UpCloud
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Finnish performance-focused cloud (Helsinki, 2011), 14+ DCs worldwide including 9 EU regions; ISO 27001; trusted by Plausible.
UpCloud is an EU-owned service hosted in Finland, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Helsinki-headquartered Finnish cloud provider (founded 2011, European-owned with no public US-PE chain on record), ISO 27001 certified, with two flagship data centres in Helsinki (FI-HEL1, FI-HEL2) plus EU regions in Frankfurt, Amsterdam, Copenhagen, Stavanger, Warsaw, Madrid, Stockholm, and London. A customer-elected region keeps customer workloads under EU jurisdiction; EU-owned and EU-hosted with no CLOUD Act exposure when EU DCs are selected.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About UpCloud
UpCloud is a Helsinki-headquartered Finnish cloud infrastructure provider founded in 2011 and positioned for high-performance compute workloads. The company runs two flagship data centres in Helsinki (FI-HEL1 and FI-HEL2) plus additional EU regions in Frankfurt, Amsterdam, Copenhagen, Stavanger (Norway), Warsaw, Madrid, Stockholm, and London, plus global regions in Chicago, New York, San Jose, Singapore, and Sydney. The customer base spans developer-focused workloads, SaaS, hosting resellers, and notable EU SaaS. UpCloud is one of the named sub-processors used by Plausible Analytics, for example.
For procurement-grade EU buyers UpCloud's compliance posture is strong: EU-owned, EU-hosted, with no CLOUD Act exposure when EU regions are selected. The company is ISO/IEC 27001 certified, GDPR-aligned, European-owned with no published US-PE control chain, and explicitly positions itself for "European data sovereignty" with customer-elected region pinning. Finland is an EU member with full GDPR alignment, so transfers between Finnish UpCloud workloads and other EU jurisdictions need no SCCs; the Stavanger region (Norway) is EEA and similarly adequacy-clean. UpCloud's automated infrastructure stack uses MaxIOPS storage (its proprietary distributed block storage) and a 100% uptime SLA, strong reliability differentiators for SMB and mid-market customers without enterprise hyperscaler complexity.
Pricing starts at roughly €5/month for the smallest virtual instance (1 vCPU, 1 GB RAM, 25 GB MaxIOPS, 1 TB transfer) on hourly or monthly billing in EUR. Best fit: developers, SaaS builders, and EU SMBs who want a Helsinki-rooted alternative to DigitalOcean or Linode with strong ISO 27001 certification and clean EU jurisdiction. The public pages returned 403 to WebFetch at audit (anti-bot fronting on upcloud.com), so the DPA and sub-processors annex URLs were not directly captured. Vendor outreach recommended before publishing the canonical URLs.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of UpCloud
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |