UpCloud vs Webswing

Compare UpCloud and Webswing on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Logo: UpCloud

UpCloud

Finland· Cloud Computing

Needs review

Shortlist UpCloud when you want Finnish-contracted IaaS with MaxIOPS storage, CNCF Managed Kubernetes, managed open-source databases, and customer-pinned EU regions—plus optional global PoPs. Skip when you need hyperscaler-only PaaS depth or the absolute lowest bare-metal VPS pricing; consider Hetzner, Scaleway, or AWS/Azure/GCP depending on that gap.

Finnish-operated IaaSMaxIOPS block storageCNCF Managed KubernetesISO 27001 (claimed)Selectable EU regionsZero-cost egress policy
View listingVisit Website
Logo: Webswing

Webswing

Ireland· Cloud Computing

Needs review

Shortlist when you must browser-enable an existing Java Swing/JavaFX/SWT/NetBeans or Oracle Forms estate without a rewrite and can run a self-hosted session tier. Skip when you are building a greenfield web UI only, or when the app depends on video, 3D acceleration, or ultra-low-latency graphics. Consider Citrix/VDI or a hyperscaler cloud desktop when you need generic desktop remoting beyond Java UI toolkits.

EU-operatedSelf-hostedISO 27001 (claimed)No-rewrite Java UIOracle Forms capable
View listingVisit Website

Highlighted rows differ between the two products.

UpCloud vs Webswing: Snapshot
FeatureLogo: UpCloudUpCloudLogo: WebswingWebswing
Country of originFinlandIreland
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoYes
HeadquartersFinlandIreland
Legal entityUpCloud Oy (Business ID 2431560-5), Aleksanterinkatu 15 B, 00100 HelsinkiWEBSWING LIMITED (Webswing Ltd.), 93 Upper George's Street, Dun Laoghaire, A96 V1K8 Dublin, Ireland
Governing lawFinland (Terms of Service; arbitration Helsinki)Ireland
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumLow
EU-hosted statusNot listedUnknown
Hosting / residencyCustomer-selected regions across 15 DCs (EU majority: FI, SE, NO, DK, DE, NL, ES, PL, UK; plus US-CHI/NYC/SJO, SG, AU) in colocations (Equinix, Digital Realty, CoreSite, Telia, Verne, Green Mountain, etc.). Customer Data stays in chosen DC. Vendor: EU VMs have no customer-data subprocessors; group subsidiaries only otherwise. Account data in Finland with global support access (incl. US/SG). Payments/hCaptcha are separate third parties.Product runtime is customer-operated (on-prem, customer cloud, Docker, or Kubernetes). Vendor Client Portal and marketing site use listed processors including Google Ireland, Meta Ireland, LinkedIn Ireland, and The Rocket Science Group LLC (US) for email marketing; those apply to vendor website/portal data, not to self-hosted application sessions.
Summary

Finnish IaaS from UpCloud Oy (Helsinki): MaxIOPS block storage, Cloud Servers, managed Kubernetes and databases across 15 global regions with customer-selected residency.

Self-hosted platform that runs Java Swing, JavaFX, SWT, NetBeans, and Oracle Forms apps in the browser without rewriting them.

Tags
cloudiaasinfrastructurekubernetesgdprapifinlandmanaged-databases
self-hostedjavadesktop-to-weboracle-formsapplication-modernizationon-premisehtml5ireland
At a glance: UpCloud vs Webswing
At a glanceLogo: UpCloudUpCloudLogo: WebswingWebswing
HQHelsinki, FinlandDublin, Ireland
Legal entityUpCloud Oy (2431560-5)WEBSWING LIMITED (CRO 564226)
Founded20112015 (Dublin); product lineage from ~2012
Regions15 DCs / 12 countries (EU-heavy + US/APAC)Not listed
Open sourceNo (platform proprietary)Not listed
Self-hostedNo (public/private cloud IaaS)Not listed
Commercial modelHourly pay-as-you-go; trial credits; zero-cost egress policyNot listed
License modelNot listedCommercial + SLA (evaluation available); AGPL only ≤20.2
DeploymentNot listedSelf-hosted (ZIP, Docker, Kubernetes, cluster)
UI frameworksNot listedSwing, JavaFX, SWT, NetBeans, Applets, Oracle Forms
Key capabilities: UpCloud vs Webswing
Key capabilitiesLogo: UpCloudUpCloudLogo: WebswingWebswing
Finnish-operated IaaSYesNot listed
MaxIOPS block storageYesNot listed
CNCF Managed KubernetesYesNot listed
ISO 27001 (claimed)YesYes
Selectable EU regionsYesNot listed
Zero-cost egress policyYesNot listed
EU-operatedNot listedYes
Self-hostedNot listedYes
No-rewrite Java UINot listedYes
Oracle Forms capableNot listedYes

