt Kubernetes Secrets (including SealedSecret contents before unsealing) stored in etcd. Enabling this closes the disk-dump attack surface.
Runtime security monitoring. Adding Falco to the k3s cluster provides rule-based alerting on anomalous container behavior (unexpected syscalls, privilege escalation attempts). Falco has a Helm chart and negligible resource overhead.
Dedicated domain. Running production on app.athena.glorylabs.nl (a shared glorylabs.nl subdomain) presents a trust issue with clients. A dedicated athena.nl or athena.io domain signals professional ownership and allows independent TLS certificate management.
Formalize the DPA agreement with Leaseweb. Under GDPR Art. 28, a data processing agreement with the hosting provider is required where they process personal data on your behalf. Leaseweb provides a standard DPA — ensure it is signed and on file.
The current Leaseweb setup is adequate for a Dutch financial-audit MVP with appropriate supplementary technical controls. The critical boxes (EU data residency, ISO 27001 certified provider, Dutch-sovereign entity, TLS, field encryption, pod hardening, NetworkPolicy) are checked. The remaining gaps (disk encryption confirmation, etcd encryption, runtime monitoring, DPA formalization) are addressable on the current infrastructure without a hosting change.
This section surveys realistic alternatives for context, not as an immediate recommendation.
cyso.cloud/trust-centre | cyso.cloud/services/managed-kubernetes
| Criterion | Leaseweb (current) | Leaf.cloud | Cyso Cloud | OVHcloud | |---|---|---|---|---| | ISO 27001 | ✅ (2022) | ✅ | ✅ | ✅ | | NEN 7510 | ✅ (AMS-01) | ❌ | ✅ | ❌ | | Dutch-owned entity | ✅ | ✅ | ✅ | ❌ (French) | | No CLOUD Act | ✅ | ✅ | ✅ | ✅ | | Data in Netherlands | ✅ | ✅ | ✅ | ✅ (opt-in) | | Managed Kubernetes | ❌ (self-hosted k3s) | ✅ | ✅ | ✅ | | Managed PostgreSQL | ❌ | ❌ | ❌ | ✅ | | Estimated monthly overhead vs current | €0 | +€85+/month | Quote needed | ~€0 for control plane | | KCSP certified | ❌ | ❌ | ✅ | N/A |
Stay on the current Leaseweb VPS. The provider has genuine, verified certifications (ISO 27001:2022, NEN 7510 at AMS-01) that satisfy the applicable regulatory environment for Dutch financial-audit data (GDPR/AVG, AP guidelines for accountants). The hosting is Dutch-sovereign, data stays in the Netherlands, and the cost is appropriate for the project's stage.
Execute the following hardening steps on the current infrastructure (no migration required):
--encryption-provider-config) for Kubernetes Secrets.Evaluate Cyso Cloud as the upgrade path if either condition is met:
The migration effort (Helm chart adaptation, PVC migration, CI/CD pipeline update) is roughly a 2–3 day engineering effort once Athena has capacity for it.
Migrating to a managed Kubernetes provider now adds €80–150+/month in platform overhead, CI/CD migration work, and operational complexity — none of which improves the security posture meaningfully over the hardened Leaseweb setup. The current provider already holds the relevant certifications. A migration is a business decision (SLA guarantees, client-facing compliance narrative), not a technical security necessity at this scale.
Reacties