Elastx vs Webswing

Compare Elastx and Webswing on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Webswing

Ireland· Cloud Computing

Needs review

Shortlist when you must browser-enable an existing Java Swing/JavaFX/SWT/NetBeans or Oracle Forms estate without a rewrite and can run a self-hosted session tier. Skip when you are building a greenfield web UI only, or when the app depends on video, 3D acceleration, or ultra-low-latency graphics. Consider Citrix/VDI or a hyperscaler cloud desktop when you need generic desktop remoting beyond Java UI toolkits.

EU-operatedSelf-hostedISO 27001 (claimed)No-rewrite Java UIOracle Forms capable

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs Webswing: Snapshot
Feature	Elastx	Webswing
Country of origin	Sweden	Ireland
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	Yes
Headquarters	Sweden	Ireland
Legal entity	Elastx AB	WEBSWING LIMITED (Webswing Ltd.), 93 Upper George's Street, Dun Laoghaire, A96 V1K8 Dublin, Ireland
Governing law	Not listed	Ireland
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Low
EU-hosted status	Not listed	Unknown
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	Product runtime is customer-operated (on-prem, customer cloud, Docker, or Kubernetes). Vendor Client Portal and marketing site use listed processors including Google Ireland, Meta Ireland, LinkedIn Ireland, and The Rocket Science Group LLC (US) for email marketing; those apply to vendor website/portal data, not to self-hosted application sessions.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	Self-hosted platform that runs Java Swing, JavaFX, SWT, NetBeans, and Oracle Forms apps in the browser without rewriting them.
Tags	cloud openstack kubernetes iaas swedish-cloud data-sovereignty dbaas	self-hosted java desktop-to-web oracle-forms application-modernization on-premise html5 ireland

At a glance: Elastx vs Webswing
At a glance	Elastx	Webswing
HQ	Stockholm, Sweden (Elastx AB)	Dublin, Ireland
Founded	2012	2015 (Dublin); product lineage from ~2012
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	Not listed
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Legal entity	Not listed	WEBSWING LIMITED (CRO 564226)
License model	Not listed	Commercial + SLA (evaluation available); AGPL only ≤20.2
Deployment	Not listed	Self-hosted (ZIP, Docker, Kubernetes, cluster)
UI frameworks	Not listed	Swing, JavaFX, SWT, NetBeans, Applets, Oracle Forms

Key capabilities: Elastx vs Webswing
Key capabilities	Elastx	Webswing
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
EU-operated	Not listed	Yes
Self-hosted	Not listed	Yes
ISO 27001 (claimed)	Not listed	Yes
No-rewrite Java UI	Not listed	Yes
Oracle Forms capable	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Webswing

Browser delivery without rewriting Java UI
Runs Swing, JavaFX, SWT, NetBeans Platform, Applets, and Oracle Forms in HTML5 browsers over WebSockets with no required source changes. End users need a browser only, not a local JRE or plugin.
Customer-controlled self-hosted runtime
Install from a distribution ZIP or containers on your own servers, VMs, Docker, or Kubernetes. Standalone and Cluster Engine modes cover single-node pilots through multi-node scale-out with admin monitoring.
Incremental modernisation beside legacy screens
Modernisation Framework and JsLink let React, Angular, Vue, Vaadin, or APEX components coexist with Java UI so teams can rewrite modules over time instead of a big-bang cutover.
Enterprise auth and session operations
Pluggable security modules include SAML2, OpenID Connect, Keycloak, LDAP, and custom providers. Admin Console adds session mirror view, recording/playback, logs, and multi-tenant path isolation.
Built-in printing, files, and clipboard bridges
Browser-side printing with preview, isolated upload/download folders, and clipboard integration cover common desktop workflows that break in naive remote-app setups.

