Aruba Cloud vs Scaleway

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

Certificate/report PDF linked from data-protection resources page.

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.