Exoscale vs UpCloud

Compare Exoscale and UpCloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Google Cloud Platform, Microsoft Azure

Logo: Exoscale

Exoscale

Switzerland· Cloud Computing

Needs review

Shortlist Exoscale when you need multi-country European IaaS (CH/DE/AT/BG/HR zones), managed Kubernetes and open-source DBaaS under a Swiss operator in the A1 Telekom Austria group. Skip when you need hyperscaler global PaaS depth or bare-metal-first catalogs—consider OVHcloud or Scaleway instead, or AWS/Azure/GCP for worldwide regions.

EU/CH zones onlySwiss operator (Akenes SA)Managed Kubernetes (SKS)Managed DBaaSISO 27001/27017/27018 (claimed)Per-second pay-as-you-go
View listingVisit Website
Logo: UpCloud

UpCloud

Finland· Cloud Computing

Needs review

Shortlist UpCloud when you want Finnish-contracted IaaS with MaxIOPS storage, CNCF Managed Kubernetes, managed open-source databases, and customer-pinned EU regions—plus optional global PoPs. Skip when you need hyperscaler-only PaaS depth or the absolute lowest bare-metal VPS pricing; consider Hetzner, Scaleway, or AWS/Azure/GCP depending on that gap.

Finnish-operated IaaSMaxIOPS block storageCNCF Managed KubernetesISO 27001 (claimed)Selectable EU regionsZero-cost egress policy
View listingVisit Website

Highlighted rows differ between the two products.

Exoscale vs UpCloud: Snapshot
FeatureLogo: ExoscaleExoscaleLogo: UpCloudUpCloud
Country of originSwitzerlandFinland
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersSwitzerlandFinland
Legal entityAkenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland (CHE-423.524.322); member of A1 Digital International GmbH & Co KG / A1 Telekom Austria GroupUpCloud Oy (Business ID 2431560-5), Aleksanterinkatu 15 B, 00100 Helsinki
Governing lawSwiss law (DPA: canton of Vaud jurisdiction language)Finland (Terms of Service; arbitration Helsinki)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumMedium
Hosting / residencyCustomer compute/storage/SKS on Exoscale European zones (CH-GVA-2, CH-DK-2, DE-FRA-1, DE-MUC-1, AT-VIE-1/2, BG-SOF-1, HR-ZAG-1); DBaaS orchestrated by Aiven Oy (Finland) on Exoscale compute. Client ops third parties include AWS (US) data archival, Twilio (US) auth, PayPal (US) payments—privacy policy states customer-uploaded service data is not sent to those ops providers.Customer-selected regions across 15 DCs (EU majority: FI, SE, NO, DK, DE, NL, ES, PL, UK; plus US-CHI/NYC/SJO, SG, AU) in colocations (Equinix, Digital Realty, CoreSite, Telia, Verne, Green Mountain, etc.). Customer Data stays in chosen DC. Vendor: EU VMs have no customer-data subprocessors; group subsidiaries only otherwise. Account data in Finland with global support access (incl. US/SG). Payments/hCaptcha are separate third parties.
Summary

European public cloud (IaaS) from Swiss operator Akenes SA (A1 Digital): multi-zone compute, managed Kubernetes (SKS), DBaaS, object and block storage, and GPUs across CH, DE, AT, BG, and HR.

Finnish IaaS from UpCloud Oy (Helsinki): MaxIOPS block storage, Cloud Servers, managed Kubernetes and databases across 15 global regions with customer-selected residency.

Tags
cloudiaaskubernetesgdprdbaasswitzerlandeuropean-cloudgpu
cloudiaaskubernetesgdprinfrastructureapifinlandmanaged-databases
At a glance: Exoscale vs UpCloud
At a glanceLogo: ExoscaleExoscaleLogo: UpCloudUpCloud
HQLausanne, SwitzerlandHelsinki, Finland
Legal entityAkenes SA (CHE-423.524.322)UpCloud Oy (2431560-5)
GroupA1 Digital / A1 Telekom Austria GroupNot listed
HostingEuropean zones only (CH, DE, AT, BG, HR)Not listed
ModelPublic cloud IaaS + managed K8s/DBaaSNot listed
Self-hostNo (managed public cloud)Not listed
FoundedNot listed2011
RegionsNot listed15 DCs / 12 countries (EU-heavy + US/APAC)
Open sourceNot listedNo (platform proprietary)
Self-hostedNot listedNo (public/private cloud IaaS)
Commercial modelNot listedHourly pay-as-you-go; trial credits; zero-cost egress policy
Key capabilities: Exoscale vs UpCloud
Key capabilitiesLogo: ExoscaleExoscaleLogo: UpCloudUpCloud
EU/CH zones onlyYesNot listed
Swiss operator (Akenes SA)YesNot listed
Managed Kubernetes (SKS)YesNot listed
Managed DBaaSYesNot listed
ISO 27001/27017/27018 (claimed)YesNot listed
Per-second pay-as-you-goYesNot listed
Finnish-operated IaaSNot listedYes
MaxIOPS block storageNot listedYes
CNCF Managed KubernetesNot listedYes
ISO 27001 (claimed)Not listedYes
Selectable EU regionsNot listedYes
Zero-cost egress policyNot listedYes

