Compare Scaleway and UpCloud on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Google Cloud Platform, Microsoft Azure
France· Cloud Computing
Needs review
Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.
Finland· Cloud Computing
Needs review
Shortlist UpCloud when you want Finnish-contracted IaaS with MaxIOPS storage, CNCF Managed Kubernetes, managed open-source databases, and customer-pinned EU regions—plus optional global PoPs. Skip when you need hyperscaler-only PaaS depth or the absolute lowest bare-metal VPS pricing; consider Hetzner, Scaleway, or AWS/Azure/GCP depending on that gap.
Highlighted rows differ between the two products.
| Feature | Scaleway | UpCloud |
|---|---|---|
| Country of origin | France | Finland |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | France | Finland |
| Legal entity | SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris | UpCloud Oy (Business ID 2431560-5), Aleksanterinkatu 15 B, 00100 Helsinki |
| Governing law | French law (General Terms of Services) | Finland (Terms of Service; arbitration Helsinki) |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| Hosting / residency | Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page. | Customer-selected regions across 15 DCs (EU majority: FI, SE, NO, DK, DE, NL, ES, PL, UK; plus US-CHI/NYC/SJO, SG, AU) in colocations (Equinix, Digital Realty, CoreSite, Telia, Verne, Green Mountain, etc.). Customer Data stays in chosen DC. Vendor: EU VMs have no customer-data subprocessors; group subsidiaries only otherwise. Account data in Finland with global support access (incl. US/SG). Payments/hCaptcha are separate third parties. |
| Summary | French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe. | Finnish IaaS from UpCloud Oy (Helsinki): MaxIOPS block storage, Cloud Servers, managed Kubernetes and databases across 15 global regions with customer-selected residency. |
| Tags |
| At a glance | Scaleway | UpCloud |
|---|---|---|
| HQ | Paris, France (SCALEWAY SAS) | Helsinki, Finland |
| Group | iliad Group subsidiary | Not listed |
| Regions | Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed) | 15 DCs / 12 countries (EU-heavy + US/APAC) |
| Model | Public cloud IaaS/PaaS (not self-hosted) | Not listed |
| Commercial model | Pay-as-you-go; compute Savings Plans (GPU rules differ) | Hourly pay-as-you-go; trial credits; zero-cost egress policy |
| Open source | Platform proprietary; open standards (K8s, S3 API, Terraform) | No (platform proprietary) |
| Legal entity | Not listed | UpCloud Oy (2431560-5) |
| Founded | Not listed | 2011 |
| Self-hosted | Not listed | No (public/private cloud IaaS) |
| Key capabilities | Scaleway | UpCloud |
|---|---|---|
| EU-operated regions | Yes | Not listed |
| Bare metal + Elastic Metal | Yes | Not listed |
| EU GPU for AI | Yes | Not listed |
| Kapsule Kubernetes | Yes | Yes |
| ISO 27001 (certified) | Yes | Yes |
| HDS (claimed) | Yes | Not listed |
| Finnish-operated IaaS | Not listed | Yes |
| MaxIOPS block storage | Not listed | Yes |
| Selectable EU regions | Not listed | Yes |
| Zero-cost egress policy | Not listed | Yes |
Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.
MaxIOPS clustered block storage
In-house all-flash block tier rated up to ~100,000 read IOPS at 4K, separate from compute hosts, with Standard and Archive tiers for capacity. Attach up to 16 devices per server (up to 64 TB total); encryption at rest optional. Suits databases and I/O-heavy apps that outgrow commodity cloud disks.
Cloud Servers on AMD EPYC with automation
Linux/Windows VMs with Starter, Premium, and Cloud Native plan families, hot resize options, firewall, utility and SDN private networking. Full lifecycle via control panel, REST API, CLI, Terraform/OpenTofu, Pulumi, and Crossplane—for teams automating fleets rather than clicking one-off VPS.
CNCF Managed Kubernetes (UKS)
Managed control planes with CNCF-certified Kubernetes versions, autoscaler integration, CSI block volumes, load-balancer integration, and private-only clusters. Worker nodes use ordinary Cloud Server plans including Private Cloud hosts—good fit when you want K8s without running etcd yourself.
Managed PostgreSQL, MySQL, Valkey, OpenSearch
Turnkey databases with automated backups, multi-node HA options, private utility/SDN connectivity, and point-in-time recovery on relational plans. Reduces ops load for product teams that still want open engines rather than proprietary hyperscaler databases.
