Cyso Cloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Cyso B.V. (KvK 37133395), Wognumsebuurt 3, 1817 BH Alkmaar, Netherlands; part of Cyso Group B.V. (KvK 33287475)
Dutch OpenStack public cloud (Cyso B.V., Alkmaar; formerly Fuga Cloud) on the operator's own hardware in Amsterdam and Frankfurt; ISO 27001 + NEN 7510, but no public DPA and a 2018 sub-processor list naming AWS, Microsoft and Google.
Cyso Cloud offers EU hosting in the Netherlands, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Cyso Cloud is the OpenStack public cloud of Cyso B.V. (KvK 37133395, Alkmaar), part of founder-owned Cyso Group B.V. (KvK 33287475), Dutch since 1997 with no US parent, no US private equity and no US venture capital in the chain. Both certificates were verified from the published PDFs rather than taken from marketing copy: ISO/IEC 27001:2022 (certificate 25.002, valid 21-02-2025 to 21-02-2028) and NEN 7510-1:2017+A1:2020 (certificate 25.080, valid 24-06-2025 to 20-02-2027), both issued by the RvA-accredited Dutch body CIIO B.V. to Cyso Group B.V. with Cyso B.V. in the appendix, scoped to managed hosting, shared hosting and cloud services. Two gaps hold the score at 3/5. First, there is no public DPA: cyso.cloud/dpa returns 404, the legal page at cyso.cloud/legal lists no DPA, the cloud Terms of Use link out to the group terms whose Article 2.11 states processor duties only in general terms, and the vendor confirms the full DPA is available on request, which caps the score at 3 under the directory's DPA-accessibility rule. Second, the only sub-processor list Cyso publishes, the one the vendor itself cited, names Microsoft Corporation, Amazon.com Inc. and Google LLC for 'Cloud Computing' with a reporting date of 14-08-2018 and no revision since, and the group privacy policy behind it is version 1.0.1 of November 2018; the MX records for cyso.cloud and cyso.com independently resolve to Google Workspace. The compute path itself is clean (cyso.cloud resolves into Cyso's own RIPE block FUGA_FRA, not to a hyperscaler or a US CDN), but a live list naming three US corporations is the vendor's operative public statement, so exposure is recorded as material until a current, platform-scoped list is published.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 3 · 3 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: Not assessed
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Cyso Cloud
Cyso Cloud is the OpenStack public cloud of Cyso B.V. (Wognumsebuurt 3, 1817 BH Alkmaar; KvK 37133395; VAT NL8185.13.974.B03), part of Cyso Group B.V. (KvK 33287475), a Dutch hosting company founded in 1997 by Paul Bankert, Sven Visser and Tjebbe de Winter, who still lead it. The cloud platform started separately in 2016 as Fuga Cloud and was folded back into Cyso on 1 January 2025 under the Cyso Cloud name. The service surface covers compute (s5 standard, c5 CPU-optimised and m5 memory-optimised flavours), S3-compatible object storage with versioning and lifecycle rules, Enterprise Managed Kubernetes with a 99.9% SLA, load balancers, anycast DNS, a transactional email service, plus IAM and cloud databases still in beta. It runs vanilla OpenStack with no proprietary abstraction layer, so the OpenStack API, CLI and the standard Terraform OpenStack provider work directly, and Cyso documents the Terraform path itself. Billing is hourly and invoiced monthly in EUR excluding VAT, from €17.50 per month for the smallest instance (2 vCPU, 8 GB RAM, 50 GB disk); object storage is 0.055 EUR per GB with egress charged at the same rate.
Ownership and certification hold up under independent checking. Cyso is founder-owned Dutch with no US parent and no US investor in the chain, and the two certificates were read straight from the published PDFs rather than trusted from a badge: ISO/IEC 27001:2022 (certificate 25.002, valid 21-02-2025 to 21-02-2028) and NEN 7510-1:2017+A1:2020 (certificate 25.080, valid 24-06-2025 to 20-02-2027), both issued by the RvA-accredited Dutch certifier CIIO B.V. to Cyso Group B.V., with Cyso B.V. and SQR B.V. named in the appendix, scoped to managed hosting, shared hosting and cloud services. NEN 7510 is the Dutch healthcare information-security standard and is the credential that genuinely differentiates this listing. The infrastructure claim checks out too: cyso.cloud resolves to 81.24.14.232 inside the RIPE block FUGA_FRA maintained by CYSO-MNT, so there is no US CDN in front and no hyperscaler underneath, and the platform runs from three data centres across Amsterdam and Frankfurt with the region selectable per object-storage bucket.
The paperwork is what holds this at 3/5. There is no publicly downloadable Data Processing Agreement: cyso.cloud/dpa returns 404, the legal page at cyso.cloud/legal lists no DPA, the cloud Terms of Use link out to the group terms whose Article 2.11 sets processor duties only in general language, and the vendor confirms the full DPA is available on request. More significant is the sub-processor position. The only list Cyso publishes, and the document the vendor cited in its own listing request, names Microsoft Corporation, Amazon.com Inc. and Google LLC for the purpose 'Cloud Computing', with a reporting date of 14 August 2018 and no revision since; the group privacy policy behind it is version 1.0.1 of November 2018. Independently, the MX records for both cyso.cloud and cyso.com point to Google Workspace, so Google LLC processes inbound support and sales mail. Set against the trust-centre claim of 'no unauthorised transfers outside the EU', that is a live contradiction, and this directory records the exposure as Material rather than accept the self-attestation. Two practical notes: object storage is not encrypted at rest by default, with SSE-C or client-side encryption as the offered routes, and there are no GPU or bare-metal flavours. Buyers who need a self-servable DPA and a current sub-processor register should compare against Hetzner, OVHcloud, Scaleway and Cleura in this category.
Sub-processor map · 3
-
Amazon.com Inc. USUnited States
Cloud computing (purpose as published, verbatim; no scope, region or service named); reported 14-08-2018, never revised
-
Google LLC USUnited States
Cloud computing (purpose as published, verbatim); reported 14-08-2018, never revised; separately confirmed live via the Google Workspace MX records on cyso.cloud and cyso.com
-
Microsoft Corporation USUnited States
Cloud computing (purpose as published, verbatim; no scope, region or service named); reported 14-08-2018, never revised
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Amazon.com Inc. | United States | Cloud computing (purpose as published, verbatim; no scope, region or service named); reported 14-08-2018, never revised | US |
| Google LLC | United States | Cloud computing (purpose as published, verbatim); reported 14-08-2018, never revised; separately confirmed live via the Google Workspace MX records on cyso.cloud and cyso.com | US |
| Microsoft Corporation | United States | Cloud computing (purpose as published, verbatim; no scope, region or service named); reported 14-08-2018, never revised | US |
Source: the vendor’s published sub-processor list, read 10 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Cyso Cloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |