Elastx vs OVHcloud

Compare Elastx and OVHcloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

OVHcloud

France· Cloud Computing

Needs review

Shortlist OVHcloud when you need a European-owned IaaS/bare-metal stack with SecNumCloud/HDS options and multi-continent regions you control per project. Skip when you need hyperscaler platform depth, or when even optional US subsidiaries/regions are a procurement red line—consider Scaleway for leaner French cloud or Hetzner for simpler dedicated/VPS estates.

EU-operated (global regions)Bare Metal + Public CloudOpenStack Public CloudSecNumCloud Private CloudAnti-DDoS includedEU / US / CA / APAC

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs OVHcloud: Snapshot
Feature	Elastx	OVHcloud
Country of origin	Sweden	France
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Sweden	France
Legal entity	Elastx AB	OVH SAS / OVH Groupe (Roubaix); regional entities include OVH US LLC for US services
Governing law	Not listed	French/EU law for EU contracts; US terms apply for OVH US LLC-contracted services
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	Own global infrastructure: EU regions (FR including Paris 3-AZ, DE Limburg, PL Warsaw, UK Erith, IT Milan 3-AZ, many Local Zones); US (Vint Hill VA, Hillsboro OR); Canada (Beauharnois, Toronto); APAC (Singapore, Sydney, Mumbai). Primary hosting is OVH-operated, not AWS/GCP resale. Optional non-EU regions are first-class products.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	French cloud and infrastructure group (Roubaix): Bare Metal dedicated servers, OpenStack Public Cloud, Hosted Private Cloud (incl. SecNumCloud), and Web Cloud on OVH-operated datacentres across Europe, North America, and Asia-Pacific.
Tags	cloud openstack kubernetes iaas swedish-cloud data-sovereignty dbaas	cloud openstack infrastructure bare-metal gdpr secnumcloud european-cloud api

At a glance: Elastx vs OVHcloud
At a glance	Elastx	OVHcloud
HQ	Stockholm, Sweden (Elastx AB)	Roubaix, France (OVH SAS / OVH Groupe)
Founded	2012	1999 (Octave Klaba)
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	Hourly/monthly public cloud; dedicated server subscriptions; free public cloud trial credits (vendor)
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Hosting model	Not listed	Own datacentres and network; multi-region IaaS/bare metal
Open source product?	Not listed	No (OpenStack-based public cloud uses open APIs)
Notable certs (claimed)	Not listed	ISO 27001 family, SOC 1/2/3, HDS, SecNumCloud (Private Cloud), PCI DSS

Key capabilities: Elastx vs OVHcloud
Key capabilities	Elastx	OVHcloud
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
EU-operated (global regions)	Not listed	Yes
Bare Metal + Public Cloud	Not listed	Yes
OpenStack Public Cloud	Not listed	Yes
SecNumCloud Private Cloud	Not listed	Yes
Anti-DDoS included	Not listed	Yes
EU / US / CA / APAC	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

OVHcloud

Bare Metal dedicated servers (in-house hardware)
Physical servers assembled and operated by OVHcloud across ranges such as Advance, Scale, High Grade, and Game—full CPU/RAM/storage without a hypervisor layer. Water cooling and hardware lifecycle are part of the industrial model. Best for performance-sensitive, virtualisation, gaming, or large single-tenant workloads where you administer the OS.
OpenStack Public Cloud and managed PaaS
On-demand compute, multi-class object storage (S3-compatible API), block/file storage, managed databases, Kubernetes/container services, networking, and data/AI platforms. Deploy via Control Panel or OpenStack APIs with 1-AZ or 3-AZ region options (for example Paris and Milan). Suited to cloud-native and hybrid automation without US hyperscaler lock-in.
Hosted Private Cloud with SecNumCloud path
VMware-based Hosted Private Cloud (and related stacks) for dedicated virtualisation estates. Selected Private Cloud offerings hold French ANSSI SecNumCloud qualification, with customer data under European regulation and hosting in French sites (Roubaix, Gravelines, Strasbourg)—relevant for French public sector and sensitive workloads under Cloud at the Center doctrine.
Global multi-region footprint (EU, US, CA, APAC)
Own datacentres and regions spanning Europe (France, Germany, Poland, UK, Italy, many Local Zones), North America (Vint Hill VA, Hillsboro OR, Beauharnois and Toronto in Canada), and Asia-Pacific (Singapore, Sydney, Mumbai and related offerings). Choose residency for latency and law; do not assume EU-only by default.
Anti-DDoS and vRack private networking included
Network-integrated anti-DDoS mitigation is standard across services. vRack provides private L2 networking across eligible OVHcloud locations so bare metal, public, and private cloud can interconnect without public exposure. Public bandwidth is typically unmetered in Europe and North America with fair-use rules; Asia-Pacific often uses lower default bandwidth and monthly traffic caps—verify per SKU.