Exoscale

  • Multi-zone European KVM compute

    Launch KVM instances in published zones across Switzerland, Germany, Austria, Bulgaria, and Croatia. Families cover standard, CPU-, memory-, and storage-optimized profiles plus NVIDIA GPU shapes; anti-affinity groups, instance pools, snapshots, custom templates, security groups, and live migration support production patterns. Billed per second with powered-off storage semantics as documented.

  • SKS managed Kubernetes (CNCF certified)

    Scalable Kubernetes Service deploys a managed control plane quickly (vendor claims under about a minute to two minutes). Starter is free without SLA; Pro adds HA control plane, etcd backups, and SLA language. Node pools use Exoscale instance types including GPUs; NLB, CSI storage, autoscaling/Karpenter (Pro), and vanilla CNCF-conformance positioning keep the stack portable.

  • Managed DBaaS on Exoscale compute (Aiven orchestration)

    Managed PostgreSQL, MySQL, Kafka, OpenSearch, Valkey, Grafana, and related engines run as DBaaS with automated backups, plan scaling, and high-availability options. Orchestration subprocessor is Aiven Oy (Finland); database instances run on Exoscale infrastructure in the zone you choose—confirm geo-replication and plan limits in docs before multi-region designs.

  • S3-compatible object storage and block volumes

    Simple Object Storage provides S3-compatible APIs for backups, media, and app assets integrated with Exoscale IAM and zones. Block storage attaches persistent NVMe-class volumes to instances and Kubernetes via CSI for stateful workloads without tying data solely to local disks.

  • IAM, private networks, and automation APIs

    Fine-grained IAM on API keys, private networks, and network load balancers support multi-tier designs. Portal, CLI, API, and Terraform-friendly workflows match common European DevOps practice without requiring a proprietary control language.

UpCloud

  • MaxIOPS clustered block storage

    In-house all-flash block tier rated up to ~100,000 read IOPS at 4K, separate from compute hosts, with Standard and Archive tiers for capacity. Attach up to 16 devices per server (up to 64 TB total); encryption at rest optional. Suits databases and I/O-heavy apps that outgrow commodity cloud disks.

  • Cloud Servers on AMD EPYC with automation

    Linux/Windows VMs with Starter, Premium, and Cloud Native plan families, hot resize options, firewall, utility and SDN private networking. Full lifecycle via control panel, REST API, CLI, Terraform/OpenTofu, Pulumi, and Crossplane—for teams automating fleets rather than clicking one-off VPS.

  • CNCF Managed Kubernetes (UKS)

    Managed control planes with CNCF-certified Kubernetes versions, autoscaler integration, CSI block volumes, load-balancer integration, and private-only clusters. Worker nodes use ordinary Cloud Server plans including Private Cloud hosts—good fit when you want K8s without running etcd yourself.

  • Managed PostgreSQL, MySQL, Valkey, OpenSearch

    Turnkey databases with automated backups, multi-node HA options, private utility/SDN connectivity, and point-in-time recovery on relational plans. Reduces ops load for product teams that still want open engines rather than proprietary hyperscaler databases.

  • Customer-selected global regions (EU-first footprint)

    Fifteen data centers across twelve countries: dense Northern/Central Europe (Helsinki x2, Stockholm, Stavanger, Copenhagen, Amsterdam, Frankfurt, Madrid, Warsaw, London) plus US, Singapore, and Sydney. Customer Data stays in the chosen zone unless you request a move—use EU zones for residency programmes.

  • Zero-cost egress packaging and 99.999% SLA line

    Public pricing emphasises no per-GB internet egress charges under a Fair Transfer Policy, plus Premium-class 99.999% SLA with service credits for unscheduled downtime. Simplifies bills for chatty APIs and multi-service architectures compared with classic egress meters—confirm fair-use limits for extreme transfer cases.

Assurance & compliance: Exoscale vs UpCloud
Assurance & complianceLogo: ExoscaleExoscaleLogo: UpCloudUpCloud
Independent security / control audit
Partial

Vendor states regular independent audits and publishes multi-framework certs via Compliance Center; not a VPN-style no-logs audit. Download current reports under account/NDA for verification.

