Aruba Cloud vs STACKIT

Compare Aruba Cloud and STACKIT on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Microsoft Azure

Logo: Aruba Cloud

Aruba Cloud

Italy· Cloud Computing

Needs review

Shortlist Aruba Cloud when you need Italian-entity IaaS with OpenStack public cloud, VMware private cloud (Pinnacle Partner), bare metal/GPU, and ACN-oriented PA packaging on proprietary EU campuses. Skip when you need hyperscaler global breadth or a fully public subprocessor directory—consider OVHcloud or Scaleway instead for multi-country European IaaS with different tradeoffs.

EU-operated (IT)OpenStack public cloudVMware Pinnacle PartnerISO 27001 (claimed)ACN-qualified (claimed)Proprietary EU data centers
View listingVisit Website
Logo: STACKIT

STACKIT

Germany· Cloud Computing

Needs review

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid
View listingVisit Website

Highlighted rows differ between the two products.

Aruba Cloud vs STACKIT: Snapshot
FeatureLogo: Aruba CloudAruba CloudLogo: STACKITSTACKIT
Country of originItalyGermany
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersItalyGermany
Legal entityAruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy; VAT IT01573850516Schwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)
Governing lawItalian law (Bergamo courts for non-consumers per T&Cs)Germany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowLow
Hosting / residencyPrimary compute on Aruba-owned data centers in Italy (Arezzo IT1/IT2, Bergamo IT3, Rome IT4) and Czech Republic (Prague CZ1, Ktiš CZ2). Partner availability zones: Paris FR1, Frankfurt DE1, London UK1, Warsaw PL1. Customer chooses region. Full subprocessor list not public—available on request under processor terms. Optional multi-cloud interconnection to other public clouds for hybrid designs.Vendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.
Summary

Italian sovereign cloud from Aruba S.p.A.: OpenStack public cloud, VMware private cloud, bare metal/GPU, Kubernetes, and storage on proprietary European data centers—strong fit for Italian PA and EU residency-minded IT.

German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.

Tags
cloudinfrastructuresovereign-cloudkubernetesopenstackvmwarebare-metalgdprenterprise
cloudinfrastructuresovereign-cloudkubernetesprivacyiaaspaas
At a glance: Aruba Cloud vs STACKIT
At a glanceLogo: Aruba CloudAruba CloudLogo: STACKITSTACKIT
HQPonte San Pietro (BG), ItalyNot listed
Legal entityAruba S.p.A.Not listed
Founded1994 (group)Not listed
HostingProprietary IT + CZ DCs; partner FR/DE/UK/PLGroup-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure reseller
Core stackOpenStack, VMware, bare metal, K8sNot listed
Commercial modelPrepaid credit / pay-as-you-go; no free tierNot listed
Open source product?No (uses OSS components e.g. OpenStack)Not listed
Self-hosted?No (provider-managed cloud/DC)Not listed
HQ / legal entityNot listedBad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KG
ParentNot listedSchwarz Digits (Schwarz Group — Lidl/Kaufland)
ModelNot listedConsumption-based public cloud + quote-based colocation
Open sourceNot listedUses open-source components; platform itself is managed, not self-hosted
External marketNot listedPublic offering from 2022 (internal roots from 2018)
Key capabilities: Aruba Cloud vs STACKIT
Key capabilitiesLogo: Aruba CloudAruba CloudLogo: STACKITSTACKIT
EU-operated (IT)YesYes
OpenStack public cloudYesNot listed
VMware Pinnacle PartnerYesNot listed
ISO 27001 (claimed)YesNot listed
ACN-qualified (claimed)YesNot listed
Proprietary EU data centersYesNot listed
German legal entityNot listedYes
Group-owned DE/AT DCsNot listedYes
BSI C5 Type 2 (claimed)Not listedYes
Managed Kubernetes (SKE)Not listedYes
EU colocation + hybridNot listedYes

Aruba Cloud

  • OpenStack public cloud + CMP

    Self-service Cloud Servers and Virtual Data Centers on OpenStack with AMD/NVMe-oriented SKUs, unlimited traffic on documented cloud-server lines, and management via the Aruba Cloud Management Platform, APIs, and prepaid credit wallet. Suits test/prod VMs and progressive scale-out inside Aruba's ecosystem—not a hyperscaler global catalog.

  • VMware private cloud (Pinnacle Partner)

    Hosted Private Cloud, Virtual Private Cloud via VMware Cloud Director, unified storage, and DRaaS-style options using enterprise stacks (vendor materials cite Zerto, Veeam, vSphere tooling). Built for teams standardizing on VMware who want European hosting without running their own gear.

  • Bare metal and GPU for private AI

    Dedicated servers in Italian Rating 4 data centers (Arezzo/Bergamo and others) with configurable networking (firewall/switch add-ons) and GPU SKUs aimed at private AI/ML. Full root control and isolation; buyer owns OS security and backups unless add-on protection is purchased.

  • Managed Kubernetes and cloud-native stack

    Managed Kubernetes, Application Platform (container/PaaS), container registry, agentless backup for K8s/VDC, plus ArubaKube R&D around open-source multi-cluster projects such as Liqo. Good for EU teams wanting managed containers without leaving Aruba's network.

  • Object/block storage and enterprise backup

    S3-compatible object storage, block volumes, smart storage, and backup packages (vendor stacks include Veeam and Commvault). Use for data protection and hybrid DR—not automatic full-workload backup unless you buy and configure those services.

