Aruba Cloud vs Elastx

Compare Aruba Cloud and Elastx on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Aruba Cloud

Italy· Cloud Computing

Needs review

Shortlist Aruba Cloud when you need Italian-entity IaaS with OpenStack public cloud, VMware private cloud (Pinnacle Partner), bare metal/GPU, and ACN-oriented PA packaging on proprietary EU campuses. Skip when you need hyperscaler global breadth or a fully public subprocessor directory—consider OVHcloud or Scaleway instead for multi-country European IaaS with different tradeoffs.

EU-operated (IT)OpenStack public cloudVMware Pinnacle PartnerISO 27001 (claimed)ACN-qualified (claimed)Proprietary EU data centers

View listing Visit Website

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Highlighted rows differ between the two products.

Aruba Cloud vs Elastx: Snapshot
Feature	Aruba Cloud	Elastx
Country of origin	Italy	Sweden
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Italy	Sweden
Legal entity	Aruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy; VAT IT01573850516	Elastx AB
Governing law	Italian law (Bergamo courts for non-consumers per T&Cs)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Primary compute on Aruba-owned data centers in Italy (Arezzo IT1/IT2, Bergamo IT3, Rome IT4) and Czech Republic (Prague CZ1, Ktiš CZ2). Partner availability zones: Paris FR1, Frankfurt DE1, London UK1, Warsaw PL1. Customer chooses region. Full subprocessor list not public—available on request under processor terms. Optional multi-cloud interconnection to other public clouds for hybrid designs.	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.
Summary	Italian sovereign cloud from Aruba S.p.A.: OpenStack public cloud, VMware private cloud, bare metal/GPU, Kubernetes, and storage on proprietary European data centers—strong fit for Italian PA and EU residency-minded IT.	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.
Tags	cloud openstack kubernetes infrastructure sovereign-cloud vmware bare-metal gdpr enterprise	cloud openstack kubernetes iaas swedish-cloud data-sovereignty dbaas

At a glance: Aruba Cloud vs Elastx
At a glance	Aruba Cloud	Elastx
HQ	Ponte San Pietro (BG), Italy	Stockholm, Sweden (Elastx AB)
Legal entity	Aruba S.p.A.	Not listed
Founded	1994 (group)	2012
Hosting	Proprietary IT + CZ DCs; partner FR/DE/UK/PL	Not listed
Core stack	OpenStack, VMware, bare metal, K8s	OpenStack IaaS, Kubernetes CaaS, DBaaS
Commercial model	Prepaid credit / pay-as-you-go; no free tier	Hourly usage; no long-term lock-in contracts (vendor)
Open source product?	No (uses OSS components e.g. OpenStack)	Not listed
Self-hosted?	No (provider-managed cloud/DC)	Not listed
Primary region	Not listed	se-sto — 3 AZs in Stockholm area
Ownership	Not listed	Swedish PE Sobro majority (~53%); no known US parent

Key capabilities: Aruba Cloud vs Elastx
Key capabilities	Aruba Cloud	Elastx
EU-operated (IT)	Yes	Not listed
OpenStack public cloud	Yes	Not listed
VMware Pinnacle Partner	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
ACN-qualified (claimed)	Yes	Not listed
Proprietary EU data centers	Yes	Not listed
Swedish OpenStack IaaS	Not listed	Yes
Multi-AZ managed Kubernetes	Not listed	Yes
Managed DBaaS	Not listed	Yes
ISO 27001/27017/27018 (claimed)	Not listed	Yes
Sweden data residency	Not listed	Yes
Hourly, no lock-in contracts	Not listed	Yes

Aruba Cloud

OpenStack public cloud + CMP
Self-service Cloud Servers and Virtual Data Centers on OpenStack with AMD/NVMe-oriented SKUs, unlimited traffic on documented cloud-server lines, and management via the Aruba Cloud Management Platform, APIs, and prepaid credit wallet. Suits test/prod VMs and progressive scale-out inside Aruba's ecosystem—not a hyperscaler global catalog.
VMware private cloud (Pinnacle Partner)
Hosted Private Cloud, Virtual Private Cloud via VMware Cloud Director, unified storage, and DRaaS-style options using enterprise stacks (vendor materials cite Zerto, Veeam, vSphere tooling). Built for teams standardizing on VMware who want European hosting without running their own gear.
Bare metal and GPU for private AI
Dedicated servers in Italian Rating 4 data centers (Arezzo/Bergamo and others) with configurable networking (firewall/switch add-ons) and GPU SKUs aimed at private AI/ML. Full root control and isolation; buyer owns OS security and backups unless add-on protection is purchased.
Managed Kubernetes and cloud-native stack
Managed Kubernetes, Application Platform (container/PaaS), container registry, agentless backup for K8s/VDC, plus ArubaKube R&D around open-source multi-cluster projects such as Liqo. Good for EU teams wanting managed containers without leaving Aruba's network.
Object/block storage and enterprise backup
S3-compatible object storage, block volumes, smart storage, and backup packages (vendor stacks include Veeam and Commvault). Use for data protection and hybrid DR—not automatic full-workload backup unless you buy and configure those services.
European region choice with Italian ACN path
Place workloads across proprietary Italian and Czech sites plus partner zones in France, Germany, the UK, and Poland. Italian ACN-qualified IaaS/PaaS/SaaS positioning targets public administration and regulated suppliers; confirm exact qualified SKUs and region pins in procurement.