Vendor claimed

Vendor states cloud services audited against Finnish PiTuKri criteria by an independent firm; ISO 27001 ISMS regularly audited. Public PiTuKri report not fully reproduced on marketing pages—request artefacts.

ISO 27001
Vendor claimed

Vendor asserts ISO/IEC 27001:2022 ISMS certification since 2018; certificates via Compliance Center.

Vendor claimed

Vendor asserts ISO 27001 certified ISMS and publishes certificate PDF; independent registry re-check not completed in this draft.

ISO 27017 (cloud security)
Vendor claimed

Listed on compliance site as certified cloud security controls.

Not listed
ISO 27018 (cloud PII)
Vendor claimed

Listed on compliance site for personal data protection in public cloud.

Not listed
SOC 2 / SOC 3
Vendor claimed

SOC 2 listed on compliance marketing; obtain report via Compliance Center / NDA.

Not found

Facility providers list SOC reports; no clear first-party UpCloud SOC 2 Type II product claim found on compliance pages reviewed.

BSI C5
Vendor claimed

BSI C5 listed among national/international standards on compliance page.

Not listed
HDS (French health data hosting)
Vendor claimed

HDS listed on compliance page; confirm scope and zones for health workloads.

Not listed
CSA STAR
Vendor claimed

CSA STAR listed on compliance page.

Not listed
GDPR / EU data protection
Vendor claimed

Swiss entity; GDPR + Swiss FADP claims; EU zones; public DPA. Not legal advice.

Vendor claimed

Finnish controller/processor under GDPR; customer chooses region; DPA in ToS; CISPE Code of Conduct adherence claimed.

US CLOUD Act exposure (indicative)
Partial

Swiss operator, no known US parent, European workload zones, and no third-party processor for compute/storage/SKS customer data. Medium residual path via US ops providers (AWS archival, Twilio auth, PayPal) listed for client data. DBaaS uses Aiven (Finland). Not legal advice.

Partial

Finnish entity / no known US parent; EU-region VMs can avoid US storage. Material exceptions: optional US DCs, US/SG support affiliates for account ops, US colocations if selected. Assessment not a vendor safety claim. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

Public DPA for Akenes SA as processor; Swiss law; Aiven listed for DBaaS.

Vendor claimed

DPA incorporated into Terms of Service; binding on acceptance without separate signature per vendor.

EU AI Act
Not applicable

Primary product is IaaS/managed infrastructure; customer AI workloads remain customer-controlled. Concrete AI offerings may need separate review if used as an AI system.

Not applicable

General-purpose IaaS/platform; not an AI system provider by primary product.

CISPE Code of ConductNot listed
Vendor claimed

Vendor states adherence to CISPE data protection code for cloud infrastructure providers.

Considerations & known limitations: Exoscale vs UpCloud
Considerations & known limitationsLogo: ExoscaleExoscaleLogo: UpCloudUpCloud
US third parties on client/ops path
Medium

Privacy policy lists AWS (US) data archival, Twilio (US) authentication, and PayPal (US) among client operations providers. Vendor states customer-uploaded service data is not transferred to these providers, but account/ops data paths still matter for CLOUD Act and transfer diligence.

Not listed
DBaaS subprocessor (Aiven)
Low

Managed databases depend on Aiven Oy (Finland) for orchestration while instances run on Exoscale. Confirm contractual chain, access model, and zone placement for sensitive data.

Not listed
Cert evidence mostly in customer portal / NDA
Low

ISO/SOC/C5/HDS claims are strong marketing signals, but full certificates and SOC reports typically require Compliance Center access or NDA—not fully public PDFs for all frameworks.

Not listed
Narrower PaaS than hyperscalers
Medium

Expect solid IaaS, SKS, DBaaS, storage, and GPU—not the global proprietary service catalog of AWS/Azure/GCP. Validate feature gaps early for serverless, global edge, and specialized managed services.

Not listed
Zone catalog evolves
Low

Public materials discuss further European expansion (e.g. Spain via A1 Digital messaging). Treat the live datacenters page as source of truth for residency commitments.

Not listed
Optional non-EU regions and support accessNot listed
Medium

US, Singapore, and Sydney zones are first-class options. Mis-pinned workloads or defaults can place Customer Data outside the EU. Account information is accessible to non-EEA support staff even when VMs stay in Europe.

Narrower catalogue than hyperscalersNot listed
Low

Strong IaaS and focused managed services; missing many proprietary AWS/Azure/GCP PaaS and AI products. Multi-cloud or dual-vendor designs may still be required.

Limited public SOC 2 for UpCloud entityNot listed
Medium

ISO 27001 and PiTuKri claims are published; a customer-facing SOC 2 Type II for UpCloud itself was not found. Enterprise questionnaires may need NDA artefacts or reliance on ISO plus facility reports.

