Aruba Cloud vs UpCloud

Compare Aruba Cloud and UpCloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Microsoft Azure

Logo: Aruba Cloud

Aruba Cloud

Italy· Cloud Computing

Needs review

Shortlist Aruba Cloud when you need Italian-entity IaaS with OpenStack public cloud, VMware private cloud (Pinnacle Partner), bare metal/GPU, and ACN-oriented PA packaging on proprietary EU campuses. Skip when you need hyperscaler global breadth or a fully public subprocessor directory—consider OVHcloud or Scaleway instead for multi-country European IaaS with different tradeoffs.

EU-operated (IT)OpenStack public cloudVMware Pinnacle PartnerISO 27001 (claimed)ACN-qualified (claimed)Proprietary EU data centers
View listingVisit Website
Logo: UpCloud

UpCloud

Finland· Cloud Computing

Needs review

Shortlist UpCloud when you want Finnish-contracted IaaS with MaxIOPS storage, CNCF Managed Kubernetes, managed open-source databases, and customer-pinned EU regions—plus optional global PoPs. Skip when you need hyperscaler-only PaaS depth or the absolute lowest bare-metal VPS pricing; consider Hetzner, Scaleway, or AWS/Azure/GCP depending on that gap.

Finnish-operated IaaSMaxIOPS block storageCNCF Managed KubernetesISO 27001 (claimed)Selectable EU regionsZero-cost egress policy
View listingVisit Website

Highlighted rows differ between the two products.

Aruba Cloud vs UpCloud: Snapshot
FeatureLogo: Aruba CloudAruba CloudLogo: UpCloudUpCloud
Country of originItalyFinland
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersItalyFinland
Legal entityAruba S.p.A., Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy; VAT IT01573850516UpCloud Oy (Business ID 2431560-5), Aleksanterinkatu 15 B, 00100 Helsinki
Governing lawItalian law (Bergamo courts for non-consumers per T&Cs)Finland (Terms of Service; arbitration Helsinki)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowMedium
Hosting / residencyPrimary compute on Aruba-owned data centers in Italy (Arezzo IT1/IT2, Bergamo IT3, Rome IT4) and Czech Republic (Prague CZ1, Ktiš CZ2). Partner availability zones: Paris FR1, Frankfurt DE1, London UK1, Warsaw PL1. Customer chooses region. Full subprocessor list not public—available on request under processor terms. Optional multi-cloud interconnection to other public clouds for hybrid designs.Customer-selected regions across 15 DCs (EU majority: FI, SE, NO, DK, DE, NL, ES, PL, UK; plus US-CHI/NYC/SJO, SG, AU) in colocations (Equinix, Digital Realty, CoreSite, Telia, Verne, Green Mountain, etc.). Customer Data stays in chosen DC. Vendor: EU VMs have no customer-data subprocessors; group subsidiaries only otherwise. Account data in Finland with global support access (incl. US/SG). Payments/hCaptcha are separate third parties.
Summary

Italian sovereign cloud from Aruba S.p.A.: OpenStack public cloud, VMware private cloud, bare metal/GPU, Kubernetes, and storage on proprietary European data centers—strong fit for Italian PA and EU residency-minded IT.

Finnish IaaS from UpCloud Oy (Helsinki): MaxIOPS block storage, Cloud Servers, managed Kubernetes and databases across 15 global regions with customer-selected residency.