UpCloud

  • MaxIOPS clustered block storage

    In-house all-flash block tier rated up to ~100,000 read IOPS at 4K, separate from compute hosts, with Standard and Archive tiers for capacity. Attach up to 16 devices per server (up to 64 TB total); encryption at rest optional. Suits databases and I/O-heavy apps that outgrow commodity cloud disks.

  • Cloud Servers on AMD EPYC with automation

    Linux/Windows VMs with Starter, Premium, and Cloud Native plan families, hot resize options, firewall, utility and SDN private networking. Full lifecycle via control panel, REST API, CLI, Terraform/OpenTofu, Pulumi, and Crossplane—for teams automating fleets rather than clicking one-off VPS.

  • CNCF Managed Kubernetes (UKS)

    Managed control planes with CNCF-certified Kubernetes versions, autoscaler integration, CSI block volumes, load-balancer integration, and private-only clusters. Worker nodes use ordinary Cloud Server plans including Private Cloud hosts—good fit when you want K8s without running etcd yourself.

  • Managed PostgreSQL, MySQL, Valkey, OpenSearch

    Turnkey databases with automated backups, multi-node HA options, private utility/SDN connectivity, and point-in-time recovery on relational plans. Reduces ops load for product teams that still want open engines rather than proprietary hyperscaler databases.

  • Customer-selected global regions (EU-first footprint)

    Fifteen data centers across twelve countries: dense Northern/Central Europe (Helsinki x2, Stockholm, Stavanger, Copenhagen, Amsterdam, Frankfurt, Madrid, Warsaw, London) plus US, Singapore, and Sydney. Customer Data stays in the chosen zone unless you request a move—use EU zones for residency programmes.

  • Zero-cost egress packaging and 99.999% SLA line

    Public pricing emphasises no per-GB internet egress charges under a Fair Transfer Policy, plus Premium-class 99.999% SLA with service credits for unscheduled downtime. Simplifies bills for chatty APIs and multi-service architectures compared with classic egress meters—confirm fair-use limits for extreme transfer cases.

Webswing

  • Browser delivery without rewriting Java UI

    Runs Swing, JavaFX, SWT, NetBeans Platform, Applets, and Oracle Forms in HTML5 browsers over WebSockets with no required source changes. End users need a browser only, not a local JRE or plugin.

  • Customer-controlled self-hosted runtime

    Install from a distribution ZIP or containers on your own servers, VMs, Docker, or Kubernetes. Standalone and Cluster Engine modes cover single-node pilots through multi-node scale-out with admin monitoring.

  • Incremental modernisation beside legacy screens

    Modernisation Framework and JsLink let React, Angular, Vue, Vaadin, or APEX components coexist with Java UI so teams can rewrite modules over time instead of a big-bang cutover.

  • Enterprise auth and session operations

    Pluggable security modules include SAML2, OpenID Connect, Keycloak, LDAP, and custom providers. Admin Console adds session mirror view, recording/playback, logs, and multi-tenant path isolation.

  • Built-in printing, files, and clipboard bridges

    Browser-side printing with preview, isolated upload/download folders, and clipboard integration cover common desktop workflows that break in naive remote-app setups.

Assurance & compliance: UpCloud vs Webswing
Assurance & complianceLogo: UpCloudUpCloudLogo: WebswingWebswing
Independent security audit (PiTuKri / ISMS)
Vendor claimed

Vendor states cloud services audited against Finnish PiTuKri criteria by an independent firm; ISO 27001 ISMS regularly audited. Public PiTuKri report not fully reproduced on marketing pages—request artefacts.

On request / NDA

Footer states regular security testing is available upon request; no public independent audit PDF found.

