STACKIT vs Webswing

Compare STACKIT and Webswing on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Logo: STACKIT

STACKIT

Germany· Cloud Computing

Needs review

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid
View listingVisit Website
Logo: Webswing

Webswing

Ireland· Cloud Computing

Needs review

Shortlist when you must browser-enable an existing Java Swing/JavaFX/SWT/NetBeans or Oracle Forms estate without a rewrite and can run a self-hosted session tier. Skip when you are building a greenfield web UI only, or when the app depends on video, 3D acceleration, or ultra-low-latency graphics. Consider Citrix/VDI or a hyperscaler cloud desktop when you need generic desktop remoting beyond Java UI toolkits.

EU-operatedSelf-hostedISO 27001 (claimed)No-rewrite Java UIOracle Forms capable
View listingVisit Website

Highlighted rows differ between the two products.

STACKIT vs Webswing: Snapshot
FeatureLogo: STACKITSTACKITLogo: WebswingWebswing
Country of originGermanyIreland
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoYes
HeadquartersGermanyIreland
Legal entitySchwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)WEBSWING LIMITED (Webswing Ltd.), 93 Upper George's Street, Dun Laoghaire, A96 V1K8 Dublin, Ireland
Governing lawGermany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)Ireland
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowLow
EU-hosted statusNot listedUnknown
Hosting / residencyVendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.Product runtime is customer-operated (on-prem, customer cloud, Docker, or Kubernetes). Vendor Client Portal and marketing site use listed processors including Google Ireland, Meta Ireland, LinkedIn Ireland, and The Rocket Science Group LLC (US) for email marketing; those apply to vendor website/portal data, not to self-hosted application sessions.
Summary

German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.

Self-hosted platform that runs Java Swing, JavaFX, SWT, NetBeans, and Oracle Forms apps in the browser without rewriting them.

Tags
cloudinfrastructureprivacykubernetessovereign-cloudiaaspaas
self-hostedjavadesktop-to-weboracle-formsapplication-modernizationon-premisehtml5ireland
At a glance: STACKIT vs Webswing
At a glanceLogo: STACKITSTACKITLogo: WebswingWebswing
HQ / legal entityBad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KGNot listed
ParentSchwarz Digits (Schwarz Group — Lidl/Kaufland)Not listed
HostingGroup-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure resellerNot listed
ModelConsumption-based public cloud + quote-based colocationNot listed
Open sourceUses open-source components; platform itself is managed, not self-hostedNot listed
External marketPublic offering from 2022 (internal roots from 2018)Not listed
HQNot listedDublin, Ireland
Legal entityNot listedWEBSWING LIMITED (CRO 564226)
FoundedNot listed2015 (Dublin); product lineage from ~2012
License modelNot listedCommercial + SLA (evaluation available); AGPL only ≤20.2
DeploymentNot listedSelf-hosted (ZIP, Docker, Kubernetes, cluster)
UI frameworksNot listedSwing, JavaFX, SWT, NetBeans, Applets, Oracle Forms
Key capabilities: STACKIT vs Webswing
Key capabilitiesLogo: STACKITSTACKITLogo: WebswingWebswing
EU-operatedYesYes
German legal entityYesNot listed
Group-owned DE/AT DCsYesNot listed
BSI C5 Type 2 (claimed)YesNot listed
Managed Kubernetes (SKE)YesNot listed
EU colocation + hybridYesNot listed
Self-hostedNot listedYes
ISO 27001 (claimed)Not listedYes
No-rewrite Java UINot listedYes
Oracle Forms capableNot listedYes

STACKIT

  • Compute Engine VMs and GPUs in group-owned EU regions

    Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.

  • STACKIT Kubernetes Engine (SKE)

    Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.

  • Managed databases, messaging, and observability

    Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.

  • Confidential computing and key/secrets control

    Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.

  • EU colocation with hybrid path to public cloud

    Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.

  • Object, block, file, backup, and archiving storage

    S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

Webswing

  • Browser delivery without rewriting Java UI

    Runs Swing, JavaFX, SWT, NetBeans Platform, Applets, and Oracle Forms in HTML5 browsers over WebSockets with no required source changes. End users need a browser only, not a local JRE or plugin.

  • Customer-controlled self-hosted runtime

    Install from a distribution ZIP or containers on your own servers, VMs, Docker, or Kubernetes. Standalone and Cluster Engine modes cover single-node pilots through multi-node scale-out with admin monitoring.

  • Incremental modernisation beside legacy screens

    Modernisation Framework and JsLink let React, Angular, Vue, Vaadin, or APEX components coexist with Java UI so teams can rewrite modules over time instead of a big-bang cutover.

  • Enterprise auth and session operations

    Pluggable security modules include SAML2, OpenID Connect, Keycloak, LDAP, and custom providers. Admin Console adds session mirror view, recording/playback, logs, and multi-tenant path isolation.

  • Built-in printing, files, and clipboard bridges

    Browser-side printing with preview, isolated upload/download folders, and clipboard integration cover common desktop workflows that break in naive remote-app setups.

Assurance & compliance: STACKIT vs Webswing
Assurance & complianceLogo: STACKITSTACKITLogo: WebswingWebswing
Independent security attestation (BSI C5 / audits)
Vendor claimed

Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit.

On request / NDA

Footer states regular security testing is available upon request; no public independent audit PDF found.

ISO 27001
Vendor claimed

Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components.

Vendor claimed

Site footer: Webswing Limited maintains an ISO/IEC 27001-certified ISMS. Independent cert registry entry not verified in this pass.