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Assurance & compliance: Aruba Cloud vs Elastx
Assurance & compliance	Aruba Cloud	Elastx
Independent security / no-logs audit	Not applicable IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.
ISO 27001	Vendor claimed Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.
SOC 2 / SOC 3	Not found Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.	Not found No SOC 2/3 claim found on official product/trust pages reviewed.
ISAE 3402	Vendor claimed Certificate/report PDF linked from data-protection resources page.	Not listed
GDPR / EU data protection	Vendor claimed EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.
US CLOUD Act exposure (indicative)	Partial Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.
CISPE Code of Conduct	Vendor claimed Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.	Not listed
ACN qualification (Italian PA)	Vendor claimed Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.	Not listed
EU AI Act	Not applicable Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.
ISO 14001 (environmental)	Not listed	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.

Considerations & known limitations: Aruba Cloud vs Elastx
Considerations & known limitations	Aruba Cloud	Elastx
Subprocessor list not fully public	Medium T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.
Partner zones and multi-region choice	Low European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.	Not listed
Customer-owned backups and OS security	Medium Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.	Not listed
Narrower managed PaaS than hyperscalers	Low OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.	Not listed
Certificate scope must be verified	Low ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.	Not listed
OpenStack operational constraints	Not listed	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.
Sweden-centric footprint	Not listed	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.
ISO claims need certificate pack	Not listed	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.

Fit

Aruba Cloud

Best fit when

Italian or EU orgs that want compute under Aruba S.p.A. with primary hosting on Aruba-owned Italian/Czech data centers
Public administration and regulated suppliers needing ACN-qualified cloud SKUs (confirm product scope)
VMware shops seeking Hosted Private Cloud / VPC / DRaaS without US hyperscaler tenancy
Teams mixing OpenStack VMs, Managed Kubernetes, object storage, and bare metal/GPU for private AI
Buyers who value Italian-language 24/7 support, CMP self-service, and prepaid credit cost control

Poor fit when

Workloads that need a hyperscaler-wide global region map and deep managed PaaS catalogs (AWS/Azure-class)
Teams that require a fully public, always-updated subprocessor page without a customer request
Buyers who only want lowest-cost bare metal/VPS and do not need VMware, ACN, or enterprise packaging (Hetzner-class shortlists)
Strict Italy-only residency without validating region selection (partner zones include FR/DE/UK/PL)

Consider instead when

When: You need larger multi-country European scale or a broader global PoP footprint than Aruba's network
Consider: OVHcloud
French-scale European IaaS; different PA quals and product tree.
When: You prioritize developer-centric instance catalogs and simpler Paris/Amsterdam-style public cloud
Consider: Scaleway
Stronger developer UX; less Italian ACN/VMware private-cloud depth.
When: You need US hyperscaler ecosystem density, global managed services, and marketplace breadth
Consider: Amazon Web Services (AWS) or Microsoft Azure
US-parent platforms with different jurisdictional posture.
When: You mainly want cost-oriented German bare metal/VPS with less enterprise packaging
Consider: Hetzner
Different country anchor and compliance story; compare catalogs carefully.

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Open questions for due diligence

Aruba Cloud

What is the current named subprocessor list (group companies and third parties) for the exact SKUs we will buy?
Which products and sites are in scope for the latest ISO 27001 / 27017 / 27018 certificates and ACN AI3/QC3 qualifications?
Can we pin workloads exclusively to Italian proprietary DCs (IT1–IT4) with contractual residency language?
What customer audit rights, ISAE/SOC report access, and DPA signature process apply to our legal entity?
For hybrid designs, which interconnect options touch US-group clouds, and can those be excluded?

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?