Assurance & compliance: Elastx vs Webswing
Assurance & compliance	Elastx	Webswing
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	On request / NDA Footer states regular security testing is available upon request; no public independent audit PDF found.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Vendor claimed Site footer: Webswing Limited maintains an ISO/IEC 27001-certified ISMS. Independent cert registry entry not verified in this pass.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Not found No SOC 2/3 claim found on public site pages reviewed.
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed Privacy policy names WEBSWING LIMITED as Irish controller under GDPR; FAQ states GDPR alignment for company contact data.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial EU entity with no known US parent; self-hosted runtime keeps sessions on customer infra. Vendor website/portal lists US-group processor The Rocket Science Group LLC (email) plus Google/Meta/LinkedIn Ireland entities for analytics/ads. Not legal advice.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Not found Privacy policy references Art. 28 DPAs with Webswing's own processors; no public customer-facing DPA download found. Request during procurement.
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Not applicable Core product is application delivery/runtime, not an AI system. Prague research affiliate explores AI; not the catalogued product.

Considerations & known limitations: Elastx vs Webswing
Considerations & known limitations	Elastx	Webswing
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
Higher per-session server resources	Not listed	Medium Docs state each browser session needs more server CPU/memory than a native web app. Capacity planning and Cluster Engine matter for large concurrent user counts.
Video, 3D, and low-latency limits	Not listed	Medium Official overview: video not supported, limited sound, no 3D hardware acceleration, poor fit for real-time action games due to rendering latency.
Proprietary licensing since 21.1	Not listed	Low Current releases require commercial license + SLA. AGPL/public source stopped after 20.2. Source access for licensed customers is via Client Portal rather than a public repo.
Vendor portal/marketing US-group processors	Not listed	Low Privacy policy lists The Rocket Science Group LLC and major ad/analytics vendors for website/portal data. Irrelevant to on-prem session pixels, but relevant if you put sensitive personal data only into vendor portals.
ISO 27001 not independently verified here	Not listed	Low Vendor claims ISO/IEC 27001-certified ISMS on the site footer. Ask for the current certificate and scope before treating it as verified.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Webswing

Best fit when

Enterprises and ISVs with production Swing, JavaFX, SWT, NetBeans, or Oracle Forms applications that must become browser-accessible without a rewrite
Teams that can operate a self-hosted Webswing tier (on-prem, VM, Docker, or Kubernetes) and size CPU/memory per concurrent session
Organisations planning incremental UI modernisation (React/Angular/Vue/APEX) while keeping proven Java screens online
Buyers who want Irish/EU contracting (WEBSWING LIMITED) and customer-controlled residency for application sessions
Public-sector or regulated estates retiring endpoint Java installs or reducing Citrix/VDI dependency for Forms/Swing only

Poor fit when

Greenfield products with no existing Java desktop or Forms UI to preserve
Multimedia, video, 3D-accelerated, or real-time action-game style interfaces (documented limitations)
Teams unwilling to run and scale a server-side session farm for interactive users
Buyers who require OSI-approved open source for the current release line (proprietary since 21.1)

Consider instead when

When: You need generic Windows/Linux desktop remoting rather than Java UI toolkit remoting
Consider: Citrix / enterprise VDI, or Microsoft Azure Virtual Desktop
Webswing FAQ positions itself as a narrower alternative to Citrix for Forms/Java estates.
When: You are rewriting the UI entirely and have no need to keep Swing/Forms screens running
Consider: Native web frameworks (React, Angular, Vue) or Oracle APEX without a Webswing bridge
Webswing's Modernisation Framework is for coexistence during migration, not a mandatory layer for new UIs.
When: You want a hyperscaler-managed browser app streaming control plane
Consider: AWS AppStream / WorkSpaces-class services or Azure cloud desktop offerings
Trade self-hosted EU software control for managed cloud operations.

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

Webswing

Will Webswing provide the current ISO 27001 certificate PDF and statement of applicability scope?
Is a customer DPA available for Client Portal / support data processing, and which subprocessors apply to licensed customers?
Where is portal.webswing.org physically hosted, and are any non-EU regions used for backups?
For your Forms/Swing edge cases (WebUtil, local devices, printers), which patterns are supported without code changes?