Aruba Cloud vs Cyso Cloud

Compare Aruba Cloud and Cyso Cloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Aruba Cloud

Italy· Cloud Computing

Needs review

Shortlist Aruba Cloud when you need Italian-entity IaaS with OpenStack public cloud, VMware private cloud (Pinnacle Partner), bare metal/GPU, and ACN-oriented PA packaging on proprietary EU campuses. Skip when you need hyperscaler global breadth or a fully public subprocessor directory—consider OVHcloud or Scaleway instead for multi-country European IaaS with different tradeoffs.

EU-operated (IT)OpenStack public cloudVMware Pinnacle PartnerISO 27001 (claimed)ACN-qualified (claimed)Proprietary EU data centers

View listing Visit Website

Cyso Cloud

Netherlands· Cloud Computing

Needs review

Shortlist Cyso Cloud when you want Dutch-operated OpenStack IaaS and KCSP managed Kubernetes with AMS/FRA residency and engineer-to-engineer support. Skip when you need global hyperscaler regions or default encryption-at-rest object storage—consider OVHcloud or Scaleway for broader European multi-region IaaS, or keep a hyperscaler for worldwide PaaS depth.

EU-operated (NL)OpenStack IaaSManaged Kubernetes (KCSP)AMS + FRA regionsISO 27001 (claimed)NEN 7510 (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

Aruba Cloud vs Cyso Cloud: Snapshot
Feature	Aruba Cloud	Cyso Cloud
Country of origin	Italy	Netherlands
Category	Cloud Computing	Cloud Computing
Open source	No	Yes
Self-hosted	No	No
Headquarters	Italy	Netherlands
Legal entity	Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy; VAT IT01573850516	Cyso B.V. (part of Cyso Group B.V.), Wognumsebuurt 3, 1817 BH Alkmaar; KVK 37133395
Governing law	Italian law (Bergamo courts for non-consumers per T&Cs)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Primary compute on Aruba-owned data centers in Italy (Arezzo IT1/IT2, Bergamo IT3, Rome IT4) and Czech Republic (Prague CZ1, Ktiš CZ2). Partner availability zones: Paris FR1, Frankfurt DE1, London UK1, Warsaw PL1. Customer chooses region. Full subprocessor list not public—available on request under processor terms. Optional multi-cloud interconnection to other public clouds for hybrid designs.	Primary public IaaS on Cyso-operated hardware in Tier 3 facilities in Amsterdam and Frankfurt (3 AZs per region); vendor states storage replicas/backups stay in the selected EU region. Not marketed as AWS/Azure/GCP-hosted IaaS. Ancillary tools disclosed at group level include website analytics (PostHog) and third parties for payments/support; status tooling has referenced Atlassian Statuspage. Full public customer-workload subprocessor list not found.
Summary	Italian sovereign cloud from Aruba S.p.A.: OpenStack public cloud, VMware private cloud, bare metal/GPU, Kubernetes, and storage on proprietary European data centers—strong fit for Italian PA and EU residency-minded IT.	Dutch OpenStack IaaS from Cyso B.V. with AMS/FRA regions, managed Kubernetes (KCSP), S3-compatible object storage, and EU data residency for teams avoiding hyperscaler lock-in.
Tags	cloud sovereign-cloud openstack kubernetes gdpr infrastructure vmware bare-metal enterprise	cloud sovereign-cloud openstack kubernetes gdpr iaas netherlands eu-hosting

At a glance: Aruba Cloud vs Cyso Cloud
At a glance	Aruba Cloud	Cyso Cloud
HQ	Ponte San Pietro (BG), Italy	Alkmaar, Netherlands
Legal entity	Aruba S.p.A.	Cyso B.V. (Cyso Group)
Founded	1994 (group)	1997 (group); public OpenStack cloud since 2016 (Fuga); Cyso Cloud brand 2025
Hosting	Proprietary IT + CZ DCs; partner FR/DE/UK/PL	Not listed
Core stack	OpenStack, VMware, bare metal, K8s	Not listed
Commercial model	Prepaid credit / pay-as-you-go; no free tier	Pay-as-you-go / hourly; optional trial via sales
Open source product?	No (uses OSS components e.g. OpenStack)	Not listed
Self-hosted?	No (provider-managed cloud/DC)	Not listed
Regions	Not listed	Amsterdam, Frankfurt (more under investigation)
Stack	Not listed	OpenStack + managed Kubernetes (KCSP)