Customer-selected global regions (EU-first footprint)
Fifteen data centers across twelve countries: dense Northern/Central Europe (Helsinki x2, Stockholm, Stavanger, Copenhagen, Amsterdam, Frankfurt, Madrid, Warsaw, London) plus US, Singapore, and Sydney. Customer Data stays in the chosen zone unless you request a move—use EU zones for residency programmes.
Zero-cost egress packaging and 99.999% SLA line
Public pricing emphasises no per-GB internet egress charges under a Fair Transfer Policy, plus Premium-class 99.999% SLA with service credits for unscheduled downtime. Simplifies bills for chatty APIs and multi-service architectures compared with classic egress meters—confirm fair-use limits for extreme transfer cases.
| Assurance & compliance | Scaleway | UpCloud |
|---|---|---|
| Independent security / no-logs audit | Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim. | Vendor claimed Vendor states cloud services audited against Finnish PiTuKri criteria by an independent firm; ISO 27001 ISMS regularly audited. Public PiTuKri report not fully reproduced on marketing pages—request artefacts. |
| ISO 27001 | Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy. | Vendor claimed Vendor asserts ISO 27001 certified ISMS and publishes certificate PDF; independent registry re-check not completed in this draft. |
| SOC 2 / SOC 3 | Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1). | Not found Facility providers list SOC reports; no clear first-party UpCloud SOC 2 Type II product claim found on compliance pages reviewed. |
| HDS (French health data hosting) | Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture. | Not listed |
| CSA STAR Level 1 | Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ). | Not listed |
| ANSSI SecNumCloud | Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed. | Not listed |
| GDPR / EU data protection | Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice. | Vendor claimed Finnish controller/processor under GDPR; customer chooses region; DPA in ToS; CISPE Code of Conduct adherence claimed. |
| US CLOUD Act exposure (indicative) | Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim. | Partial Finnish entity / no known US parent; EU-region VMs can avoid US storage. Material exceptions: optional US DCs, US/SG support affiliates for account ops, US colocations if selected. Assessment not a vendor safety claim. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs. | Vendor claimed DPA incorporated into Terms of Service; binding on acceptance without separate signature per vendor. |
| EU AI Act | Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim. | Not applicable General-purpose IaaS/platform; not an AI system provider by primary product. |
| CISPE Code of Conduct | Not listed | Vendor claimed Vendor states adherence to CISPE data protection code for cloud infrastructure providers. |
| Considerations & known limitations | Scaleway | UpCloud |
|---|---|---|
| SecNumCloud not yet obtained | Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan. | Not listed |
| Smaller service catalogue than US hyperscalers | Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate. | Not listed |
| Account-plane processors and possible non-EU transfers | Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs. | Not listed |
| Shared responsibility for guest security | Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes. | Not listed |
| Dedibox vs Elastic Metal product split | Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort. | Not listed |
| Optional non-EU regions and support access | Not listed | Medium US, Singapore, and Sydney zones are first-class options. Mis-pinned workloads or defaults can place Customer Data outside the EU. Account information is accessible to non-EEA support staff even when VMs stay in Europe. |
| Narrower catalogue than hyperscalers | Not listed | Low Strong IaaS and focused managed services; missing many proprietary AWS/Azure/GCP PaaS and AI products. Multi-cloud or dual-vendor designs may still be required. |
| Limited public SOC 2 for UpCloud entity | Not listed | Medium ISO 27001 and PiTuKri claims are published; a customer-facing SOC 2 Type II for UpCloud itself was not found. Enterprise questionnaires may need NDA artefacts or reliance on ISO plus facility reports. |
| Colocation facility dependency | Not listed | Low Platform runs in third-party data centres. Facility certifications differ by site; treat them as complementary to UpCloud’s own ISMS, not a substitute for vendor due diligence. |
| Fair Transfer Policy on zero egress | Not listed | Low Zero-cost egress is a commercial differentiator but is governed by a Fair Transfer Policy—extreme or abusive transfer patterns may fall outside the marketing promise. Validate for CDN-scale or bulk egress designs. |
When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.
When: You need cheaper raw compute or dedicated servers more than managed K8s packaging
Consider: Hetzner
Often stronger on price for VPS/dedicated; compare managed service depth separately.
When: You want a broader French/EU public-cloud portfolio or different regional SKUs
Consider: OVHcloud or Scaleway
Different product breadth and commercial culture; still European-operated peers.
When: You need hyperscaler-managed platforms, global enterprise contracts, or deep marketplace ecosystems
Consider: AWS, Google Cloud, or Microsoft Azure
Trade European HQ simplicity for catalogue depth and global account teams.
When: You want a compact European cloud with Swiss roots and a tighter region set
Consider: Exoscale
Compare region map and managed feature parity to UpCloud’s 15-DC footprint.