  • European region choice with Italian ACN path

    Place workloads across proprietary Italian and Czech sites plus partner zones in France, Germany, the UK, and Poland. Italian ACN-qualified IaaS/PaaS/SaaS positioning targets public administration and regulated suppliers; confirm exact qualified SKUs and region pins in procurement.

STACKIT

  • Compute Engine VMs and GPUs in group-owned EU regions

    Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.

  • STACKIT Kubernetes Engine (SKE)

    Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.

  • Managed databases, messaging, and observability

    Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.

  • Confidential computing and key/secrets control

    Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.

  • EU colocation with hybrid path to public cloud

    Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.

  • Object, block, file, backup, and archiving storage

    S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

Assurance & compliance: Aruba Cloud vs STACKIT
Assurance & complianceLogo: Aruba CloudAruba CloudLogo: STACKITSTACKIT
Independent security / no-logs audit
Not applicable

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

Vendor claimed

Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit.

ISO 27001
Vendor claimed

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

Vendor claimed

Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components.

SOC 2 / SOC 3
Not found

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Vendor claimed

Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request.

ISAE 3402
Vendor claimed

Certificate/report PDF linked from data-protection resources page.

Not listed
GDPR / EU data protection
Vendor claimed

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

Vendor claimed

EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud.

US CLOUD Act exposure (indicative)
Partial

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

Partial

German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice.

Data processing agreement (B2B)
Vendor claimed

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Not found

No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement.

CISPE Code of Conduct
Vendor claimed

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Not listed
ACN qualification (Italian PA)
Vendor claimed

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Not listed
EU AI Act
Not applicable

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Not applicable

Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems.

BSI C5 Type 2Not listed
Vendor claimed

C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product.

TISAX Level 3Not listed
Vendor claimed

Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page).

Considerations & known limitations: Aruba Cloud vs STACKIT
Considerations & known limitationsLogo: Aruba CloudAruba CloudLogo: STACKITSTACKIT
Subprocessor list not fully public
Medium

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

Not listed
Partner zones and multi-region choice
Low

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Not listed
Customer-owned backups and OS security
Medium

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

Not listed
Narrower managed PaaS than hyperscalers
Low

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

Not listed
Certificate scope must be verified
Low

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

Not listed
Narrower service map than US hyperscalersNot listed
Medium

STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.

C5 Type 2 is product-scopedNot listed
Medium

Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.

Limited public subprocessor inventoryNot listed
Low

Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.

Retail-group operator concentrationNot listed
Low

Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.

Fit

Aruba Cloud

Best fit when

  • Italian or EU orgs that want compute under Aruba S.p.A. with primary hosting on Aruba-owned Italian/Czech data centers
  • Public administration and regulated suppliers needing ACN-qualified cloud SKUs (confirm product scope)
  • VMware shops seeking Hosted Private Cloud / VPC / DRaaS without US hyperscaler tenancy
  • Teams mixing OpenStack VMs, Managed Kubernetes, object storage, and bare metal/GPU for private AI
  • Buyers who value Italian-language 24/7 support, CMP self-service, and prepaid credit cost control

Poor fit when

  • Workloads that need a hyperscaler-wide global region map and deep managed PaaS catalogs (AWS/Azure-class)
  • Teams that require a fully public, always-updated subprocessor page without a customer request
  • Buyers who only want lowest-cost bare metal/VPS and do not need VMware, ACN, or enterprise packaging (Hetzner-class shortlists)
  • Strict Italy-only residency without validating region selection (partner zones include FR/DE/UK/PL)

Consider instead when

  • When: You need larger multi-country European scale or a broader global PoP footprint than Aruba's network

    Consider: OVHcloud

    French-scale European IaaS; different PA quals and product tree.

  • When: You prioritize developer-centric instance catalogs and simpler Paris/Amsterdam-style public cloud

    Consider: Scaleway

    Stronger developer UX; less Italian ACN/VMware private-cloud depth.

  • When: You need US hyperscaler ecosystem density, global managed services, and marketplace breadth

    Consider: Amazon Web Services (AWS) or Microsoft Azure

    US-parent platforms with different jurisdictional posture.

  • When: You mainly want cost-oriented German bare metal/VPS with less enterprise packaging

    Consider: Hetzner

    Different country anchor and compliance story; compare catalogs carefully.

STACKIT

Best fit when

  • Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
  • Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
  • Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
  • Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
  • Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

  • Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
  • Teams that must self-host the full cloud control plane rather than consume a managed public cloud
  • Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
  • Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
  • Use cases requiring non-European data residency as a primary requirement

Consider instead when

  • When: You need a wider multi-country European region map and a large independent cloud portfolio

    Consider: OVHcloud or Scaleway

    Different ownership and product cultures; still not US hyperscaler breadth

  • When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth

    Consider: IONOS (or similar DE hosts)

    Often simpler packaging for commodity compute

  • When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis

  • When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale

    Consider: Exoscale

    Smaller portfolio; different jurisdiction story

Open questions for due diligence

Aruba Cloud

  • What is the current named subprocessor list (group companies and third parties) for the exact SKUs we will buy?
  • Which products and sites are in scope for the latest ISO 27001 / 27017 / 27018 certificates and ACN AI3/QC3 qualifications?
  • Can we pin workloads exclusively to Italian proprietary DCs (IT1–IT4) with contractual residency language?
  • What customer audit rights, ISAE/SOC report access, and DPA signature process apply to our legal entity?
  • For hybrid designs, which interconnect options touch US-group clouds, and can those be excluded?

STACKIT

  • Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
  • Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
  • What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
  • What are exit, data export, and termination assistance terms for large object stores and managed databases?
  • For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?