Aruba Cloud vs SAP

Compare Aruba Cloud and SAP on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Microsoft Azure

Logo: Aruba Cloud

Aruba Cloud

Italy· Cloud Computing

Needs review

Shortlist Aruba Cloud when you need Italian-entity IaaS with OpenStack public cloud, VMware private cloud (Pinnacle Partner), bare metal/GPU, and ACN-oriented PA packaging on proprietary EU campuses. Skip when you need hyperscaler global breadth or a fully public subprocessor directory—consider OVHcloud or Scaleway instead for multi-country European IaaS with different tradeoffs.

EU-operated (IT)OpenStack public cloudVMware Pinnacle PartnerISO 27001 (claimed)ACN-qualified (claimed)Proprietary EU data centers
View listingVisit Website
Logo: SAP

SAP

Germany· Cloud Computing

Needs review

Shortlist SAP when you need S/4HANA-class ERP breadth under a German parent entity and can fund a structured implementation. Skip when you want lightweight self-serve finance SaaS without a transformation partner. Consider Salesforce when CRM is the system of record, or a Microsoft Dynamics / Azure-centric stack when identity and productivity are already standardised on Microsoft.

EU-operatedFull ERP suiteS/4HANA CloudISO 27001 (claimed)B2B DPA published
View listingVisit Website

Highlighted rows differ between the two products.

Aruba Cloud vs SAP: Snapshot
FeatureLogo: Aruba CloudAruba CloudLogo: SAPSAP
Country of originItalyGermany
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoYes
HeadquartersItalyGermany
Legal entityAruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy; VAT IT01573850516SAP SE, Dietmar-Hopp-Allee 16, 69190 Walldorf (Mannheim HRB 719915)
Governing lawItalian law (Bergamo courts for non-consumers per T&Cs)German entity; order forms may name local SAP affiliates
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowMedium
EU-hosted statusNot listedPartial
Hosting / residencyPrimary compute on Aruba-owned data centers in Italy (Arezzo IT1/IT2, Bergamo IT3, Rome IT4) and Czech Republic (Prague CZ1, Ktiš CZ2). Partner availability zones: Paris FR1, Frankfurt DE1, London UK1, Warsaw PL1. Customer chooses region. Full subprocessor list not public—available on request under processor terms. Optional multi-cloud interconnection to other public clouds for hybrid designs.Mixed: SAP-operated data centers (including Walldorf / St. Leon-Rot, Germany) plus Enterprise Cloud Services documented on AWS, Microsoft Azure, Google Cloud Platform, or customer data centers. Product-specific subprocessor lists are primarily on My Trust Center for customers.
Summary

Italian sovereign cloud from Aruba S.p.A.: OpenStack public cloud, VMware private cloud, bare metal/GPU, Kubernetes, and storage on proprietary European data centers—strong fit for Italian PA and EU residency-minded IT.

German-headquartered enterprise ERP suite (SAP Cloud ERP / S/4HANA) for finance, supply chain, procurement, and HR.

Tags
cloudgdprenterpriseinfrastructuresovereign-cloudopenstackvmwarebare-metalkubernetes
cloudgdprenterpriseerps4hana
At a glance: Aruba Cloud vs SAP
At a glanceLogo: Aruba CloudAruba CloudLogo: SAPSAP
HQPonte San Pietro (BG), ItalyWalldorf, Germany
Legal entityAruba S.p.A.SAP SE (HRB 719915 Mannheim)
Founded1994 (group)Not listed
HostingProprietary IT + CZ DCs; partner FR/DE/UK/PLNot listed
Core stackOpenStack, VMware, bare metal, K8sNot listed
Commercial modelPrepaid credit / pay-as-you-go; no free tierEnterprise subscription and licences (quote-based)
Open source product?No (uses OSS components e.g. OpenStack)Not listed
Self-hosted?No (provider-managed cloud/DC)Not listed
Product focusNot listedCloud ERP / S/4HANA
Open sourceNot listedNo
Data residency regionsNot listedCustomer-selectable; Americas, Europe, Asia Pacific (incl. SAP DE sites and hyperscalers)
Compliance certs (claimed)Not listedISO 27001, SOC 1/2, BSI C5, plus regional attestations via Trust Center
Key capabilities: Aruba Cloud vs SAP
Key capabilitiesLogo: Aruba CloudAruba CloudLogo: SAPSAP
EU-operated (IT)YesYes
OpenStack public cloudYesNot listed
VMware Pinnacle PartnerYesNot listed
ISO 27001 (claimed)YesNot listed
ACN-qualified (claimed)YesNot listed
Proprietary EU data centersYesNot listed
Full ERP suiteNot listedYes
S/4HANA CloudNot listedYes
ISO 27001 (claimed)Not listedYes
B2B DPA publishedNot listedYes

Aruba Cloud

  • OpenStack public cloud + CMP

    Self-service Cloud Servers and Virtual Data Centers on OpenStack with AMD/NVMe-oriented SKUs, unlimited traffic on documented cloud-server lines, and management via the Aruba Cloud Management Platform, APIs, and prepaid credit wallet. Suits test/prod VMs and progressive scale-out inside Aruba's ecosystem—not a hyperscaler global catalog.