Tags
cloudinfrastructurekubernetesgdprsovereign-cloudopenstackvmwarebare-metalenterprise
cloudinfrastructurekubernetesgdpriaasapifinlandmanaged-databases
At a glance: Aruba Cloud vs UpCloud
At a glanceLogo: Aruba CloudAruba CloudLogo: UpCloudUpCloud
HQPonte San Pietro (BG), ItalyHelsinki, Finland
Legal entityAruba S.p.A.UpCloud Oy (2431560-5)
Founded1994 (group)2011
HostingProprietary IT + CZ DCs; partner FR/DE/UK/PLNot listed
Core stackOpenStack, VMware, bare metal, K8sNot listed
Commercial modelPrepaid credit / pay-as-you-go; no free tierHourly pay-as-you-go; trial credits; zero-cost egress policy
Open source product?No (uses OSS components e.g. OpenStack)Not listed
Self-hosted?No (provider-managed cloud/DC)No (public/private cloud IaaS)
RegionsNot listed15 DCs / 12 countries (EU-heavy + US/APAC)
Open sourceNot listedNo (platform proprietary)
Key capabilities: Aruba Cloud vs UpCloud
Key capabilitiesLogo: Aruba CloudAruba CloudLogo: UpCloudUpCloud
EU-operated (IT)YesNot listed
OpenStack public cloudYesNot listed
VMware Pinnacle PartnerYesNot listed
ISO 27001 (claimed)YesNot listed
ACN-qualified (claimed)YesNot listed
Proprietary EU data centersYesNot listed
Finnish-operated IaaSNot listedYes
MaxIOPS block storageNot listedYes
CNCF Managed KubernetesNot listedYes
ISO 27001 (claimed)Not listedYes
Selectable EU regionsNot listedYes
Zero-cost egress policyNot listedYes

Aruba Cloud

  • OpenStack public cloud + CMP

    Self-service Cloud Servers and Virtual Data Centers on OpenStack with AMD/NVMe-oriented SKUs, unlimited traffic on documented cloud-server lines, and management via the Aruba Cloud Management Platform, APIs, and prepaid credit wallet. Suits test/prod VMs and progressive scale-out inside Aruba's ecosystem—not a hyperscaler global catalog.

  • VMware private cloud (Pinnacle Partner)

    Hosted Private Cloud, Virtual Private Cloud via VMware Cloud Director, unified storage, and DRaaS-style options using enterprise stacks (vendor materials cite Zerto, Veeam, vSphere tooling). Built for teams standardizing on VMware who want European hosting without running their own gear.

  • Bare metal and GPU for private AI

    Dedicated servers in Italian Rating 4 data centers (Arezzo/Bergamo and others) with configurable networking (firewall/switch add-ons) and GPU SKUs aimed at private AI/ML. Full root control and isolation; buyer owns OS security and backups unless add-on protection is purchased.

  • Managed Kubernetes and cloud-native stack

    Managed Kubernetes, Application Platform (container/PaaS), container registry, agentless backup for K8s/VDC, plus ArubaKube R&D around open-source multi-cluster projects such as Liqo. Good for EU teams wanting managed containers without leaving Aruba's network.

  • Object/block storage and enterprise backup

    S3-compatible object storage, block volumes, smart storage, and backup packages (vendor stacks include Veeam and Commvault). Use for data protection and hybrid DR—not automatic full-workload backup unless you buy and configure those services.

  • European region choice with Italian ACN path

    Place workloads across proprietary Italian and Czech sites plus partner zones in France, Germany, the UK, and Poland. Italian ACN-qualified IaaS/PaaS/SaaS positioning targets public administration and regulated suppliers; confirm exact qualified SKUs and region pins in procurement.

UpCloud

  • MaxIOPS clustered block storage

    In-house all-flash block tier rated up to ~100,000 read IOPS at 4K, separate from compute hosts, with Standard and Archive tiers for capacity. Attach up to 16 devices per server (up to 64 TB total); encryption at rest optional. Suits databases and I/O-heavy apps that outgrow commodity cloud disks.

  • Cloud Servers on AMD EPYC with automation

    Linux/Windows VMs with Starter, Premium, and Cloud Native plan families, hot resize options, firewall, utility and SDN private networking. Full lifecycle via control panel, REST API, CLI, Terraform/OpenTofu, Pulumi, and Crossplane—for teams automating fleets rather than clicking one-off VPS.

  • CNCF Managed Kubernetes (UKS)

    Managed control planes with CNCF-certified Kubernetes versions, autoscaler integration, CSI block volumes, load-balancer integration, and private-only clusters. Worker nodes use ordinary Cloud Server plans including Private Cloud hosts—good fit when you want K8s without running etcd yourself.

  • Managed PostgreSQL, MySQL, Valkey, OpenSearch

    Turnkey databases with automated backups, multi-node HA options, private utility/SDN connectivity, and point-in-time recovery on relational plans. Reduces ops load for product teams that still want open engines rather than proprietary hyperscaler databases.

  • Customer-selected global regions (EU-first footprint)

    Fifteen data centers across twelve countries: dense Northern/Central Europe (Helsinki x2, Stockholm, Stavanger, Copenhagen, Amsterdam, Frankfurt, Madrid, Warsaw, London) plus US, Singapore, and Sydney. Customer Data stays in the chosen zone unless you request a move—use EU zones for residency programmes.

  • Zero-cost egress packaging and 99.999% SLA line

    Public pricing emphasises no per-GB internet egress charges under a Fair Transfer Policy, plus Premium-class 99.999% SLA with service credits for unscheduled downtime. Simplifies bills for chatty APIs and multi-service architectures compared with classic egress meters—confirm fair-use limits for extreme transfer cases.

Assurance & compliance: Aruba Cloud vs UpCloud
Assurance & complianceLogo: Aruba CloudAruba CloudLogo: UpCloudUpCloud
Independent security / no-logs audit
Not applicable

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

Vendor claimed

Vendor states cloud services audited against Finnish PiTuKri criteria by an independent firm; ISO 27001 ISMS regularly audited. Public PiTuKri report not fully reproduced on marketing pages—request artefacts.

ISO 27001
Vendor claimed

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

Vendor claimed

Vendor asserts ISO 27001 certified ISMS and publishes certificate PDF; independent registry re-check not completed in this draft.

SOC 2 / SOC 3
Not found

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Not found

Facility providers list SOC reports; no clear first-party UpCloud SOC 2 Type II product claim found on compliance pages reviewed.

ISAE 3402
Vendor claimed

Certificate/report PDF linked from data-protection resources page.

Not listed
GDPR / EU data protection
Vendor claimed

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

Vendor claimed

Finnish controller/processor under GDPR; customer chooses region; DPA in ToS; CISPE Code of Conduct adherence claimed.

US CLOUD Act exposure (indicative)
Partial

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

Partial

Finnish entity / no known US parent; EU-region VMs can avoid US storage. Material exceptions: optional US DCs, US/SG support affiliates for account ops, US colocations if selected. Assessment not a vendor safety claim. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Vendor claimed

DPA incorporated into Terms of Service; binding on acceptance without separate signature per vendor.

CISPE Code of Conduct
Vendor claimed

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Vendor claimed

Vendor states adherence to CISPE data protection code for cloud infrastructure providers.

ACN qualification (Italian PA)
Vendor claimed

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Not listed
EU AI Act
Not applicable

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Not applicable

General-purpose IaaS/platform; not an AI system provider by primary product.

Considerations & known limitations: Aruba Cloud vs UpCloud
Considerations & known limitationsLogo: Aruba CloudAruba CloudLogo: UpCloudUpCloud
Subprocessor list not fully public
Medium

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

Not listed
Partner zones and multi-region choice
Low

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Not listed
Customer-owned backups and OS security
Medium

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

Not listed
Narrower managed PaaS than hyperscalers
Low

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

Not listed
Certificate scope must be verified
Low

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

Not listed
Optional non-EU regions and support accessNot listed
Medium

US, Singapore, and Sydney zones are first-class options. Mis-pinned workloads or defaults can place Customer Data outside the EU. Account information is accessible to non-EEA support staff even when VMs stay in Europe.

Narrower catalogue than hyperscalersNot listed
Low

Strong IaaS and focused managed services; missing many proprietary AWS/Azure/GCP PaaS and AI products. Multi-cloud or dual-vendor designs may still be required.

Limited public SOC 2 for UpCloud entityNot listed
Medium

ISO 27001 and PiTuKri claims are published; a customer-facing SOC 2 Type II for UpCloud itself was not found. Enterprise questionnaires may need NDA artefacts or reliance on ISO plus facility reports.

Colocation facility dependencyNot listed
Low

Platform runs in third-party data centres. Facility certifications differ by site; treat them as complementary to UpCloud’s own ISMS, not a substitute for vendor due diligence.

Fair Transfer Policy on zero egressNot listed
Low

Zero-cost egress is a commercial differentiator but is governed by a Fair Transfer Policy—extreme or abusive transfer patterns may fall outside the marketing promise. Validate for CDN-scale or bulk egress designs.

