Aruba Cloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.
Aruba Cloud is an EU-owned service hosted in Italy, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Aruba Cloud is the cloud division of Aruba S.p.A. (Ponte San Pietro, BG, Italy; P.IVA 01573850516), Italy''s largest privately-held cloud and hosting provider: proprietary infrastructure with four Italian data centres in Arezzo (IT1 + IT2), Bergamo (IT3), and Rome (IT4), Rating 4 ANSI/TIA-942-C at IT1 (the highest tier), ISO/IEC 27001 + 27017 + 27018 + 27035 certifications, qualified by Italy''s ACN (National Cybersecurity Agency) up to AI3 / QC3 levels for IaaS / PaaS / SaaS, CISPE Code of Conduct, DORA and NIS 2 compliant; EU-owned and EU-hosted with no CLOUD Act exposure, and an exceptionally strong certification profile; however, Aruba does not publish a standalone DPA: data-processing terms are buried in the general T&Cs and a separate data-processing agreement is only obtainable by contacting dpo@aruba.it, which is a transparency gap relative to other directory entries.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Aruba Cloud
Aruba Cloud is the cloud division of Aruba S.p.A., Italy's largest privately-held cloud and web-services group, founded in 1994 and headquartered in Ponte San Pietro (BG), Italy (P.IVA 01573850516, C.F. 04552920482). The company operates proprietary infrastructure across four Italian data centres: IT1 and IT2 in Arezzo (the unique twin-DC configuration only a few kilometres apart that enables low-latency redundancy), IT3 in Bergamo (the flagship Global Cloud Data Centre campus), and IT4 in Rome. IT1, IT3 and IT4 carry the highest Rating 4 ANSI/TIA-942-C-2024 data-centre certification.
Compliance posture is among the strongest in Europe for Italian public-sector procurement. Aruba Cloud is qualified by Italy's ACN (Agenzia per la Cybersicurezza Nazionale / National Cybersecurity Agency) at the AI3 level for infrastructure and QC3 level for services, the qualifications required by the Italian Public Administration (PA) to host critical and strategic data. Certifications include ISO/IEC 27001, ISO 27017, ISO 27018, ISO 27035, and ISO 9001 at the management-system level. The company is a CISPE Code of Conduct signatory (the European cloud-infrastructure association founded explicitly around GDPR alignment), DORA-compliant for EU financial-services operational resilience, and NIS 2-compliant. The product is a VMware Pinnacle Partner (the highest VMware partnership tier) and offers data-sovereignty positioning under the explicit promise that "your data stays in Italy." Aruba S.p.A. also operates the .it domain registry, giving it deep ties to Italian internet infrastructure.
The product surface covers bare metal, VPS, public cloud compute, VMware cloud, object storage, and managed services. Pricing is highly competitive: the cheapest plan in the catalogue is Cloud VPS OpenStack Starter at €1.99 per month excluding VAT, while Cloud Server PRO itself starts at €6.60 per month excluding VAT. Best fit: Italian SMBs, agencies, the entire Italian public-sector procurement chain (ACN-qualified workloads), VMware shops in Italy and Southern Europe, regulated industries (financial services post-DORA), and any EU buyer needing geographic diversity from DACH-clustered alternatives. Together with Hetzner (DE), OVHcloud (FR), Scaleway (FR), IONOS (DE), UpCloud (FI), STACKIT (DE), Cleura (SE), Exoscale (CH), T Cloud Public (DE), and Stackscale (ES), Aruba Cloud completes the 11-vendor procurement-grade EU hyperscaler-alternative shortlist.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of Aruba Cloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
OpenData Processing Addendum (DPA)www.arubacloud.com/terms-and-conditions…
-
missingSub-processors list— missing
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
France · €4.80/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |
Clever Cloud
France
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
€4.80/mo |