Key capabilities: Aruba Cloud vs Cyso Cloud
Key capabilities	Aruba Cloud	Cyso Cloud
EU-operated (IT)	Yes	Yes
OpenStack public cloud	Yes	Yes
VMware Pinnacle Partner	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
ACN-qualified (claimed)	Yes	Not listed
Proprietary EU data centers	Yes	Not listed
Managed Kubernetes (KCSP)	Not listed	Yes
AMS + FRA regions	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
NEN 7510 (claimed)	Not listed	Yes

Aruba Cloud

OpenStack public cloud + CMP
Self-service Cloud Servers and Virtual Data Centers on OpenStack with AMD/NVMe-oriented SKUs, unlimited traffic on documented cloud-server lines, and management via the Aruba Cloud Management Platform, APIs, and prepaid credit wallet. Suits test/prod VMs and progressive scale-out inside Aruba's ecosystem—not a hyperscaler global catalog.
VMware private cloud (Pinnacle Partner)
Hosted Private Cloud, Virtual Private Cloud via VMware Cloud Director, unified storage, and DRaaS-style options using enterprise stacks (vendor materials cite Zerto, Veeam, vSphere tooling). Built for teams standardizing on VMware who want European hosting without running their own gear.
Bare metal and GPU for private AI
Dedicated servers in Italian Rating 4 data centers (Arezzo/Bergamo and others) with configurable networking (firewall/switch add-ons) and GPU SKUs aimed at private AI/ML. Full root control and isolation; buyer owns OS security and backups unless add-on protection is purchased.
Managed Kubernetes and cloud-native stack
Managed Kubernetes, Application Platform (container/PaaS), container registry, agentless backup for K8s/VDC, plus ArubaKube R&D around open-source multi-cluster projects such as Liqo. Good for EU teams wanting managed containers without leaving Aruba's network.
Object/block storage and enterprise backup
S3-compatible object storage, block volumes, smart storage, and backup packages (vendor stacks include Veeam and Commvault). Use for data protection and hybrid DR—not automatic full-workload backup unless you buy and configure those services.
European region choice with Italian ACN path
Place workloads across proprietary Italian and Czech sites plus partner zones in France, Germany, the UK, and Poland. Italian ACN-qualified IaaS/PaaS/SaaS positioning targets public administration and regulated suppliers; confirm exact qualified SKUs and region pins in procurement.

Cyso Cloud

OpenStack public IaaS on EU hardware
Vanilla OpenStack compute (roughly 2–64 vCPUs and up to 512 GB RAM flavors), NVMe-backed ephemeral and block volumes, dashboard plus OpenStack APIs/CLI. Deployed on Cyso-managed hardware in Amsterdam and Frankfurt with three availability zones per region so multi-AZ designs are first-class.
S3-compatible NVMe object storage
Region-scoped object storage with triple-disk redundancy, versioning, lifecycle rules, object lock, pre-signed URLs, and standard S3 clients (AWS CLI, Rclone, MinIO mc, SDKs). Data and replicas stay in the selected AMS or FRA region; default server-side encryption at rest is not applied—plan client-side or customer-key approaches for sensitive objects.
Enterprise Managed Kubernetes (KCSP)
CNCF Kubernetes Certified Service Provider managed control planes with multi-version support, automated upgrades, worker groups (including GPU/high-memory options), HPA/VPA/node autoscaling, Garden Linux workers, Terraform/kubectl/k9s workflows, and cluster hibernation to scale workers to zero on a schedule.
European networking and multi-AZ design
VPC-style private networks, security groups as virtual firewalls, load balancers with health checks, floating/reserved IPs, Anycast DNS, IPv6 dual-stack, native edge DDoS mitigation, and Direct Connect-style private links. SLA text targets 99.99% monthly uptime for listed compute, volume, object, and networking services when multi-AZ conditions are met.
Private cloud and wholesale options
Same OpenStack-based stack can be deployed as a private cloud on customer data-centre hardware (including VMware-alternative messaging) or white-label/wholesale models for partners—useful when public multi-tenant regions are not enough for isolation or residency policy.