Colocation facility dependencyNot listed
Low

Platform runs in third-party data centres. Facility certifications differ by site; treat them as complementary to UpCloud’s own ISMS, not a substitute for vendor due diligence.

Fair Transfer Policy on zero egressNot listed
Low

Zero-cost egress is a commercial differentiator but is governed by a Fair Transfer Policy—extreme or abusive transfer patterns may fall outside the marketing promise. Validate for CDN-scale or bulk egress designs.

Fit

Exoscale

Best fit when

  • Teams that must pin VMs, Kubernetes, and object storage to named European zones (including Swiss options)
  • SaaS and product orgs wanting SKS plus managed PostgreSQL/MySQL/Kafka/OpenSearch without running the control planes
  • Buyers who need a published DPA, zone list, and multi-framework compliance pack from a non-US legal entity
  • Workloads that fit IaaS plus managed open-source data services rather than proprietary global PaaS catalogs
  • Organizations evaluating A1 Digital / A1 Telekom Austria group cloud as a European alternative to AWS/Azure/GCP

Poor fit when

  • Products that depend on dozens of proprietary hyperscaler services or multi-continent active-active regions
  • Buyers who require zero US-group SaaS anywhere on the account path (privacy lists AWS archival, Twilio, PayPal for ops)
  • Teams seeking a fully self-hosted OpenStack/Kubernetes distribution rather than a managed public cloud
  • Bare-metal-heavy designs better served by large European bare-metal catalogs (e.g. OVHcloud)

Consider instead when

  • When: You need extensive bare-metal or a different pan-EU hosting footprint

    Consider: OVHcloud

    Often stronger metal catalog and broader hosting packaging; different sovereignty and product mix.

  • When: You want a developer-centric alternative with a different regional product mix

    Consider: Scaleway

    Common EU shortlist peer; compare zones, K8s, and storage packaging side by side.

  • When: You need global regions and deep proprietary PaaS/AI catalogs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade European-operator simplicity for worldwide service breadth and US CLOUD Act parent risk.

UpCloud

Best fit when

  • EU product teams needing IaaS with Finnish legal entity and pin-to-zone residency
  • Workloads sensitive to block I/O that benefit from MaxIOPS-class SSDs
  • Cloud-native stacks on managed Kubernetes plus managed PostgreSQL/MySQL/Valkey
  • Multi-service apps where predictable outbound transfer packaging matters
  • Agencies and SaaS operators standardising on API/Terraform automation

Poor fit when

  • Organisations that require a full hyperscaler catalogue (proprietary AI/PaaS breadth)
  • Buyers optimising solely for the lowest-cost bare metal or unlimited-traffic VPS
  • Programmes that forbid any non-EU group support access to account metadata without extra controls
  • Teams that will deploy only to US regions yet still market the stack as EU-sovereign

Consider instead when

  • When: You need cheaper raw compute or dedicated servers more than managed K8s packaging

    Consider: Hetzner

    Often stronger on price for VPS/dedicated; compare managed service depth separately.

  • When: You want a broader French/EU public-cloud portfolio or different regional SKUs

    Consider: OVHcloud or Scaleway

    Different product breadth and commercial culture; still European-operated peers.

  • When: You need hyperscaler-managed platforms, global enterprise contracts, or deep marketplace ecosystems

    Consider: AWS, Google Cloud, or Microsoft Azure

    Trade European HQ simplicity for catalogue depth and global account teams.

  • When: You want a compact European cloud with Swiss roots and a tighter region set

    Consider: Exoscale

    Compare region map and managed feature parity to UpCloud’s 15-DC footprint.

Open questions for due diligence

Exoscale

  • Download current ISO/SOC/C5/HDS certificates from the Compliance Center and verify auditor, scope, and expiry for your zones.
  • Confirm whether your use case can accept AWS/Twilio/PayPal on the account/ops path even if workload data stays on European Exoscale zones.
  • For DBaaS, document Aiven access boundaries, encryption, backup locations, and multi-zone replication behavior in writing.
  • If Spanish or other new zones are required, get contractual residency language rather than relying on roadmap announcements.
  • Clarify support plan SLAs and enterprise contracting terms beyond self-serve pay-as-you-go.

UpCloud

  • Obtain current ISO 27001 certificate scope/dates and any PiTuKri or other audit reports under NDA if required.
  • Confirm DPA Appendix 1 legal names and countries of all group-company subprocessors for your service mix.
  • Document which regions and backup/object-storage endpoints will be allow-listed for EU-only programmes.
  • Ask whether a SOC 2 or equivalent report for UpCloud Oy is available for enterprise review.
  • Validate Fair Transfer Policy thresholds for your expected egress profile.