  • VMware private cloud (Pinnacle Partner)

    Hosted Private Cloud, Virtual Private Cloud via VMware Cloud Director, unified storage, and DRaaS-style options using enterprise stacks (vendor materials cite Zerto, Veeam, vSphere tooling). Built for teams standardizing on VMware who want European hosting without running their own gear.

  • Bare metal and GPU for private AI

    Dedicated servers in Italian Rating 4 data centers (Arezzo/Bergamo and others) with configurable networking (firewall/switch add-ons) and GPU SKUs aimed at private AI/ML. Full root control and isolation; buyer owns OS security and backups unless add-on protection is purchased.

  • Managed Kubernetes and cloud-native stack

    Managed Kubernetes, Application Platform (container/PaaS), container registry, agentless backup for K8s/VDC, plus ArubaKube R&D around open-source multi-cluster projects such as Liqo. Good for EU teams wanting managed containers without leaving Aruba's network.

  • Object/block storage and enterprise backup

    S3-compatible object storage, block volumes, smart storage, and backup packages (vendor stacks include Veeam and Commvault). Use for data protection and hybrid DR—not automatic full-workload backup unless you buy and configure those services.

  • European region choice with Italian ACN path

    Place workloads across proprietary Italian and Czech sites plus partner zones in France, Germany, the UK, and Poland. Italian ACN-qualified IaaS/PaaS/SaaS positioning targets public administration and regulated suppliers; confirm exact qualified SKUs and region pins in procurement.

SAP

  • SAP S/4HANA Cloud ERP core

    Public and private cloud editions cover finance, supply chain, procurement, sales, and related processes on an in-memory data model with role-based UX. Scope and extensibility differ between Public Edition (standardised) and Private Edition (closer to classic on-premises flexibility).

  • GROW and RISE packaging

    SAP GROW targets organisations starting on standardised AI-enabled cloud ERP. RISE with SAP supports existing on-premises customers migrating toward cloud with transformation services. Packaging choice drives implementation shape more than feature marketing slides.

  • Integration via SAP BTP

    SAP Business Technology Platform and Integration Suite provide APIs, iPaaS connectivity, and extension points to link SAP ERP with third-party and legacy systems. Expect integration projects rather than plug-and-play SMB connectors.

  • Selectable cloud regions and sovereign options

    Customers can choose data center regions; SAP documents Americas, Europe, and Asia Pacific availability, including SAP-operated German sites and hyperscaler regions. Sovereign / regulated options (for example German IT-Grundschutz messaging for SAP-owned facilities) exist but must be contracted explicitly.

  • Trust Center compliance artifacts

    SAP publishes ISO 27001, SOC, C5, and other certificates plus DPAs through the Trust Center and customer portals. Audit reports for specific services are often gated to customers rather than fully public PDFs.

Assurance & compliance: Aruba Cloud vs SAP
Assurance & complianceLogo: Aruba CloudAruba CloudLogo: SAPSAP
Independent security / no-logs audit
Not applicable

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

Not applicable

ERP suite; not a no-logs privacy network product. Rely on SOC/ISO/C5 attestations instead.

ISO 27001
Vendor claimed

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

Vendor claimed

Trust Center lists ISO 27001 certificates for cloud services and publishes certificate finder entries (e.g. Central / Enterprise Cloud Services).

SOC 2 / SOC 3
Not found

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Vendor claimed

SOC 1 and SOC 2 reports described on Trust Center; many reports customer-gated via SAP for Me / My Trust Center.

ISAE 3402
Vendor claimed

Certificate/report PDF linked from data-protection resources page.

Not listed
GDPR / EU data protection
Vendor claimed

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

Vendor claimed

EU parent entity; Trust Center privacy pages and DPAs reference GDPR processing terms.

US CLOUD Act exposure (indicative)
Partial

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

Partial

German SAP SE parent with no known US parent, but Enterprise Cloud Services explicitly include AWS, Azure, and GCP paths. Medium exposure for hyperscaler-backed tenants. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Vendor claimed

SAP states it signs DPAs; Trust Center hosts Data Processing Agreement documents for cloud, support, and professional services.

CISPE Code of Conduct
Vendor claimed

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Not listed
ACN qualification (Italian PA)
Vendor claimed

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Not listed
EU AI Act
Not applicable

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Partial

SAP publishes EU AI Act governance materials for Joule Agents and AI features; customer still must assess in-scope AI uses.

BSI C5Not listed
Vendor claimed

Trust Center lists Cloud Computing Compliance Controls Catalogue (C5) audit reports among EU regional offerings.

Considerations & known limitations: Aruba Cloud vs SAP
Considerations & known limitationsLogo: Aruba CloudAruba CloudLogo: SAPSAP
Subprocessor list not fully public
Medium

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

Low

Public pages confirm lists exist on My Trust Center, but a full anonymous dump was not available in this research pass. Request the list for your exact cloud service before security sign-off.