SOC 2 / SOC 3 (ISAE 3000)
Vendor claimed

Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request.

Not found

No SOC 2/3 claim found on public site pages reviewed.

BSI C5 Type 2
Vendor claimed

C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product.

Not listed
GDPR / EU data protection
Vendor claimed

EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud.

Vendor claimed

Privacy policy names WEBSWING LIMITED as Irish controller under GDPR; FAQ states GDPR alignment for company contact data.

US CLOUD Act exposure (indicative)
Partial

German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice.

Partial

EU entity with no known US parent; self-hosted runtime keeps sessions on customer infra. Vendor website/portal lists US-group processor The Rocket Science Group LLC (email) plus Google/Meta/LinkedIn Ireland entities for analytics/ads. Not legal advice.

Data processing agreement (B2B)
Not found

No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement.

Not found

Privacy policy references Art. 28 DPAs with Webswing's own processors; no public customer-facing DPA download found. Request during procurement.

TISAX Level 3
Vendor claimed

Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page).

Not listed
EU AI Act
Not applicable

Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems.

Not applicable

Core product is application delivery/runtime, not an AI system. Prague research affiliate explores AI; not the catalogued product.

Considerations & known limitations: STACKIT vs Webswing
Considerations & known limitationsLogo: STACKITSTACKITLogo: WebswingWebswing
Narrower service map than US hyperscalers
Medium

STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.

Not listed
C5 Type 2 is product-scoped
Medium

Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.

Not listed
Limited public subprocessor inventory
Low

Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.

Not listed
Retail-group operator concentration
Low

Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.

Not listed
Higher per-session server resourcesNot listed
Medium

Docs state each browser session needs more server CPU/memory than a native web app. Capacity planning and Cluster Engine matter for large concurrent user counts.

Video, 3D, and low-latency limitsNot listed
Medium

Official overview: video not supported, limited sound, no 3D hardware acceleration, poor fit for real-time action games due to rendering latency.

Proprietary licensing since 21.1Not listed
Low

Current releases require commercial license + SLA. AGPL/public source stopped after 20.2. Source access for licensed customers is via Client Portal rather than a public repo.

Vendor portal/marketing US-group processorsNot listed
Low

Privacy policy lists The Rocket Science Group LLC and major ad/analytics vendors for website/portal data. Irrelevant to on-prem session pixels, but relevant if you put sensitive personal data only into vendor portals.

ISO 27001 not independently verified hereNot listed
Low

Vendor claims ISO/IEC 27001-certified ISMS on the site footer. Ask for the current certificate and scope before treating it as verified.

Fit

STACKIT

Best fit when

  • Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
  • Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
  • Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
  • Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
  • Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

  • Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
  • Teams that must self-host the full cloud control plane rather than consume a managed public cloud
  • Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
  • Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
  • Use cases requiring non-European data residency as a primary requirement

Consider instead when

  • When: You need a wider multi-country European region map and a large independent cloud portfolio

    Consider: OVHcloud or Scaleway

    Different ownership and product cultures; still not US hyperscaler breadth

  • When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth

    Consider: IONOS (or similar DE hosts)

    Often simpler packaging for commodity compute

  • When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis

  • When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale

    Consider: Exoscale

    Smaller portfolio; different jurisdiction story

Webswing

Best fit when

  • Enterprises and ISVs with production Swing, JavaFX, SWT, NetBeans, or Oracle Forms applications that must become browser-accessible without a rewrite
  • Teams that can operate a self-hosted Webswing tier (on-prem, VM, Docker, or Kubernetes) and size CPU/memory per concurrent session
  • Organisations planning incremental UI modernisation (React/Angular/Vue/APEX) while keeping proven Java screens online
  • Buyers who want Irish/EU contracting (WEBSWING LIMITED) and customer-controlled residency for application sessions
  • Public-sector or regulated estates retiring endpoint Java installs or reducing Citrix/VDI dependency for Forms/Swing only

Poor fit when

  • Greenfield products with no existing Java desktop or Forms UI to preserve
  • Multimedia, video, 3D-accelerated, or real-time action-game style interfaces (documented limitations)
  • Teams unwilling to run and scale a server-side session farm for interactive users
  • Buyers who require OSI-approved open source for the current release line (proprietary since 21.1)

Consider instead when

  • When: You need generic Windows/Linux desktop remoting rather than Java UI toolkit remoting

    Consider: Citrix / enterprise VDI, or Microsoft Azure Virtual Desktop

    Webswing FAQ positions itself as a narrower alternative to Citrix for Forms/Java estates.

  • When: You are rewriting the UI entirely and have no need to keep Swing/Forms screens running

    Consider: Native web frameworks (React, Angular, Vue) or Oracle APEX without a Webswing bridge

    Webswing's Modernisation Framework is for coexistence during migration, not a mandatory layer for new UIs.

  • When: You want a hyperscaler-managed browser app streaming control plane

    Consider: AWS AppStream / WorkSpaces-class services or Azure cloud desktop offerings

    Trade self-hosted EU software control for managed cloud operations.

Open questions for due diligence

STACKIT

  • Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
  • Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
  • What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
  • What are exit, data export, and termination assistance terms for large object stores and managed databases?
  • For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?

Webswing

  • Will Webswing provide the current ISO 27001 certificate PDF and statement of applicability scope?
  • Is a customer DPA available for Client Portal / support data processing, and which subprocessors apply to licensed customers?
  • Where is portal.webswing.org physically hosted, and are any non-EU regions used for backups?
  • For your Forms/Swing edge cases (WebUtil, local devices, printers), which patterns are supported without code changes?