Assurance & compliance: Aruba Cloud vs Cyso Cloud
Assurance & compliance	Aruba Cloud	Cyso Cloud
Independent security / no-logs audit	Not applicable IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.	Not found Security measures and pen-testing philosophy are described; no public independent no-logs or IaaS audit report found beyond ISMS certs.
ISO 27001	Vendor claimed Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.	Vendor claimed Vendor publishes ISO/IEC 27001 certificate PDF via Trust Centre / certifications (listed expiry into 2028). Not re-checked on an independent registry for this draft.
SOC 2 / SOC 3	Not found Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.	Not found Certifications page explains SOC 2 Type II generally; no clear statement that Cyso currently holds a published SOC 2 report.
ISAE 3402	Vendor claimed Certificate/report PDF linked from data-protection resources page.	Not listed
GDPR / EU data protection	Vendor claimed EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.	Vendor claimed EU legal entity; AMS/FRA residency claims; Trust Centre GDPR section. Obtain DPA and TOMs for controller/processor mapping.
US CLOUD Act exposure (indicative)	Partial Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.	Partial EuropeanStack assessment: EU entity, no known US parent, primary IaaS claimed on self-operated NL/DE hardware (not AWS/GCP/Azure). Partial because no full public subprocessor schedule and ancillary SaaS (e.g. PostHog analytics, Atlassian-linked status) may involve non-EU providers. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.	Vendor claimed Marketing (e.g. Azure alternative pages) states Cyso signs a DPA under Dutch law; confirm current template and subprocessor annex in contracting.
CISPE Code of Conduct	Vendor claimed Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.	Not listed
ACN qualification (Italian PA)	Vendor claimed Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.	Not listed
EU AI Act	Not applicable Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.	Not applicable IaaS/infrastructure platform, not an AI system product.
NEN 7510 (Dutch healthcare information security)	Not listed	Vendor claimed Vendor publishes NEN 7510 certificate PDF on certifications/Trust Centre pages.

Considerations & known limitations: Aruba Cloud vs Cyso Cloud
Considerations & known limitations	Aruba Cloud	Cyso Cloud
Subprocessor list not fully public	Medium T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.	Not listed
Partner zones and multi-region choice	Low European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.	Not listed
Customer-owned backups and OS security	Medium Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.	Not listed
Narrower managed PaaS than hyperscalers	Low OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.	Not listed
Certificate scope must be verified	Low ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.	Not listed
Only two live public regions	Not listed	Medium Production public cloud is AMS and FRA today. Multi-continent latency, in-country residency outside NL/DE, or extensive multi-region DR across Europe may require another provider or private cloud.
No default object storage encryption at rest	Not listed	Medium Official FAQs state no standard server-side encryption at rest; TLS in transit and client-side/SSE-C patterns are recommended. Regulated designs must implement key management outside default storage behaviour.
Incomplete public subprocessor inventory	Not listed	Medium Primary hosting path is vendor-operated EU hardware, but privacy materials list third parties without a dedicated live subprocessor register for all ancillary processing. Request the schedule under NDA or DPA annex.
Certifications are vendor-published PDFs	Not listed	Low ISO 27001 and NEN 7510 are claimed with certificate PDFs on Cyso sites; this draft did not independently verify registry entries. Treat as claimed until audit pack is reviewed.
Smaller ecosystem than hyperscalers	Not listed	Low Fewer managed PaaS services and marketplace options than AWS/Azure/GCP. Expect to run more of the stack yourself on OpenStack/Kubernetes.

