Aruba Cloud vs OVHcloud

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

IaaS/hosting provider, not a no-logs VPN product. Security is covered via ISO/SOC programme rather than a public no-logs audit.

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

Vendor compliance pages assert ISO/IEC 27001 (with 27017/27018) for cloud services and datacentres; US pages reference Schellman certificate directory. Confirm current scope per product and region.

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Vendor asserts SSAE 18 Type 2 SOC 1, SOC 2 (+NIST), and SOC 3 attestations; reports available to prospective customers under vendor process.

Certificate/report PDF linked from data-protection resources page.

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

EU headquartered; GDPR compliance asserted; DPA documents published for relevant subsidiaries. Residency depends on chosen region.

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

French group with no known US parent, but operates US datacentres (Vint Hill, Hillsboro) and OVH US LLC. Medium indicative exposure: EU-region workloads on EU contracts differ from US-region workloads. Not legal advice.

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Published DPAs form part of terms (e.g. OVH SAS Europe paths; separate US DPA for OVH US LLC). Obtain the DPA matching your contracting entity.

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Core product is IaaS/bare metal/hosting; AI/ML platforms are optional infrastructure offerings, not a single AI system product under typical procurement framing.

Hosted Private Cloud (VMware on OVHcloud and related) holds SecNumCloud qualification; hosted in French sites (Roubaix, Gravelines, Strasbourg). Not all products are SecNumCloud-qualified.

Vendor lists HDS certification for healthcare data hosting options; confirm which products and locations are in scope.

Vendor asserts PCI DSS Level 1 certification for payment data hosting—confirm applicability to your architecture.

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

US East/West datacentres and OVH US LLC mean CLOUD Act and US process risk apply to US-placed data and some contracts. EU-only deployment reduces this but buyers must enforce region and contracting path.

A major fire at SBG caused widespread customer outages. Treat multi-AZ/multi-region backup design as mandatory for critical data; do not rely on single-site assumptions.

ISO, SOC, HDS, SecNumCloud, and PCI claims do not automatically cover every SKU and location. Procurement should request the exact report for the services ordered.

Vendor documents unmetered traffic exceptions for Asia-Pacific (lower default bandwidth and monthly volume caps vs Europe/North America). Model egress and bandwidth options for APAC workloads.

Bare Metal, Public Cloud, Private Cloud, and Web Cloud under one brand can confuse account structure, IAM, and billing. Define landing-zone standards early.