Assurance & compliance: Elastx vs OVHcloud
Assurance & compliance	Elastx	OVHcloud
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	Not applicable IaaS/hosting provider, not a no-logs VPN product. Security is covered via ISO/SOC programme rather than a public no-logs audit.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Vendor claimed Vendor compliance pages assert ISO/IEC 27001 (with 27017/27018) for cloud services and datacentres; US pages reference Schellman certificate directory. Confirm current scope per product and region.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Vendor claimed Vendor asserts SSAE 18 Type 2 SOC 1, SOC 2 (+NIST), and SOC 3 attestations; reports available to prospective customers under vendor process.
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed EU headquartered; GDPR compliance asserted; DPA documents published for relevant subsidiaries. Residency depends on chosen region.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial French group with no known US parent, but operates US datacentres (Vint Hill, Hillsboro) and OVH US LLC. Medium indicative exposure: EU-region workloads on EU contracts differ from US-region workloads. Not legal advice.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Vendor claimed Published DPAs form part of terms (e.g. OVH SAS Europe paths; separate US DPA for OVH US LLC). Obtain the DPA matching your contracting entity.
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Not applicable Core product is IaaS/bare metal/hosting; AI/ML platforms are optional infrastructure offerings, not a single AI system product under typical procurement framing.
ANSSI SecNumCloud	Not listed	Vendor claimed Hosted Private Cloud (VMware on OVHcloud and related) holds SecNumCloud qualification; hosted in French sites (Roubaix, Gravelines, Strasbourg). Not all products are SecNumCloud-qualified.
HDS (French health data hosting)	Not listed	Vendor claimed Vendor lists HDS certification for healthcare data hosting options; confirm which products and locations are in scope.
PCI DSS	Not listed	Vendor claimed Vendor asserts PCI DSS Level 1 certification for payment data hosting—confirm applicability to your architecture.

Considerations & known limitations: Elastx vs OVHcloud
Considerations & known limitations	Elastx	OVHcloud
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
US regions and US subsidiary	Not listed	Medium US East/West datacentres and OVH US LLC mean CLOUD Act and US process risk apply to US-placed data and some contracts. EU-only deployment reduces this but buyers must enforce region and contracting path.
2021 Strasbourg datacentre fire (resilience history)	Not listed	Medium A major fire at SBG caused widespread customer outages. Treat multi-AZ/multi-region backup design as mandatory for critical data; do not rely on single-site assumptions.
Certification scope is product- and region-specific	Not listed	Medium ISO, SOC, HDS, SecNumCloud, and PCI claims do not automatically cover every SKU and location. Procurement should request the exact report for the services ordered.
APAC bandwidth and traffic rules differ	Not listed	Low Vendor documents unmetered traffic exceptions for Asia-Pacific (lower default bandwidth and monthly volume caps vs Europe/North America). Model egress and bandwidth options for APAC workloads.
Broad catalogue complexity	Not listed	Low Bare Metal, Public Cloud, Private Cloud, and Web Cloud under one brand can confuse account structure, IAM, and billing. Define landing-zone standards early.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

OVHcloud

Best fit when

Teams wanting European ownership with optional global regions (EU, US, Canada, APAC) under one operator
Workloads that need exclusive Bare Metal performance or hybrid bare metal + OpenStack/vRack designs
French public sector or sensitive estates needing ANSSI SecNumCloud-qualified Hosted Private Cloud paths
Organisations standardising on OpenStack APIs and S3-compatible object storage for reversibility
Sites that benefit from network-integrated anti-DDoS and private multi-site networking as defaults

Poor fit when

Buyers who require the deepest managed AI/marketplace/IAM ecosystems of AWS, Azure, or GCP
Policies that forbid any provider with US legal entities or US datacentre options regardless of region selection
Teams seeking the simplest low-SKU VPS experience—Hetzner or similar may fit better
Anyone assuming EU-only residency without selecting and enforcing EU regions in architecture

Consider instead when

When: You want a leaner French public cloud with a strong developer product surface and less enterprise sovereign packaging
Consider: Scaleway
Often simpler for cloud-native teams; confirm region and compliance fit.
When: You primarily need price-performance VPS or dedicated servers with a smaller catalogue
Consider: Hetzner
Strong for lean estates; different sovereign/cert posture and global region set.
When: You need maximum managed-service breadth, global account tooling, and partner marketplace density
Consider: Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform
Hyperscalers win platform depth; accept US ownership and CLOUD Act parent exposure.
When: You want German SMB hosting plus cloud IaaS with EU and some non-EU options
Consider: IONOS
Different product mix and compliance packaging than OVHcloud's bare-metal industrial model.

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

OVHcloud

Which contracting entity and DPA (EU OVH SAS path vs OVH US LLC) will apply to our account?
Which exact products/regions are in scope for the ISO/SOC/HDS/SecNumCloud certificates we need?
What is our multi-region DR design given historical single-site fire risk?
Are any non-OVH subprocessors used for our specific managed services (support, monitoring, payments) beyond OVH-operated infrastructure?
Do APAC or Local Zone bandwidth/SLA terms meet our traffic profile?