Fit

Aruba Cloud

Best fit when

Italian or EU orgs that want compute under Aruba S.p.A. with primary hosting on Aruba-owned Italian/Czech data centers
Public administration and regulated suppliers needing ACN-qualified cloud SKUs (confirm product scope)
VMware shops seeking Hosted Private Cloud / VPC / DRaaS without US hyperscaler tenancy
Teams mixing OpenStack VMs, Managed Kubernetes, object storage, and bare metal/GPU for private AI
Buyers who value Italian-language 24/7 support, CMP self-service, and prepaid credit cost control

Poor fit when

Workloads that need a hyperscaler-wide global region map and deep managed PaaS catalogs (AWS/Azure-class)
Teams that require a fully public, always-updated subprocessor page without a customer request
Buyers who only want lowest-cost bare metal/VPS and do not need VMware, ACN, or enterprise packaging (Hetzner-class shortlists)
Strict Italy-only residency without validating region selection (partner zones include FR/DE/UK/PL)

Consider instead when

When: You need larger multi-country European scale or a broader global PoP footprint than Aruba's network
Consider: OVHcloud
French-scale European IaaS; different PA quals and product tree.
When: You prioritize developer-centric instance catalogs and simpler Paris/Amsterdam-style public cloud
Consider: Scaleway
Stronger developer UX; less Italian ACN/VMware private-cloud depth.
When: You need US hyperscaler ecosystem density, global managed services, and marketplace breadth
Consider: Amazon Web Services (AWS) or Microsoft Azure
US-parent platforms with different jurisdictional posture.
When: You mainly want cost-oriented German bare metal/VPS with less enterprise packaging
Consider: Hetzner
Different country anchor and compliance story; compare catalogs carefully.

Cyso Cloud

Best fit when

European product/SaaS teams that need VMs, volumes, and S3-compatible storage with explicit Amsterdam or Frankfurt residency
Organisations standardising on OpenStack APIs/CLI to reduce hyperscaler lock-in and support multi-cloud portability
Teams wanting CNCF KCSP managed Kubernetes with hibernation and pay-as-you-go worker nodes on EU infrastructure
Dutch healthcare-adjacent or regulated buyers who need NEN 7510 alongside ISO 27001 claims from a NL operator
Buyers evaluating a private OpenStack cloud or VMware alternative on their own data-centre hardware

Poor fit when

Workloads that require many global regions, edge PoPs, or a large marketplace of managed PaaS services
Storage designs that assume default server-side encryption at rest without customer-managed keys
Procurement that must rely only on a fully published subprocessor schedule without vendor engagement
Teams that need fully self-serve free tiers or only automated chat support with no human engineering contact

Consider instead when

When: You need many European (or global) regions and a broader product catalogue than two live IaaS regions
Consider: OVHcloud or Scaleway
Larger EU multi-region footprints; different APIs and commercial models.
When: You want Swiss multi-zone simplicity with strong managed Kubernetes emphasis
Consider: Exoscale
Swiss operator profile; fewer regions than hyperscalers but clear sovereignty messaging.
When: You need maximum global PaaS depth, AI services, and worldwide edge
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership for ecosystem breadth; apply your own residency and CLOUD Act analysis.
When: You prioritise high-performance European VMs across more city locations than AMS/FRA only
Consider: UpCloud
Different stack; compare residency guarantees and support model side by side.

Open questions for due diligence

Aruba Cloud

What is the current named subprocessor list (group companies and third parties) for the exact SKUs we will buy?
Which products and sites are in scope for the latest ISO 27001 / 27017 / 27018 certificates and ACN AI3/QC3 qualifications?
Can we pin workloads exclusively to Italian proprietary DCs (IT1–IT4) with contractual residency language?
What customer audit rights, ISAE/SOC report access, and DPA signature process apply to our legal entity?
For hybrid designs, which interconnect options touch US-group clouds, and can those be excluded?

Cyso Cloud

Can Cyso provide the current DPA, technical and organisational measures, and a dated subprocessor list covering payments, support, analytics, and status tooling?
What is the exact OpenStack release, upgrade cadence, and any divergences from upstream APIs that affect Terraform/automation?
For object storage and volumes, what encryption-at-rest or KMS options can be contractually committed for regulated data?
What are contractual 24/7 escalation SLAs for severity-1 incidents beyond office-hours tech-to-tech support?
Which additional EU regions (if any) have committed go-live dates versus community voting only?