Loading the catalogue…
IONOS AI Model Hub
L1 · European-hosted
ionos-ai-model-hubGermanyEurope
Open-model inference from IONOS (United Internet) over an OpenAI-compatible API, run in IONOS's own German data centres. The DPA commits processing to the EU/EEA.
Compliance posture · Stav's assessment
Jurisdiction
EU · Germany
Data residency
EU
CLOUD Act / FISA 702
Not exposed
Stav sovereignty level
Stav's assessment
Five dimensions
Serving residency
Strong
Legal exposure
Strong
Serving retention
Strong
Security posture
Weak
Contractual posture
Strong
Bands only. The scores and Stav's notes per dimension are read in the workspace.
Customers only
The full assessment
Stav's narrative, every risk item with its source, the safeguards that offset them and the privacy-policy issues found: the part of the page a procurement review runs on.
Stav's narrative · 2 risk items · 7 safeguards · 2 privacy-policy issues · DPA, terms, privacy policy — sign in to read them.
Traffic through Stav is covered by Stav's customer DPA, which lists Stav's sub-processors.
Stav's serving-side assessment, compiled from the provider's published documentation and Stav's operational review. Last reviewed 17 Oct 2026. An assessment, not a guarantee or regulatory determination. Confirm against the provider's own documentation before contracting.
Sovereignty ladder · how the level was reached
L1European-hostedIndicativeregistry 4.1
This level applies to traffic routed through Stav.
IONOS Cloud GmbH, a German company owned through German SEs by United Internet AG, is at L1. L2 is blocked because BSI C5 is a Type 1 attestation and the ISO 27001 / IT-Grundschutz certificate may not name IONOS Cloud GmbH after the June 2026 spin-off.
One criterion from L2: Independently audited security certification.
Stav's own assessment against criterion registry 4.1. Indicative, not an official recognition, which only a national authority can confer. Criteria follow the proposed Cloud and AI Development Act and are expected to change. “Union” reads as EU/EEA at every rung. CADA itself still says “in the Union”: until the Act is incorporated into the EEA Agreement, a Norwegian, Icelandic or Liechtenstein route does not evidence formal Union assurance for an EU public-sector buyer. UK and Swiss providers are capped at L1.
Verified 17 Oct 2026About the ladder →Certifications & legal documents · the provider's own facts
BSI C5 (Type 1)
BSI C5:2020 Type 1 attestation for cloud service clusters, including AI and analytics · Claimed by the provider
BSI IT-Grundschutz (ISO 27001 on the basis of IT-Grundschutz)
IONOS information security management system based on BSI IT-Grundschutz, certified since September 2022. · Claimed by the provider
ISO/IEC 27001
Information security management for data center infrastructure and cloud services · Claimed by the provider
“Claimed by the provider” means the provider states the certification. Stav has not seen the certificate or report.
Terms of servicepublished
Privacy policypublished
Data processing agreement (DPA)published
Sub-processor listnot published
Links to every document and certificate — 3 legal documents, 3 certification sources
Compiled by Stav from the provider's published documentation. Last verified 17 Oct 2026. Reflects what the provider states, not a Stav guarantee or regulatory determination. Confirm against the provider's own pages before contracting.
Endpoints served · 2
| Model | Input / M | Output / M | TTFT | Tok/s |
|---|---|---|---|---|
| Llama-3.3-70B-Instruct | €0.65 | €0.65 | 0.32 s | 46 |
| gpt-oss-120b | €0.15 | €0.65 | 0.22 s | 143 |