Elastx vs Leaseweb

Compare Elastx and Leaseweb on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Leaseweb

Netherlands· Cloud Computing

Needs review

Shortlist when you want a Dutch (or other local Leaseweb) B2B contract for dedicated servers, CloudStack public cloud, colo, or regional object storage, and you will pick the DC yourself. Skip when you need EU-only halls with no US affiliate in the group, a hyperscaler-width managed-platform catalog, or self-serve hobby VPS without KYC. Consider Hetzner or OVHcloud for simpler EU-centric IaaS, or AWS if you need the global managed-service surface.

Dutch sales entityDedicated / bare metalCloudStack KVM public cloudS3-compatible object storageColo + global DCsISO 27001 (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs Leaseweb: Snapshot
Feature	Elastx	Leaseweb
Country of origin	Sweden	Netherlands
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Sweden	Netherlands
Legal entity	Elastx AB	Leaseweb Netherlands B.V. (KvK 30141839, Amsterdam). Website: Leaseweb Global B.V. (KvK 60593652). Other local sales entities exist.
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	Customer-chosen Leaseweb halls (Amsterdam, Frankfurt, London, plus US, CA, SG, HK, AU). Object storage: nl-01, de-01, uk-01, us-01, ca-01, sg-01. Optional Cloud Connect via Megaport to AWS, Google Cloud, Azure. Public Cloud backup row lists Acronis. NL Feb 2026 terms keep that entity on Dutch DCs unless law, written authorisation, or customer action. Sub-processor list on request.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	Dutch B2B IaaS: dedicated servers, CloudStack public cloud, colocation, and S3-compatible object storage on a global hall list under local sales entities.
Tags	iaas cloud openstack kubernetes swedish-cloud data-sovereignty dbaas	iaas dedicated-servers bare-metal colocation object-storage cloudstack netherlands gdpr b2b

At a glance: Elastx vs Leaseweb
At a glance	Elastx	Leaseweb
HQ	Stockholm, Sweden (Elastx AB)	Amsterdam, Netherlands
Founded	2012	1997 (vendor 2022 press)
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	B2B contract, monthly or hourly cloud, KYC on first order
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Typical NL contract	Not listed	Leaseweb Netherlands B.V. (KvK 30141839)
Website operator	Not listed	Leaseweb Global B.V. (KvK 60593652)
Product type	Not listed	B2B IaaS (dedicated, cloud, colo, object storage); not self-hosted, not open source
Published dedicated DCs	Not listed	AMS-01/02, FRA-10, LON-01/11, MTL-02, SIN-01, HKG-10, SYD-10, plus nine US halls
Object storage regions	Not listed	nl-01, de-01, uk-01, us-01, ca-01, sg-01

Key capabilities: Elastx vs Leaseweb
Key capabilities	Elastx	Leaseweb
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
Dutch sales entity	Not listed	Yes
Dedicated / bare metal	Not listed	Yes
CloudStack KVM public cloud	Not listed	Yes
S3-compatible object storage	Not listed	Yes
Colo + global DCs	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Leaseweb

Dedicated servers with portal, API, and Instant Delivery
Bare metal for databases, analytics, gaming, and e-commerce. The knowledge base lists Windows or Linux images, Volume or Premium transit, interconnects, and Layer 2 private networking. First orders are phone-verified. Instant Delivery SKUs can provision within an hour; custom builds take longer. CPU cannot be upgraded in place.
CloudStack Public Cloud on KVM
Instances run on Leaseweb-owned CloudStack KVM with general-purpose, compute, memory, and GPU-oriented families. Billing is hourly on-demand or monthly. Local NVMe is faster but slower to recover if a hypervisor fails. Central NFS storage is the higher-availability path. Each instance gets one public IPv4. Extra IPv4 is not offered yet.
S3-compatible object storage with named regions
HTTPS/S3 API buckets at nl.object-storage.io, de.object-storage.io, uk.object-storage.io, us.object-storage.io, ca.object-storage.io, and sg.object-storage.io. Leaseweb says objects are stored in three availability zones. The default S3 region name us-east-1 is a compatibility alias, not a geography. Keys are created in the Customer Portal.
Colocation with remote hands
Bring your own servers into Leaseweb halls. Shared 1U to 5U is only in AMS-01 and FR-01. Private racks and cages are for larger or more isolated deployments. Remote hands are 24/7 and included by default, with higher packages available. Colo knowledge base counts six European halls (Netherlands, Germany, UK), seven in Asia-Pacific and Oceania, and twelve in the US and Canada.
Private network and Cloud Connect to hyperscalers
Layer 2 private networking can join dedicated servers, Public Cloud, VMware products, and colo in the same DC (and some metro pairs). Cloud Connect uses Megaport SDN plus a Leaseweb router to reach AWS, Google Cloud, and Azure from selected halls (including AMS-01/02, FRA, London, WDC-02, Singapore, Montreal, Sydney). Redundant paths are Active-Standby. Delivery is quoted in business days via sales.
Customer Portal, REST API, and Terraform
Operators power-cycle, reinstall, rescue, manage IPs, attach private networks, and watch traffic graphs without a ticket for routine work. developer.leaseweb.com documents the REST API, GitHub integrations, a Terraform provider for Leaseweb Cloud, and S3 compatibility. This is not a self-hosted control plane you run yourself.