ISO 27001
Vendor claimed

Vendor asserts ISO 27001 certified ISMS and publishes certificate PDF; independent registry re-check not completed in this draft.

Vendor claimed

Site footer: Webswing Limited maintains an ISO/IEC 27001-certified ISMS. Independent cert registry entry not verified in this pass.

SOC 2 / SOC 3
Not found

Facility providers list SOC reports; no clear first-party UpCloud SOC 2 Type II product claim found on compliance pages reviewed.

Not found

No SOC 2/3 claim found on public site pages reviewed.

GDPR / EU data protection
Vendor claimed

Finnish controller/processor under GDPR; customer chooses region; DPA in ToS; CISPE Code of Conduct adherence claimed.

Vendor claimed

Privacy policy names WEBSWING LIMITED as Irish controller under GDPR; FAQ states GDPR alignment for company contact data.

US CLOUD Act exposure (indicative)
Partial

Finnish entity / no known US parent; EU-region VMs can avoid US storage. Material exceptions: optional US DCs, US/SG support affiliates for account ops, US colocations if selected. Assessment not a vendor safety claim. Not legal advice.

Partial

EU entity with no known US parent; self-hosted runtime keeps sessions on customer infra. Vendor website/portal lists US-group processor The Rocket Science Group LLC (email) plus Google/Meta/LinkedIn Ireland entities for analytics/ads. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

DPA incorporated into Terms of Service; binding on acceptance without separate signature per vendor.

Not found

Privacy policy references Art. 28 DPAs with Webswing's own processors; no public customer-facing DPA download found. Request during procurement.

CISPE Code of Conduct
Vendor claimed

Vendor states adherence to CISPE data protection code for cloud infrastructure providers.

Not listed
EU AI Act
Not applicable

General-purpose IaaS/platform; not an AI system provider by primary product.

Not applicable

Core product is application delivery/runtime, not an AI system. Prague research affiliate explores AI; not the catalogued product.

Considerations & known limitations: UpCloud vs Webswing
Considerations & known limitationsLogo: UpCloudUpCloudLogo: WebswingWebswing
Optional non-EU regions and support access
Medium

US, Singapore, and Sydney zones are first-class options. Mis-pinned workloads or defaults can place Customer Data outside the EU. Account information is accessible to non-EEA support staff even when VMs stay in Europe.

Not listed
Narrower catalogue than hyperscalers
Low

Strong IaaS and focused managed services; missing many proprietary AWS/Azure/GCP PaaS and AI products. Multi-cloud or dual-vendor designs may still be required.

Not listed
Limited public SOC 2 for UpCloud entity
Medium

ISO 27001 and PiTuKri claims are published; a customer-facing SOC 2 Type II for UpCloud itself was not found. Enterprise questionnaires may need NDA artefacts or reliance on ISO plus facility reports.

Not listed
Colocation facility dependency
Low

Platform runs in third-party data centres. Facility certifications differ by site; treat them as complementary to UpCloud’s own ISMS, not a substitute for vendor due diligence.

Not listed
Fair Transfer Policy on zero egress
Low

Zero-cost egress is a commercial differentiator but is governed by a Fair Transfer Policy—extreme or abusive transfer patterns may fall outside the marketing promise. Validate for CDN-scale or bulk egress designs.

Not listed
Higher per-session server resourcesNot listed
Medium

Docs state each browser session needs more server CPU/memory than a native web app. Capacity planning and Cluster Engine matter for large concurrent user counts.

Video, 3D, and low-latency limitsNot listed
Medium

Official overview: video not supported, limited sound, no 3D hardware acceleration, poor fit for real-time action games due to rendering latency.

Proprietary licensing since 21.1Not listed
Low

Current releases require commercial license + SLA. AGPL/public source stopped after 20.2. Source access for licensed customers is via Client Portal rather than a public repo.

Vendor portal/marketing US-group processorsNot listed
Low

Privacy policy lists The Rocket Science Group LLC and major ad/analytics vendors for website/portal data. Irrelevant to on-prem session pixels, but relevant if you put sensitive personal data only into vendor portals.

ISO 27001 not independently verified hereNot listed
Low

Vendor claims ISO/IEC 27001-certified ISMS on the site footer. Ask for the current certificate and scope before treating it as verified.

Fit

UpCloud

Best fit when

  • EU product teams needing IaaS with Finnish legal entity and pin-to-zone residency
  • Workloads sensitive to block I/O that benefit from MaxIOPS-class SSDs
  • Cloud-native stacks on managed Kubernetes plus managed PostgreSQL/MySQL/Valkey
  • Multi-service apps where predictable outbound transfer packaging matters
  • Agencies and SaaS operators standardising on API/Terraform automation

Poor fit when

  • Organisations that require a full hyperscaler catalogue (proprietary AI/PaaS breadth)
  • Buyers optimising solely for the lowest-cost bare metal or unlimited-traffic VPS
  • Programmes that forbid any non-EU group support access to account metadata without extra controls
  • Teams that will deploy only to US regions yet still market the stack as EU-sovereign

Consider instead when

  • When: You need cheaper raw compute or dedicated servers more than managed K8s packaging

    Consider: Hetzner

    Often stronger on price for VPS/dedicated; compare managed service depth separately.

  • When: You want a broader French/EU public-cloud portfolio or different regional SKUs

    Consider: OVHcloud or Scaleway

    Different product breadth and commercial culture; still European-operated peers.

  • When: You need hyperscaler-managed platforms, global enterprise contracts, or deep marketplace ecosystems

    Consider: AWS, Google Cloud, or Microsoft Azure

    Trade European HQ simplicity for catalogue depth and global account teams.

  • When: You want a compact European cloud with Swiss roots and a tighter region set

    Consider: Exoscale

    Compare region map and managed feature parity to UpCloud’s 15-DC footprint.

Webswing

Best fit when

  • Enterprises and ISVs with production Swing, JavaFX, SWT, NetBeans, or Oracle Forms applications that must become browser-accessible without a rewrite
  • Teams that can operate a self-hosted Webswing tier (on-prem, VM, Docker, or Kubernetes) and size CPU/memory per concurrent session
  • Organisations planning incremental UI modernisation (React/Angular/Vue/APEX) while keeping proven Java screens online
  • Buyers who want Irish/EU contracting (WEBSWING LIMITED) and customer-controlled residency for application sessions
  • Public-sector or regulated estates retiring endpoint Java installs or reducing Citrix/VDI dependency for Forms/Swing only

Poor fit when

  • Greenfield products with no existing Java desktop or Forms UI to preserve
  • Multimedia, video, 3D-accelerated, or real-time action-game style interfaces (documented limitations)
  • Teams unwilling to run and scale a server-side session farm for interactive users
  • Buyers who require OSI-approved open source for the current release line (proprietary since 21.1)

Consider instead when

  • When: You need generic Windows/Linux desktop remoting rather than Java UI toolkit remoting

    Consider: Citrix / enterprise VDI, or Microsoft Azure Virtual Desktop

    Webswing FAQ positions itself as a narrower alternative to Citrix for Forms/Java estates.

  • When: You are rewriting the UI entirely and have no need to keep Swing/Forms screens running

    Consider: Native web frameworks (React, Angular, Vue) or Oracle APEX without a Webswing bridge

    Webswing's Modernisation Framework is for coexistence during migration, not a mandatory layer for new UIs.

  • When: You want a hyperscaler-managed browser app streaming control plane

    Consider: AWS AppStream / WorkSpaces-class services or Azure cloud desktop offerings

    Trade self-hosted EU software control for managed cloud operations.

Open questions for due diligence

UpCloud

  • Obtain current ISO 27001 certificate scope/dates and any PiTuKri or other audit reports under NDA if required.
  • Confirm DPA Appendix 1 legal names and countries of all group-company subprocessors for your service mix.
  • Document which regions and backup/object-storage endpoints will be allow-listed for EU-only programmes.
  • Ask whether a SOC 2 or equivalent report for UpCloud Oy is available for enterprise review.
  • Validate Fair Transfer Policy thresholds for your expected egress profile.

Webswing

  • Will Webswing provide the current ISO 27001 certificate PDF and statement of applicability scope?
  • Is a customer DPA available for Client Portal / support data processing, and which subprocessors apply to licensed customers?
  • Where is portal.webswing.org physically hosted, and are any non-EU regions used for backups?
  • For your Forms/Swing edge cases (WebUtil, local devices, printers), which patterns are supported without code changes?