Thalassa Cloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Dutch Kubernetes-native sovereign cloud (Thalassa Cloud Services B.V., Arnhem, 2024); 100% EU-owned, NL-hosted, API-first with an official Terraform provider. Early-stage, no published certifications yet.
Thalassa Cloud is an EU-owned service hosted in the Netherlands, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Thalassa Cloud Services B.V. (Arnhem, Netherlands; KvK 99309769, founded ~2024) is a bootstrapped, 100% EU-owned Kubernetes-native sovereign cloud: virtual machines, managed Kubernetes, managed PostgreSQL, S3-compatible object storage and VPC networking driven by an API-first control plane with an official Terraform/OpenTofu provider. Jurisdiction is clean: Dutch B.V., no US parent, no external/US VC, NL-hosted, and the vendor states no non-EU dependencies, so CLOUD Act exposure is low on its face. The score is held down by the assurance gap, not the sovereignty story: no published third-party certifications (no ISO 27001 / BSI C5 / SecNumCloud / SOC 2, only 'via partners'), the DPA is request-only (no public URL), there is no public sub-processors list, and the platform is early-stage: a single region (Arnhem, nl-ams-1), a very small founder-led team, and several services still 'Coming Soon'. Listed for sovereignty coverage as a credible EU-owned NL option, with the early-stage and transparency caveats noted.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Thalassa Cloud
Thalassa Cloud (operated by Thalassa Cloud Services B.V., Meander 251, Arnhem, Netherlands; KvK 99309769) is a bootstrapped, founder-led EU-sovereign public cloud built Kubernetes-native and API-first, positioned as a Dutch alternative to the hyperscalers for DevOps teams. The platform covers virtual machines, managed Kubernetes (with integrated IAM/RBAC and VPC), managed PostgreSQL, S3-compatible object storage, block and file storage, container registry, managed Prometheus and a cost explorer, all provisionable through a REST API, CLI, and official Terraform / OpenTofu / Pulumi providers. Billing is usage-based (per-minute, EUR ex-VAT): the cheapest VM is roughly €5/month, a managed Kubernetes control plane around €19.50/month, with free VPC / subnets / security-groups and free bandwidth. A "Dedicated Private Cloud" option is offered for organisations wanting isolated capacity. The sovereignty positioning is strong and clean on paper: 100% EU-owned, NL-hosted, no non-EU dependencies, GDPR-first design, NIS2 support, and Dutch Cloud Community membership, with named public-sector customers including Provincie Noord-Holland and Dienst Justitiële Inrichtingen (DJI). The caveats are maturity and assurance: founded around 2024 as a bootstrapped startup with a very small team; a single region (Arnhem, nl-ams-1) with the data-centre operator undisclosed; no published certifications (ISO 27001 / BSI C5 / SecNumCloud / SOC 2 are described as available "via partners", i.e. not currently held); a Data Processing Agreement that is referenced in the terms but available only on request; and no public sub-processors list. No GPU instances or bare-metal. Best fit: Dutch / EU teams that want a genuinely EU-owned, Kubernetes-native sovereign cloud and can accept an early-stage provider without formal certifications. Not yet a fit for procurement that mandates ISO 27001 / C5 or a publicly signable DPA.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Thalassa Cloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicethalassa.cloud/terms-and-conditions…
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |