Skip to content
Independently verified · Quarterly re-audit
EU VETTED

Exoscale

VERIFIED
Cloud & hosting · Switzerland
Founded 2011 · exoscale.com ↗

Swiss public cloud (Akenes SA, A1 Digital member), 6 EU/CH zones, ISO 27001 + FINMA + TISAX, Swiss-data-residency guarantee.

In short

Exoscale, in the Cloud & hosting category, is a European service with Switzerland as its hosting location and at most minor, transient US exposure under the CLOUD Act.

Assessment notes

Lausanne-based Swiss public cloud (Akenes SA, member of Austrian Telekom A1 Group's A1 Digital), founded 2011, with ISO/IEC 27001:2022 + ISO 27017 + ISO 27018 + FINMA Circular 2018/3 + TISAX + DORA-ready, six EU/EEA + CH data-centre zones in Geneva, Zurich, Vienna ×2, Frankfurt, and Zagreb, and a Swiss-data-residency guarantee for workloads placed in Swiss zones; AWS appears as an archival sub-processor on the customer-data path, which is the sole reason a minor CLOUD Act flag applies. Compute, object storage and SKS workloads stay on the EU/CH stack with no US dependency.

CLOUD ACT
OWNERSHIP
SUB-PROCS
7 · 3 US
Verified signals
Jurisdiction
  • EU / adequacy hosting
  • EU / adequacy operator
  • No US CLOUD Act exposure
Transparency
  • Public DPA
  • Sub-processors disclosed
  • Open-source clients
  • Third-party certification
JUMP TO
OVERVIEW

About Exoscale

Exoscale is a Swiss public cloud operated by Akenes SA (Boulevard de Grancy 19A, 1006 Lausanne; CHE-423.524.322), founded in 2011 and a member of A1 Digital, the digital subsidiary of A1 Telekom Austria Group, the largest telecoms group in Central and Eastern Europe. The product covers compute, storage, AI/GPU instances, Kubernetes (SKS), DBaaS (PostgreSQL, MySQL, Redis, OpenSearch, Kafka, Valkey), and object storage across six European data-centre zones: Switzerland (Geneva CH-GVA-2 and Zurich CH-DK-2), Austria (Vienna AT-VIE-1 and AT-VIE-2), Germany (Frankfurt DE-FRA-1), and Croatia (Zagreb HR-ZAG-1). Pricing is billed by the second at a flat rate across all zones, with no upfront commitment.

Compliance is enterprise-grade and built specifically for regulated workloads. Exoscale carries ISO/IEC 27001:2022, ISO 27017, ISO 27018, the Swiss FINMA Circular 2018/3 outsourcing framework (essential for Swiss financial-services customers), TISAX (German automotive supply-chain security), DORA-readiness for EU financial-services operational resilience, and the full Cloud Security Alliance 100-control-point framework. Operating under Swiss law and the Swiss Federal Data Protection Act, the company explicitly guarantees that "data uploaded in one of our Swiss zones is stored in Switzerland only": no cross-border transfers. The Swiss zones are housed in Equinix-managed facilities with strict physical-access controls; decommissioned drives are destroyed or cryptographically locked. Switzerland's EU adequacy decision (Art. 45 GDPR) keeps transfers between CH and EU jurisdictions legally clean without SCCs.

Sub-processors are deliberately minimal: Aiven Oy (Helsinki, FI) handles DBaaS orchestration; Adyen (NL) and PostFinance / PayPal cover payments; Matomo (NZ-incorporated, EU-self-hostable) handles portal analytics; Mailchimp is used for newsletters but no permanent email storage; AWS appears solely as an archival sub-processor, the only US-owned dependency, holding the CLOUD Act flag at minor rather than none. Compute, Storage, and SKS currently have no third-party processors listed. The EU GDPR representative is A1 Digital International GmbH (Lassallestrasse 9, Vienna, AT). Best fit: Swiss financial-services (FINMA-regulated), DACH automotive supply-chain (TISAX), regulated public-sector buyers, and EU companies that want Swiss data residency with EU/CH adequacy clarity.

SUB-PROCESSORS

Sub-processor map · 7

Source ↗
  • Amazon Web Services, Inc. US
    United States

    Archival sub-processor; customer-data backups/archives at rest (US-owned); sole reason for the minor CLOUD Act flag, kept off the live customer workloads

  • Mailchimp (Intuit Inc.) US
    United States

    Newsletter delivery with no permanent email storage; ancillary, off the customer-data path

  • PayPal US
    United States

    Payment processing; ancillary, off the customer-data path

  • Adyen N.V. EU
    Netherlands

    Payment processing; ancillary, off the customer-data path

  • Aiven Oy EU
    Finland

    Orchestration of data infrastructure services instances (DBaaS) running on Exoscale Compute

  • InnoCraft Ltd (Matomo) non-US
    New Zealand

    Portal/website analytics; ancillary, EU-self-hostable, off the customer-data path

  • PostFinance AG EU
    Switzerland

    Payment processing; ancillary, off the customer-data path

3 of 7 sub-processors are US-incorporated. Limited CLOUD Act exposure via these ancillary sub-processors.
CERTIFICATIONS

Frameworks & certifications

ISO/IEC 27001
ACTIVE
ISO/IEC 27017
ACTIVE
ISO/IEC 27018
ACTIVE
FEATURES

Capability matrix

Dedicated / bare-metal No
Object storage (S3) Yes
Managed Kubernetes Yes
Managed databases Yes
GPU instances Yes
Hourly billing Yes
API / Terraform Yes
Countries 5 countries
INTEGRATION & ACCESS
REST API Yes
SSO (SAML / OIDC) Yes
COMPLIANCE & GOVERNANCE
Audit log Yes
Self-host / on-prem option No
PRICING

Pricing & tiers

PAID
from €9/mo
View pricing page ↗
PUBLIC DOCUMENTS

Public documents

  • Data Processing Addendum (DPA)
    www.exoscale.com/dpa…
    Open ↗
  • Sub-processors list
    www.exoscale.com/privacy…
    Open ↗
  • Terms of Service
    www.exoscale.com/terms…
    Open ↗
ALTERNATIVES

Alternatives in this category

Aruba Cloud
Italy · Founded 1994
EU-SOVEREIGN

Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.

Public DPA Sub-processors Open source
FROM
€1/mo
CLOUD ACT
NONE
Cleura
Sweden · Founded 2005
EU-SOVEREIGN

Swedish OpenStack public + compliant cloud (Cleura, ex-City Network, Iver-owned), ISO 27001/27017/27018, EU-only residency.

Public DPA Sub-processors Open source
FROM
CLOUD ACT
NONE
Clever Cloud
France · Founded 2010
EU-SOVEREIGN

French sovereign PaaS/IaaS: deploy apps and managed databases on EU infrastructure, billed per second.

Public DPA Sub-processors Open source
FROM
€4.8/mo
CLOUD ACT
NONE