Fit

Aruba Cloud

Best fit when

  • Italian or EU orgs that want compute under Aruba S.p.A. with primary hosting on Aruba-owned Italian/Czech data centers
  • Public administration and regulated suppliers needing ACN-qualified cloud SKUs (confirm product scope)
  • VMware shops seeking Hosted Private Cloud / VPC / DRaaS without US hyperscaler tenancy
  • Teams mixing OpenStack VMs, Managed Kubernetes, object storage, and bare metal/GPU for private AI
  • Buyers who value Italian-language 24/7 support, CMP self-service, and prepaid credit cost control

Poor fit when

  • Workloads that need a hyperscaler-wide global region map and deep managed PaaS catalogs (AWS/Azure-class)
  • Teams that require a fully public, always-updated subprocessor page without a customer request
  • Buyers who only want lowest-cost bare metal/VPS and do not need VMware, ACN, or enterprise packaging (Hetzner-class shortlists)
  • Strict Italy-only residency without validating region selection (partner zones include FR/DE/UK/PL)

Consider instead when

  • When: You need larger multi-country European scale or a broader global PoP footprint than Aruba's network

    Consider: OVHcloud

    French-scale European IaaS; different PA quals and product tree.

  • When: You prioritize developer-centric instance catalogs and simpler Paris/Amsterdam-style public cloud

    Consider: Scaleway

    Stronger developer UX; less Italian ACN/VMware private-cloud depth.

  • When: You need US hyperscaler ecosystem density, global managed services, and marketplace breadth

    Consider: Amazon Web Services (AWS) or Microsoft Azure

    US-parent platforms with different jurisdictional posture.

  • When: You mainly want cost-oriented German bare metal/VPS with less enterprise packaging

    Consider: Hetzner

    Different country anchor and compliance story; compare catalogs carefully.

UpCloud

Best fit when

  • EU product teams needing IaaS with Finnish legal entity and pin-to-zone residency
  • Workloads sensitive to block I/O that benefit from MaxIOPS-class SSDs
  • Cloud-native stacks on managed Kubernetes plus managed PostgreSQL/MySQL/Valkey
  • Multi-service apps where predictable outbound transfer packaging matters
  • Agencies and SaaS operators standardising on API/Terraform automation

Poor fit when

  • Organisations that require a full hyperscaler catalogue (proprietary AI/PaaS breadth)
  • Buyers optimising solely for the lowest-cost bare metal or unlimited-traffic VPS
  • Programmes that forbid any non-EU group support access to account metadata without extra controls
  • Teams that will deploy only to US regions yet still market the stack as EU-sovereign

Consider instead when

  • When: You need cheaper raw compute or dedicated servers more than managed K8s packaging

    Consider: Hetzner

    Often stronger on price for VPS/dedicated; compare managed service depth separately.

  • When: You want a broader French/EU public-cloud portfolio or different regional SKUs

    Consider: OVHcloud or Scaleway

    Different product breadth and commercial culture; still European-operated peers.

  • When: You need hyperscaler-managed platforms, global enterprise contracts, or deep marketplace ecosystems

    Consider: AWS, Google Cloud, or Microsoft Azure

    Trade European HQ simplicity for catalogue depth and global account teams.

  • When: You want a compact European cloud with Swiss roots and a tighter region set

    Consider: Exoscale

    Compare region map and managed feature parity to UpCloud’s 15-DC footprint.

Open questions for due diligence

Aruba Cloud

  • What is the current named subprocessor list (group companies and third parties) for the exact SKUs we will buy?
  • Which products and sites are in scope for the latest ISO 27001 / 27017 / 27018 certificates and ACN AI3/QC3 qualifications?
  • Can we pin workloads exclusively to Italian proprietary DCs (IT1–IT4) with contractual residency language?
  • What customer audit rights, ISAE/SOC report access, and DPA signature process apply to our legal entity?
  • For hybrid designs, which interconnect options touch US-group clouds, and can those be excluded?

UpCloud

  • Obtain current ISO 27001 certificate scope/dates and any PiTuKri or other audit reports under NDA if required.
  • Confirm DPA Appendix 1 legal names and countries of all group-company subprocessors for your service mix.
  • Document which regions and backup/object-storage endpoints will be allow-listed for EU-only programmes.
  • Ask whether a SOC 2 or equivalent report for UpCloud Oy is available for enterprise review.
  • Validate Fair Transfer Policy thresholds for your expected egress profile.