Aruba Cloud – The European Cloud, certified and AI-ready

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: Aruba S.p.A. is an Italian S.p.A., privately owned, headquartered in Italy, governed by Italian law with EU jurisdiction. No foreign parent or non-EU ownership exists.

Evidence

• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Directly confirms that the legal entity controlling cloud services is an Italian S.p.A. and that all contractual governance and jurisdictional authority resides within EU member state Italy.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms Aruba is an EU-origin company with no indication of non-EU parent ownership or control. All operations and headquarters are within the EU/EEA.
• Organisation, Management and Control Model of Aruba S.p.A. other 30. September 2026
  Official corporate governance document under Italian Legislative Decree 231/2001, describing Aruba S.p.A. as parent company of the Aruba Group with a Board of Directors and Board of Statutory Auditors, registered in Ponte San Pietro, Italy.
  Relevance: Confirms Aruba S.p.A. is the top-level parent entity with traditional Italian corporate governance, meaning ultimate decision-making authority resides entirely within EU jurisdiction.

Selected answer: 5. Very unlikely Value 125 SEAL 4

Notes: Privately held, family-controlled (Cecconi family), wholly Italian capital, parent company (not subsidiary), not listed on any exchange — very low takeover risk.

Evidence

• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Directly establishes that Aruba is privately held with wholly Italian/EU capital, no stock exchange listing, and no foreign ownership — key indicators of low change-of-control risk.
• D&B Business Directory – ARUBA SPA other 1. October 2026
  Dun & Bradstreet profile confirming Aruba S.p.A. as a 'Private Parent - Headquarters' at the top of its corporate family, not a subsidiary of any larger entity.
  Relevance: Confirms Aruba is a parent company, not subsidiary to any non-EU entity, reducing likelihood of external takeover or transfer of control to non-sovereign owners.
• Organisation, Management and Control Model of Aruba S.p.A. other 30. September 2026
  Official corporate governance document under Italian Legislative Decree 231/2001, describing Aruba S.p.A. as parent company of the Aruba Group with a Board of Directors and Board of Statutory Auditors, registered in Ponte San Pietro, Italy.
  Relevance: Demonstrates robust Italian corporate governance structure under Italian Legislative Decree 231/2001, reinforcing EU-anchored ownership stability and low risk of non-EU transfer.

Selected answer: 3. Governance bodies exist with EU actors participation Value 83 SEAL 3

Notes: Aruba participates in EU governance bodies (CISPE, Gaia-X, SECA) where EU actors shape its roadmap, but full control is not established as it's privately owned.

Evidence

• CISPE is a founding member of Gaia-X other 1. October 2026
  CISPE announcement of Gaia-X founding membership. Aruba CEO Stefano Cecconi is CISPE Vice-President, giving Aruba direct governance influence in EU cloud initiatives.
  Relevance: Shows Aruba's CEO holds VP role in CISPE, a founding Gaia-X board member — demonstrating EU governance bodies where stakeholders shape Aruba's technological roadmap.
• European cloud providers unite over data sovereignty-focused API (Computer Weekly) other 1. October 2026
  Article on Aruba, IONOS, and Dynamo co-creating SECA open-source API for EU cloud interoperability. CISPE restructured to exclude non-European providers from governance.
  Relevance: Demonstrates Aruba actively co-shaping EU cloud standards via governance bodies (CISPE/SECA), confirming EU stakeholder participation in roadmap decisions.
• Organisation, Management and Control Model of Aruba S.p.A. other 30. September 2026
  Official corporate governance document under Italian Legislative Decree 231/2001, describing Aruba S.p.A. as parent company of the Aruba Group with a Board of Directors and Board of Statutory Auditors, registered in Ponte San Pietro, Italy.
  Relevance: Confirms Aruba's governance structure includes stakeholder considerations and is anchored in EU/Italian corporate law, enabling EU actor participation in governance.

Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4

Notes: Aruba S.p.A. is privately held with wholly Italian capital, no foreign investors, and self-financed growth from EU revenue.

Evidence

• Aruba S.p.A receives €500 million in funding — DCNN Magazine other 1. October 2026
  Article detailing Aruba's €500M self-investment in its Bergamo Global Cloud Data Centre campus expansion, powered by renewable energy.
  Relevance: Shows major infrastructure investment financed internally by an Italian company without external non-EU capital involvement.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Directly confirms Aruba has 'wholly Italian capital' and is privately owned with no indication of any non-EU investors or external capital.
• D&B Business Directory – ARUBA SPA other 1. October 2026
  Dun & Bradstreet profile confirming Aruba S.p.A. as a 'Private Parent - Headquarters' at the top of its corporate family, not a subsidiary of any larger entity.
  Relevance: Confirms Aruba is an independent parent company with no foreign parent or external ownership structure, supporting EU-only capital.

