Cyso Cloud vs Elastx

Compare Cyso Cloud and Elastx on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Cyso Cloud

Netherlands· Cloud Computing

Needs review

Shortlist Cyso Cloud when you want Dutch-operated OpenStack IaaS and KCSP managed Kubernetes with AMS/FRA residency and engineer-to-engineer support. Skip when you need global hyperscaler regions or default encryption-at-rest object storage—consider OVHcloud or Scaleway for broader European multi-region IaaS, or keep a hyperscaler for worldwide PaaS depth.

EU-operated (NL)OpenStack IaaSManaged Kubernetes (KCSP)AMS + FRA regionsISO 27001 (claimed)NEN 7510 (claimed)

View listing Visit Website

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Highlighted rows differ between the two products.

Cyso Cloud vs Elastx: Snapshot
Feature	Cyso Cloud	Elastx
Country of origin	Netherlands	Sweden
Category	Cloud Computing	Cloud Computing
Open source	Yes	No
Self-hosted	No	No
Headquarters	Netherlands	Sweden
Legal entity	Cyso B.V. (part of Cyso Group B.V.), Wognumsebuurt 3, 1817 BH Alkmaar; KVK 37133395	Elastx AB
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Primary public IaaS on Cyso-operated hardware in Tier 3 facilities in Amsterdam and Frankfurt (3 AZs per region); vendor states storage replicas/backups stay in the selected EU region. Not marketed as AWS/Azure/GCP-hosted IaaS. Ancillary tools disclosed at group level include website analytics (PostHog) and third parties for payments/support; status tooling has referenced Atlassian Statuspage. Full public customer-workload subprocessor list not found.	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.
Summary	Dutch OpenStack IaaS from Cyso B.V. with AMS/FRA regions, managed Kubernetes (KCSP), S3-compatible object storage, and EU data residency for teams avoiding hyperscaler lock-in.	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.
Tags	cloud iaas openstack kubernetes gdpr netherlands eu-hosting sovereign-cloud	cloud iaas openstack kubernetes swedish-cloud data-sovereignty dbaas

At a glance: Cyso Cloud vs Elastx
At a glance	Cyso Cloud	Elastx
HQ	Alkmaar, Netherlands	Stockholm, Sweden (Elastx AB)
Legal entity	Cyso B.V. (Cyso Group)	Not listed
Founded	1997 (group); public OpenStack cloud since 2016 (Fuga); Cyso Cloud brand 2025	2012
Regions	Amsterdam, Frankfurt (more under investigation)	Not listed
Stack	OpenStack + managed Kubernetes (KCSP)	Not listed
Commercial model	Pay-as-you-go / hourly; optional trial via sales	Hourly usage; no long-term lock-in contracts (vendor)
Primary region	Not listed	se-sto — 3 AZs in Stockholm area
Core stack	Not listed	OpenStack IaaS, Kubernetes CaaS, DBaaS
Ownership	Not listed	Swedish PE Sobro majority (~53%); no known US parent

Key capabilities: Cyso Cloud vs Elastx
Key capabilities	Cyso Cloud	Elastx
EU-operated (NL)	Yes	Not listed
OpenStack IaaS	Yes	Not listed
Managed Kubernetes (KCSP)	Yes	Not listed
AMS + FRA regions	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
NEN 7510 (claimed)	Yes	Not listed
Swedish OpenStack IaaS	Not listed	Yes
Multi-AZ managed Kubernetes	Not listed	Yes
Managed DBaaS	Not listed	Yes
ISO 27001/27017/27018 (claimed)	Not listed	Yes
Sweden data residency	Not listed	Yes
Hourly, no lock-in contracts	Not listed	Yes

Cyso Cloud

OpenStack public IaaS on EU hardware
Vanilla OpenStack compute (roughly 2–64 vCPUs and up to 512 GB RAM flavors), NVMe-backed ephemeral and block volumes, dashboard plus OpenStack APIs/CLI. Deployed on Cyso-managed hardware in Amsterdam and Frankfurt with three availability zones per region so multi-AZ designs are first-class.
S3-compatible NVMe object storage
Region-scoped object storage with triple-disk redundancy, versioning, lifecycle rules, object lock, pre-signed URLs, and standard S3 clients (AWS CLI, Rclone, MinIO mc, SDKs). Data and replicas stay in the selected AMS or FRA region; default server-side encryption at rest is not applied—plan client-side or customer-key approaches for sensitive objects.
Enterprise Managed Kubernetes (KCSP)
CNCF Kubernetes Certified Service Provider managed control planes with multi-version support, automated upgrades, worker groups (including GPU/high-memory options), HPA/VPA/node autoscaling, Garden Linux workers, Terraform/kubectl/k9s workflows, and cluster hibernation to scale workers to zero on a schedule.
European networking and multi-AZ design
VPC-style private networks, security groups as virtual firewalls, load balancers with health checks, floating/reserved IPs, Anycast DNS, IPv6 dual-stack, native edge DDoS mitigation, and Direct Connect-style private links. SLA text targets 99.99% monthly uptime for listed compute, volume, object, and networking services when multi-AZ conditions are met.
Private cloud and wholesale options
Same OpenStack-based stack can be deployed as a private cloud on customer data-centre hardware (including VMware-alternative messaging) or white-label/wholesale models for partners—useful when public multi-tenant regions are not enough for isolation or residency policy.