Partner zones and multi-region choice
Low

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Not listed
Customer-owned backups and OS security
Medium

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

Not listed
Narrower managed PaaS than hyperscalers
Low

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

Not listed
Certificate scope must be verified
Low

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

Not listed
Hyperscaler hosting is commonNot listed
Medium

Even with a German parent, many cloud tenants run on AWS, Azure, or GCP. EU region selection does not remove US-group infrastructure operators from the path. Confirm contracted region and subprocessors.

Heavy implementation programmesNot listed
Medium

S/4HANA and RISE projects typically need partners, data migration, and process redesign. Poor fit if you expected self-serve SaaS onboarding.

Catalog category is Cloud Computing, not ERPNot listed
Low

EuropeanStack has no dedicated ERP category yet. This entry is filed under Cloud Computing as the closest existing slug.

Fit

Aruba Cloud

Best fit when

  • Italian or EU orgs that want compute under Aruba S.p.A. with primary hosting on Aruba-owned Italian/Czech data centers
  • Public administration and regulated suppliers needing ACN-qualified cloud SKUs (confirm product scope)
  • VMware shops seeking Hosted Private Cloud / VPC / DRaaS without US hyperscaler tenancy
  • Teams mixing OpenStack VMs, Managed Kubernetes, object storage, and bare metal/GPU for private AI
  • Buyers who value Italian-language 24/7 support, CMP self-service, and prepaid credit cost control

Poor fit when

  • Workloads that need a hyperscaler-wide global region map and deep managed PaaS catalogs (AWS/Azure-class)
  • Teams that require a fully public, always-updated subprocessor page without a customer request
  • Buyers who only want lowest-cost bare metal/VPS and do not need VMware, ACN, or enterprise packaging (Hetzner-class shortlists)
  • Strict Italy-only residency without validating region selection (partner zones include FR/DE/UK/PL)

Consider instead when

  • When: You need larger multi-country European scale or a broader global PoP footprint than Aruba's network

    Consider: OVHcloud

    French-scale European IaaS; different PA quals and product tree.

  • When: You prioritize developer-centric instance catalogs and simpler Paris/Amsterdam-style public cloud

    Consider: Scaleway

    Stronger developer UX; less Italian ACN/VMware private-cloud depth.

  • When: You need US hyperscaler ecosystem density, global managed services, and marketplace breadth

    Consider: Amazon Web Services (AWS) or Microsoft Azure

    US-parent platforms with different jurisdictional posture.

  • When: You mainly want cost-oriented German bare metal/VPS with less enterprise packaging

    Consider: Hetzner

    Different country anchor and compliance story; compare catalogs carefully.

SAP

Best fit when

  • Midsize to large enterprises consolidating finance, supply chain, and procurement on one ERP
  • Organisations that need deep industry process templates and multi-country localisation
  • Buyers that require a German / EU parent contracting entity plus formal Trust Center attestations
  • Existing SAP ECC customers planning a RISE or S/4HANA transformation
  • Teams with budget for partner-led implementation rather than pure self-serve SaaS

Poor fit when

  • Startups or SMBs needing only simple invoicing without ERP programme overhead
  • Buyers that require a guaranteed EU-only, non-hyperscaler hosting path without reading the contract region
  • Teams seeking an open-source ERP they can fork and fully self-operate without vendor lock-in
  • CRM-first organisations where Salesforce-class customer platforms are the real system of record

Consider instead when

  • When: Your primary system of record is CRM and revenue operations, not manufacturing or complex finance

    Consider: Salesforce

    Stronger CRM depth; US parent and different compliance posture.

  • When: You already standardise on Microsoft identity, M365, and Azure and want ERP in that estate

    Consider: Microsoft 365 / Azure-centric Dynamics stacks

    Compare total cost of identity + productivity + ERP under one US vendor.

  • When: You need a smaller European mid-market ERP without S/4HANA transformation scope

    Consider: Evaluate EU mid-market ERP vendors outside this catalog (no peer ERP slug listed yet)

    Catalog currently lacks a direct European ERP alternative entry.

Open questions for due diligence

Aruba Cloud

  • What is the current named subprocessor list (group companies and third parties) for the exact SKUs we will buy?
  • Which products and sites are in scope for the latest ISO 27001 / 27017 / 27018 certificates and ACN AI3/QC3 qualifications?
  • Can we pin workloads exclusively to Italian proprietary DCs (IT1–IT4) with contractual residency language?
  • What customer audit rights, ISAE/SOC report access, and DPA signature process apply to our legal entity?
  • For hybrid designs, which interconnect options touch US-group clouds, and can those be excluded?

SAP

  • Which exact cloud service and region would this buyer contract (Public Edition vs Private Edition vs RISE on which hyperscaler)?
  • Will the order form be with SAP SE or a local affiliate, and which governing law clause applies?
  • Can the vendor provide the current subprocessor list and SOC/C5 reports for the specific service code without an existing customer login?