Elastx vs IONOS

Compare Elastx and IONOS on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

IONOS

Germany· Cloud Computing

Needs review

Shortlist IONOS when you want a German-operated hosting + public cloud stack with EU location choice, managed Kubernetes, S3 storage, and public BSI-oriented cloud certifications for DACH buyers. Skip when you need hyperscaler service breadth, EU-only infrastructure with no US regions or US facility partners in the path, or lowest-cost bare metal—consider OVHcloud, Scaleway, Hetzner, or STACKIT instead depending on that gap.

German SE (Montabaur)EU + US cloud regionsManaged KubernetesS3 Object StorageBSI C5 Type 1 (claimed)Domains + SMB hosting

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs IONOS: Snapshot
Feature	Elastx	IONOS
Country of origin	Sweden	Germany
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Sweden	Germany
Legal entity	Elastx AB	IONOS SE (HRB 24498, Amtsgericht Montabaur); group listed as IONOS Group SE
Governing law	Not listed	German / EU (confirm per contract and national affiliate)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	IONOS-operated and partner facilities in Europe (e.g. Berlin, Frankfurt—including Equinix-operated sites—Paris, Logroño, London, Worcester, Karlsruhe) and the US (Las Vegas, Newark, Lenexa). Object Storage and compute location chosen per resource. Backup Service uses Acronis technology; managed backup path described as DE ISO 27001 centers. Optional Microsoft 365 / Google Workspace resale.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	German hosting and cloud provider (IONOS SE): domains and SMB web hosting plus IONOS Cloud IaaS/PaaS with EU and US locations, managed Kubernetes, object storage, and DBaaS.
Tags	cloud kubernetes iaas openstack swedish-cloud data-sovereignty dbaas	cloud kubernetes iaas hosting infrastructure germany gdpr smb

At a glance: Elastx vs IONOS
At a glance	Elastx	IONOS
HQ	Stockholm, Sweden (Elastx AB)	Montabaur, Germany (IONOS SE)
Founded	2012	Not listed
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	Hosting packages + cloud usage (per-minute style)
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Group	Not listed	United Internet / IONOS Group SE (listed)
Product lines	Not listed	Domains & hosting + IONOS Cloud IaaS/PaaS
Cloud regions	Not listed	DE, FR, ES, UK + US (e.g. LAS, EWR, MCI)
Open source	Not listed	No (proprietary platform)
Self-host	Not listed	No

Key capabilities: Elastx vs IONOS
Key capabilities	Elastx	IONOS
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
German SE (Montabaur)	Not listed	Yes
EU + US cloud regions	Not listed	Yes
Managed Kubernetes	Not listed	Yes
S3 Object Storage	Not listed	Yes
BSI C5 Type 1 (claimed)	Not listed	Yes
Domains + SMB hosting	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

IONOS

Virtual Data Center Designer and IaaS compute
Build isolated virtual data centers in the browser or via Cloud API: dedicated-core servers, vCPU servers, and Cubes with attached NVMe. Live vertical scaling is supported on many Linux images for cores, RAM, NICs, and volumes without a full rebuild. Locations span DE (Berlin, Frankfurt, Karlsruhe), FR, ES, UK, and US.
Managed Kubernetes without a separate control-plane fee
Automated cluster and node-pool setup with geo-redundant control plane, admin API access, and optional node auto-scaling. IONOS documents the managed control plane as free of charge; you pay for the underlying compute, storage, and network only—useful for staging and production clusters on the same contract.
S3-compatible Object Storage across EU and US endpoints
Contract-included Object Storage with S3 API compatibility, versioning, object lock, SSE-S3/SSE-C, and lifecycle rules. Documented endpoints include Frankfurt, Berlin, Logroño, and Lenexa (US). German object-storage locations are listed with BSI IT-Grundschutz compliance notes in the service catalog.
Managed databases, GPU VMs, and Berlin-hosted AI Model Hub
DBaaS for PostgreSQL, MongoDB, MariaDB, and in-memory DB; Cloud GPU VMs (NVIDIA H200 templates) in Frankfurt; AI Model Hub with OpenAI-compatible APIs, RAG/vector support, and vendor-stated processing exclusively in Germany (Berlin). Fits teams that want European inference without standing up their own GPU estate.
Domains, web hosting, and personal consultant for SMBs
Classic IONOS portfolio: domain registration, shared/VPS/dedicated hosting, site builders, and optional Microsoft 365 or Google Workspace. Differentiator for non-cloud buyers is a dedicated personal consultant plus 24/7 support channels—not pure ticket-only self-serve hosting.

Assurance & compliance: Elastx vs IONOS
Assurance & compliance	Elastx	IONOS
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	Partial BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Vendor claimed Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Not found SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed.
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Vendor claimed Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex.
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Partial Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence.
BSI C5 (Cloud Computing Compliance Criteria Catalogue)	Not listed	Vendor claimed Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope.

Considerations & known limitations: Elastx vs IONOS
Considerations & known limitations	Elastx	IONOS
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
US regions, US entities, and facility partners	Not listed	Medium Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews.
No clear public subprocessor catalogue	Not listed	Medium Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.).
C5 Type 1 scope and freshness	Not listed	Low Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports.
Narrower managed ecosystem than hyperscalers	Not listed	Low Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor.
Hosting brand vs cloud platform complexity	Not listed	Low SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

IONOS

Best fit when

SMB and agencies needing domains, hosting, email/office resale, and a personal consultant under one German brand
Teams building IaaS workloads in selectable EU locations with a visual Data Center Designer and full Cloud API
Organizations that want managed Kubernetes, DBaaS, and S3-compatible storage without a hyperscaler contract
DACH public-sector or regulated buyers who need documented BSI C5 / IT-Grundschutz posture on scoped cloud products (confirm current report)
AI or inference pilots that prefer vendor-stated Germany (Berlin) hosting for AI Model Hub

Poor fit when

Buyers requiring a guarantee of no US legal entities, no US regions, and no US-group facility partners anywhere in the path
Workloads that depend on the full AWS/Azure/GCP marketplace, global region density, or niche managed services IONOS does not offer
Price-only bare-metal or Hetzner-style DIY shops that do not need managed PaaS or SMB hosting layers
Teams that refuse any US-group SaaS (Microsoft 365 / Google Workspace) if those bundles are part of the intended stack

Consider instead when

When: You want French-operated cloud with strong developer packaging and EU focus without a mass-market hosting brand
Consider: Scaleway
Different product mix; compare region map and managed services side by side.
When: You prioritize large European hosting/cloud scale and multi-country DC ownership narratives
Consider: OVHcloud
Both are EU groups with non-trivial international footprints—read residency options carefully.
When: You mainly need cost-efficient dedicated servers or simple cloud in DE/FI with minimal PaaS
Consider: Hetzner
Thinner managed layer; different support and SMB hosting model.
When: You are already in Schwarz Group ecosystems or need STACKIT-specific public-cloud positioning
Consider: STACKIT
Narrower commercial brand than IONOS hosting+cloud combo.

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

IONOS

What is the current BSI C5 report type (Type 1 vs Type 2), validity period, and exact product/location scope?
Can IONOS provide a consolidated subprocessor and sub-processor change-notification list under the DPA/AVV?
Which contract entity (IONOS SE vs IONOS Cloud GmbH vs national affiliates) will sign for our workload and which TOMs apply?
For EU-only deployments, are any support, monitoring, or backup control-plane components processed outside the EU?
Is ISO 27001 held by IONOS operating companies for the full service stack, or primarily facility/operator certifications?