Elastx vs Scaleway

Compare Elastx and Scaleway on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Scaleway

France· Cloud Computing

Needs review

Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.

EU-operated regionsBare metal + Elastic MetalEU GPU for AIKapsule KubernetesISO 27001 (certified)HDS (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs Scaleway: Snapshot
Feature	Elastx	Scaleway
Country of origin	Sweden	France
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Sweden	France
Legal entity	Elastx AB	SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris
Governing law	Not listed	French law (General Terms of Services)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe.
Tags	cloud kubernetes openstack iaas swedish-cloud data-sovereignty dbaas	cloud kubernetes infrastructure bare-metal gpu european-cloud gdpr hds api terraform

At a glance: Elastx vs Scaleway
At a glance	Elastx	Scaleway
HQ	Stockholm, Sweden (Elastx AB)	Paris, France (SCALEWAY SAS)
Founded	2012	Not listed
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	Pay-as-you-go; compute Savings Plans (GPU rules differ)
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Group	Not listed	iliad Group subsidiary
Regions	Not listed	Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed)
Model	Not listed	Public cloud IaaS/PaaS (not self-hosted)
Open source	Not listed	Platform proprietary; open standards (K8s, S3 API, Terraform)

Key capabilities: Elastx vs Scaleway
Key capabilities	Elastx	Scaleway
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
EU-operated regions	Not listed	Yes
Bare metal + Elastic Metal	Not listed	Yes
EU GPU for AI	Not listed	Yes
Kapsule Kubernetes	Not listed	Yes
ISO 27001 (certified)	Not listed	Yes
HDS (claimed)	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Scaleway

Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.

Assurance & compliance: Elastx vs Scaleway
Assurance & compliance	Elastx	Scaleway
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.
HDS (French health data hosting)	Not listed	Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.
CSA STAR Level 1	Not listed	Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).
ANSSI SecNumCloud	Not listed	Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Considerations & known limitations: Elastx vs Scaleway
Considerations & known limitations	Elastx	Scaleway
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
SecNumCloud not yet obtained	Not listed	Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.
Smaller service catalogue than US hyperscalers	Not listed	Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.
Account-plane processors and possible non-EU transfers	Not listed	Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.
Shared responsibility for guest security	Not listed	Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.
Dedibox vs Elastic Metal product split	Not listed	Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Scaleway

Best fit when

Teams that need compute, storage, networking and managed Kubernetes in documented EU multi-AZ regions under a French legal entity
AI/ML workloads that require NVIDIA GPUs with European data residency rather than US-region training defaults
Workloads that benefit from single-tenant bare metal (Elastic Metal or Dedibox) alongside cloud APIs
Healthtech or French-market buyers that need HDS-oriented hosting signals plus a published B2B DPA
Platform engineers standardising on Terraform/API-driven provisioning with S3-compatible storage and managed Postgres/MySQL

Poor fit when

Organisations that require a finished ANSSI SecNumCloud qualification on day one (process is ongoing, not completed on public pages)
Architectures that must run primary production in US or APAC regions on the same cloud account
Buyers that need the full hyperscaler catalogue (global edge, proprietary PaaS density, enterprise marketplace breadth)
Teams expecting a self-hosted “install Scaleway on your own DC” product rather than a managed cloud
Procurement processes that accept only SOC 2 Type II as the primary assurance artefact (not surfaced as a public Trust Center badge here)

Consider instead when

When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

Scaleway

What is the exact HDS certificate scope (services, regions, shared responsibility) for our architecture?
What is the current ANSSI SecNumCloud milestone and target date for the SKUs we would buy?
Which named subprocessors (including any non-EU) process account, billing, support or security telemetry data?
For multi-region DR, which products are GA in each AZ (including Milan) at contract time?
Are independent SOC 2 / C5 or other reports available under NDA if our assurance programme requires them?