Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.
- FROM
- €1/mo
- CLOUD ACT
- NONE
A single roll-up of ownership and CLOUD Act exposure.
Norwegian managed enterprise-cloud platform (est. 2000), own platform colocated in Oslo, NO/SE data residency, ISO 27001 + ISAE 3402/3000; enterprise quote-based, no public pricing.
Intility, in the Cloud & hosting category, offers EU hosting with Norway as its hosting location, but a US parent or sub-processor leaves material CLOUD Act exposure.
Intility AS (org. nr 981 967 070, Schweigaards gate 39, Oslo) is a Norwegian-controlled managed enterprise-cloud platform that runs its OWN platform on colocated hardware (Bulk Data Centers, OS-IX Oslo) with all platform data stored and processed within Norwegian and Swedish borders and operated by NO/SE staff — a genuine local operator, not a US-hyperscaler reseller. It is ISO 27001 certified (audited April 2025 by Scandinavian Certification AS, covering all service deliveries) and additionally publishes ISAE 3402 Type 2 (security) and ISAE 3000 Type 2 (GDPR) reports. It is capped at 3/5 because: (1) the flagship product is a multicloud managed platform that routinely integrates Microsoft 365 / Azure and other public cloud for customers, introducing material US CLOUD Act exposure outside the dedicated 'Sovereign Cloud' SKU; (2) there is no publicly self-servable DPA — processing is governed by per-customer agreements available only on contract, and the public sub-processor list (Fathom, Hotjar, Questback, Teamtailor, WhistleB) covers only the corporate website, not the customer platform; (3) Norway is EEA but outside the EU, and no EUCS / C5 / SecNumCloud attestation exists. The clean local-hero posture applies to the Sovereign Cloud offering specifically; the default platform is multicloud.
How exposed customer data is to US authorities under the CLOUD Act.
Where ultimate control over the operating company sits.
Intility AS is a Norwegian managed enterprise-cloud and digital-workplace provider founded in 2000, headquartered at Schweigaards gate 39, 0191 Oslo (org. nr 981 967 070), serving roughly 700 companies across 3,000+ locations in Norway and the wider Nordics. Unlike a self-service IaaS, Intility sells a fully-managed "complete platform for multicloud IT environments": it operates its own platform on colocated infrastructure (Bulk Data Centers' OS-IX facility in Oslo, with Swedish presence), wrapping compute, networking, managed Kubernetes, managed databases, identity/SSO, security and an end-user digital workplace into one operated service. This is a real local operator running its own stack — not a thin reseller of a US hyperscaler.
For sovereignty-minded buyers the key distinction is between Intility's dedicated Sovereign Cloud SKU and its default multicloud platform. The Sovereign Cloud keeps all data stored and processed strictly within Norwegian and Swedish jurisdiction, operated and supported exclusively by NO/SE personnel, and can be locked to a single country — a genuinely clean posture for finance, healthcare, energy and public-sector workloads. The mainstream Intility platform, by contrast, is explicitly multicloud and commonly integrates Microsoft 365 / Azure and other public cloud at the customer's election, which carries material US CLOUD Act exposure for any data that lands there. Buyers must therefore specify the sovereign offering to get the local-only guarantees.
Compliance evidence is solid on attestation but weak on self-serviceability: Intility holds ISO 27001 (certified April 2025 by Scandinavian Certification AS, scope = all service deliveries, only "outsourced development" excluded) and publishes ISAE 3402 Type 2 (information security) and ISAE 3000 Type 2 (GDPR) reports. However, the DPA is not publicly available — processing is governed by separate per-customer data-processing agreements — and the only public sub-processor list covers the corporate marketing website (Fathom Analytics, Hotjar, Questback, Teamtailor, WhistleB), not the customer platform. Ownership is Norwegian-led with minority Nordic/UK venture backing (Northzone, Melesio; linked via the Amphytron vehicle of Bjørn Stray and Arild Engh); no US private-equity or US controlling stake is evident. Pricing is enterprise and quote-based with no public EUR list. Best fit: Nordic enterprises and public bodies that want a single managed sovereign platform and will contract the Sovereign Cloud SKU explicitly.
Italian sovereign cloud (Aruba S.p.A.), 4 Italian DCs (Arezzo/Bergamo/Rome), ACN-qualified up to AI3/QC3 for public administration.
Swedish OpenStack public + compliant cloud (Cleura, ex-City Network, Iver-owned), ISO 27001/27017/27018, EU-only residency.
French sovereign PaaS/IaaS: deploy apps and managed databases on EU infrastructure, billed per second.