← Back to Directory
Logo: Scaleway

Scaleway

French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe.

cloudinfrastructurebare-metalkubernetesgpueuropean-cloudgdprhdsapiterraform
Visit WebsiteAsk an EU migration specialistFeedback & corrections

Scaleway is a French cloud infrastructure provider (SCALEWAY SAS, Paris) and a subsidiary of the iliad Group. It sells a public-cloud stack on Scaleway-operated European infrastructure: virtual instances, bare metal, GPU instances, managed Kubernetes, serverless, object and block storage, and managed databases.

It exists as a French alternative to US hyperscaler regions for teams that want multi-AZ European residency without reselling someone else's cloud. Documented regions include Paris, Amsterdam, and Warsaw, with product docs also listing Milan.

The concrete differentiator is bare metal plus EU-resident GPU for AI, on the same account as Kubernetes and managed data services. It is not software you self-host on your own metal.

EU-operated regionsBare metal + Elastic MetalEU GPU for AIKapsule KubernetesISO 27001 (certified)HDS (claimed)

Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.

Key capabilities

Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.

On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.

Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.

Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.

S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.

Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.

At a glance

HQ
Paris, France (SCALEWAY SAS)
Group
iliad Group subsidiary
Regions
Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed)
Model
Public cloud IaaS/PaaS (not self-hosted)
Commercial model
Pay-as-you-go; compute Savings Plans (GPU rules differ)
Open source
Platform proprietary; open standards (K8s, S3 API, Terraform)

Best fit when

  • Teams that need compute, storage, networking and managed Kubernetes in documented EU multi-AZ regions under a French legal entity
  • AI/ML workloads that require NVIDIA GPUs with European data residency rather than US-region training defaults
  • Workloads that benefit from single-tenant bare metal (Elastic Metal or Dedibox) alongside cloud APIs
  • Healthtech or French-market buyers that need HDS-oriented hosting signals plus a published B2B DPA
  • Platform engineers standardising on Terraform/API-driven provisioning with S3-compatible storage and managed Postgres/MySQL

Poor fit when

  • Organisations that require a finished ANSSI SecNumCloud qualification on day one (process is ongoing, not completed on public pages)
  • Architectures that must run primary production in US or APAC regions on the same cloud account
  • Buyers that need the full hyperscaler catalogue (global edge, proprietary PaaS density, enterprise marketplace breadth)
  • Teams expecting a self-hosted “install Scaleway on your own DC” product rather than a managed cloud
  • Procurement processes that accept only SOC 2 Type II as the primary assurance artefact (not surfaced as a public Trust Center badge here)

Consider instead when

  • When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator

    Consider: OVHcloud

    Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.

  • When: You want simpler EU VPS/dedicated economics with a smaller product surface

    Consider: UpCloud, Exoscale, or Cyso Cloud

    Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.

  • When: You need maximum global managed-service depth and partner ecosystem

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Accept US-parent CLOUD Act exposure and design residency/controls explicitly.

  • When: German SMB hosting plus EU cloud under a DE-centric brand is the priority

    Consider: IONOS

    Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.

Jurisdiction & ownership

Legal entity
SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris
Governing law
French law (General Terms of Services)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page.

French iliad Group ownership; no US parent identified. Vendor marketing claims CLOUD Act immunity—treat as positioning. Indicative EuropeanStack assessment only, not legal advice. Residual diligence: subprocessor list, support access paths, HDS/SecNumCloud scope for the exact services used.

  • Independent security / no-logs auditNot applicable
  • ISO 27001Verified
  • SOC 2 / SOC 3Not found
  • HDS (French health data hosting)Vendor claimed
  • +6

Considerations & known limitations

  • MediumSecNumCloud not yet obtained

    ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

  • MediumSmaller service catalogue than US hyperscalers

    Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

  • LowAccount-plane processors and possible non-EU transfers

    Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

  • MediumShared responsibility for guest security

    Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

  • LowDedibox vs Elastic Metal product split

    Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.

Open questions for due diligence

  • What is the exact HDS certificate scope (services, regions, shared responsibility) for our architecture?
  • What is the current ANSSI SecNumCloud milestone and target date for the SKUs we would buy?
  • Which named subprocessors (including any non-EU) process account, billing, support or security telemetry data?
  • For multi-region DR, which products are GA in each AZ (including Milan) at contract time?
  • Are independent SOC 2 / C5 or other reports available under NDA if our assurance programme requires them?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

Scaleway documents cloud regions in Paris (fr-par, AZs PAR1–PAR3), Amsterdam (nl-ams, AMS1–AMS3) and Warsaw (pl-waw, WAW1–WAW3). Product-availability documentation also lists Milan (MIL1). Not every SKU exists in every AZ—check the official product availability guide before designing multi-AZ or multi-region failover. There is no US customer region on the public region map reviewed for this evaluation.

Not as a finished public qualification on the pages reviewed. Scaleway states it has begun the SecNumCloud process for its Scaleway Cloud offering (ANSSI “J0” milestone reported in company news) and security pages mark SecNumCloud as ongoing / under assessment. If your tender or risk policy requires a live SecNumCloud-qualified service today, verify current ANSSI status and exact product scope with Scaleway sales—or shortlist providers that already publish qualified offers (for example certain OVHcloud private-cloud paths).

Choose Elastic Metal when you want bare metal that plugs into the public-cloud control plane (VPC, managed Kubernetes, load balancers, cloud storage/APIs) with hourly-friendly elasticity. Choose Dedibox when you need the broader dedicated hardware catalogue or a classic dedicated-server operating model. Scaleway documents an ongoing convergence toward a unified bare-metal experience; map the specific CPU/RAM/disk/GPU SKU and AZ before migrating between lines.

Scaleway markets HDS (French health-data hosting) alongside ISO 27001 and states GPU instances are HDS-compliant on product FAQs. HDS is a French regulatory hosting framework relevant to certain health personal data use cases—not a blanket global “HIPAA equivalent.” Confirm whether your services, regions and shared-responsibility controls fall inside the certified scope, complete a DPA, and treat application-layer security as your obligation.

Yes—a Data Processing Agreement is published for download on Scaleway’s contracts page together with general terms and technical/organisational measures. For cloud services Scaleway acts as processor under that DPA; for account, billing, marketing and support it acts as controller and uses processors. The privacy policy allows limited non-EU transfers under SCCs for some controller purposes. Pull the current subprocessor list from the Trust Center (or contract pack) during procurement rather than relying only on marketing sovereignty copy.

Scaleway is a French SAS under the iliad Group, operating customer infrastructure in European regions on its own platform—not a US-parent hyperscaler. That ownership and hosting pattern is typically more favourable than EU-branded services running on AWS/GCP/Azure. It is not automatic legal immunity: controller-side tools may involve third-country transfers, support and legal processes still need review, and vendor “CLOUD Act free” slogans are not legal advice. Map entity, regions, DPA, subprocessors and any non-EU support access for your residual risk file.