Assurance & compliance: Elastx vs Leaseweb
Assurance & compliance	Elastx	Leaseweb
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	Not found IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Vendor claimed Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Partial SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Vendor claimed Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Not applicable IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.
PCI DSS	Not listed	Partial Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.
NEN 7510	Not listed	Vendor claimed Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.
CISPE IaaS Code of Conduct	Not listed	Vendor claimed Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.

Considerations & known limitations: Elastx vs Leaseweb
Considerations & known limitations	Elastx	Leaseweb
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
Global catalog includes US halls and a US affiliate	Not listed	Medium Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.
No public IaaS subprocessor register	Not listed	Medium NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).
Certification scope is entity- and service-specific	Not listed	Low ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.
Public Cloud / VPS IPv4 and Elastic Compute end of sale	Not listed	Low Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Leaseweb

Best fit when

Teams that want a KvK-identifiable Dutch contractor (Leaseweb Netherlands B.V.) for IaaS, not a US parent
Operators placing dedicated servers or colo in named halls (Amsterdam, Frankfurt, London, plus optional non-EU cities)
Workloads that need CloudStack KVM or S3-compatible buckets with an explicit nl-01 / de-01 / uk-01 endpoint
Hybrid designs that keep origin on Leaseweb metal and optionally Cloud-Connect to AWS, Google Cloud, or Azure
Buyers who will use the Customer Portal, REST API, or Terraform rather than a fully managed PaaS

Poor fit when

Organisations that forbid any US group company, US datacentre option, or US-region object storage in the same vendor catalog
Teams that need extra public IPv4 on Public Cloud or VPS (docs: one IPv4, extras not yet available)
Buyers looking for a self-hosted control plane or an open-source product they operate themselves
People who actually wanted Leaseweb Multi-CDN rather than compute and colo
Hobby or consumer hosting: NL terms state B2B only, with KYC on first order

Consider instead when

When: You want a larger managed-cloud catalog (IAM, managed databases, serverless) and accept a US parent
Consider: Amazon Web Services (AWS) or Google Cloud Platform
Different jurisdiction and product surface. Leaseweb stays IaaS-classic.
When: You want European IaaS with a simpler EU-centric hall list and strong self-serve dedicated servers
Consider: Hetzner or OVHcloud
Still diligence their own non-EU options. Neither is a Leaseweb contract.
When: You want French public cloud with object storage and more developer-cloud SKUs
Consider: Scaleway
Different product mix. Confirm current regions on Scaleway's site.
When: You mainly need a German-group host with a broad SMB catalog
Consider: IONOS
Different ownership and SKU mix than Leaseweb's local-entity IaaS model.
When: You actually needed global content delivery, not origin compute
Consider: Leaseweb CDN
Same group, different data path (partner CDNs and a Washington D.C. shield).

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

Leaseweb

For the SKUs we will buy, what is the current ISO 27001 statement of applicability (and is object storage in scope)?
Will Leaseweb issue the current sub-processor list for this order, including Acronis and Megaport if used?
Can the contract freeze region to named EU halls and forbid US-affiliate access except as Clause 8.3 allows?
What is the current Instant Delivery dedicated inventory in AMS/FRA versus US halls?
Is there a live CISPE public-register declaration for these IaaS services?