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Assurance & compliance: Cyso Cloud vs Elastx
Assurance & compliance	Cyso Cloud	Elastx
Independent security / no-logs audit	Not found Security measures and pen-testing philosophy are described; no public independent no-logs or IaaS audit report found beyond ISMS certs.	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.
ISO 27001	Vendor claimed Vendor publishes ISO/IEC 27001 certificate PDF via Trust Centre / certifications (listed expiry into 2028). Not re-checked on an independent registry for this draft.	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.
SOC 2 / SOC 3	Not found Certifications page explains SOC 2 Type II generally; no clear statement that Cyso currently holds a published SOC 2 report.	Not found No SOC 2/3 claim found on official product/trust pages reviewed.
GDPR / EU data protection	Vendor claimed EU legal entity; AMS/FRA residency claims; Trust Centre GDPR section. Obtain DPA and TOMs for controller/processor mapping.	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: EU entity, no known US parent, primary IaaS claimed on self-operated NL/DE hardware (not AWS/GCP/Azure). Partial because no full public subprocessor schedule and ancillary SaaS (e.g. PostHog analytics, Atlassian-linked status) may involve non-EU providers. Not legal advice.	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Marketing (e.g. Azure alternative pages) states Cyso signs a DPA under Dutch law; confirm current template and subprocessor annex in contracting.	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.
NEN 7510 (Dutch healthcare information security)	Vendor claimed Vendor publishes NEN 7510 certificate PDF on certifications/Trust Centre pages.	Not listed
EU AI Act	Not applicable IaaS/infrastructure platform, not an AI system product.	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.
ISO 14001 (environmental)	Not listed	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.

Considerations & known limitations: Cyso Cloud vs Elastx
Considerations & known limitations	Cyso Cloud	Elastx
Only two live public regions	Medium Production public cloud is AMS and FRA today. Multi-continent latency, in-country residency outside NL/DE, or extensive multi-region DR across Europe may require another provider or private cloud.	Not listed
No default object storage encryption at rest	Medium Official FAQs state no standard server-side encryption at rest; TLS in transit and client-side/SSE-C patterns are recommended. Regulated designs must implement key management outside default storage behaviour.	Not listed
Incomplete public subprocessor inventory	Medium Primary hosting path is vendor-operated EU hardware, but privacy materials list third parties without a dedicated live subprocessor register for all ancillary processing. Request the schedule under NDA or DPA annex.	Not listed
Certifications are vendor-published PDFs	Low ISO 27001 and NEN 7510 are claimed with certificate PDFs on Cyso sites; this draft did not independently verify registry entries. Treat as claimed until audit pack is reviewed.	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.
Smaller ecosystem than hyperscalers	Low Fewer managed PaaS services and marketplace options than AWS/Azure/GCP. Expect to run more of the stack yourself on OpenStack/Kubernetes.	Not listed
No public subprocessor inventory	Not listed	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.
OpenStack operational constraints	Not listed	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.
Sweden-centric footprint	Not listed	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.

Fit

Cyso Cloud

Best fit when

European product/SaaS teams that need VMs, volumes, and S3-compatible storage with explicit Amsterdam or Frankfurt residency
Organisations standardising on OpenStack APIs/CLI to reduce hyperscaler lock-in and support multi-cloud portability
Teams wanting CNCF KCSP managed Kubernetes with hibernation and pay-as-you-go worker nodes on EU infrastructure
Dutch healthcare-adjacent or regulated buyers who need NEN 7510 alongside ISO 27001 claims from a NL operator
Buyers evaluating a private OpenStack cloud or VMware alternative on their own data-centre hardware

Poor fit when

Workloads that require many global regions, edge PoPs, or a large marketplace of managed PaaS services
Storage designs that assume default server-side encryption at rest without customer-managed keys
Procurement that must rely only on a fully published subprocessor schedule without vendor engagement
Teams that need fully self-serve free tiers or only automated chat support with no human engineering contact

Consider instead when

When: You need many European (or global) regions and a broader product catalogue than two live IaaS regions
Consider: OVHcloud or Scaleway
Larger EU multi-region footprints; different APIs and commercial models.
When: You want Swiss multi-zone simplicity with strong managed Kubernetes emphasis
Consider: Exoscale
Swiss operator profile; fewer regions than hyperscalers but clear sovereignty messaging.
When: You need maximum global PaaS depth, AI services, and worldwide edge
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership for ecosystem breadth; apply your own residency and CLOUD Act analysis.
When: You prioritise high-performance European VMs across more city locations than AMS/FRA only
Consider: UpCloud
Different stack; compare residency guarantees and support model side by side.

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Open questions for due diligence

Cyso Cloud

Can Cyso provide the current DPA, technical and organisational measures, and a dated subprocessor list covering payments, support, analytics, and status tooling?
What is the exact OpenStack release, upgrade cadence, and any divergences from upstream APIs that affect Terraform/automation?
For object storage and volumes, what encryption-at-rest or KMS options can be contractually committed for regulated data?
What are contractual 24/7 escalation SLAs for severity-1 incidents beyond office-hours tech-to-tech support?
Which additional EU regions (if any) have committed go-live dates versus community voting only?

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?