Selected answer: 5. Fully in the EU Value 125 SEAL 4

Notes: Aruba is wholly EU-based: all operations, data centers (IT/CZ), jobs (~900-1365), €500M+ investment, and €300M revenue are within the EU/EEA. No non-EU footprint.

Evidence

• Aruba S.p.A receives €500 million in funding — DCNN Magazine other 1. October 2026
  Article detailing Aruba's €500M self-investment in its Bergamo Global Cloud Data Centre campus expansion, powered by renewable energy.
  Relevance: Demonstrates major EU-based capital investment and value creation. All €500M invested in Italian infrastructure, with workforce development via Aruba Academy and university partnerships.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms all operations, revenue, employees, and data centers are within EU/EEA. No non-EU investment or operations reported. Directly addresses EU economic contribution.
• Aruba, Hyperscaler Transitions and the Italian Data Centre Potential — Capacity Magazine other 1. October 2026
  Interview with Aruba's Head of Data Centre Services covering Bergamo campus (200,000 sqm, 45MW) and Rome IT4 (30MW), sustainability via renewables, and European expansion strategy.
  Relevance: Highlights Aruba's ongoing EU-focused data center expansion, job creation, and strategic role in Italy's emergence as a Tier I European data center market. All investment in EU member states.

Selected answer: 2. Active participant in strategic projects Value 62 SEAL 4

Notes: Aruba is a Day-1 Gaia-X member, operates a Gaia-X Digital Clearing House, and its CEO is CISPE Vice-President (CISPE co-founded Gaia-X). Also active in Structura-X and SECA API.

Evidence

• Aruba Formalises Its GAIA-X Status as a Day-1 Member other 1. October 2026
  Article confirming Aruba S.p.A. formally joined Gaia-X as a Day-1 member, with CEO Stefano Cecconi emphasizing commitment to European cloud infrastructure.
  Relevance: Directly confirms Aruba's active participation in Gaia-X, a flagship EU strategic cloud sovereignty initiative, as a founding-level Day-1 member.
• CISPE is a founding member of Gaia-X other 1. October 2026
  CISPE announcement of Gaia-X founding membership. Aruba CEO Stefano Cecconi is CISPE Vice-President, giving Aruba direct governance influence in EU cloud initiatives.
  Relevance: Links Aruba to Gaia-X governance through CISPE leadership role, confirming strategic-level participation in EU cloud sovereignty initiatives.
• Presented at GX Summit 2023: The Aruba Digital Clearing House Solution other 1. October 2026
  Aruba presented its end-to-end Digital Clearing House solution at Gaia-X Summit 2023, acting as a gateway to the Gaia-X ecosystem with eIDAS-compliant credentials.
  Relevance: Shows Aruba as an operational operator within Gaia-X infrastructure, not just a passive member — demonstrating deep strategic involvement.

Selected answer: Already measured achievement and existing dedicated governance Value 83 SEAL 4

Notes: Aruba shows concrete achievements (Gaia-X Day-1 member, CISPE VP, Climate Neutral Data Centre Pact, European Green Digital Coalition, €500M EU investment) with dedicated governance structures.

Evidence

• Aruba S.p.A on Growth and Sustainable Data Centre Management other 1. October 2026
  Interview covering Aruba's sustainability commitments: Climate Neutral Data Centre Pact certification, European Green Digital Coalition membership, hydroelectric and photovoltaic investments, 100% renewable Rome campus.
  Relevance: Shows measurable achievements in EU green strategy alignment via Climate Neutral Data Centre Pact and European Green Digital Coalition, with dedicated renewable energy infrastructure investments.
• Aruba S.p.A receives €500 million in funding — DCNN Magazine other 1. October 2026
  Article detailing Aruba's €500M self-investment in its Bergamo Global Cloud Data Centre campus expansion, powered by renewable energy.
  Relevance: Demonstrates significant dedicated means and industrial sovereignty alignment through large-scale EU-based infrastructure investment with green energy, consistent with EU industrial strategy goals.
• CISPE is a founding member of Gaia-X other 1. October 2026
  CISPE announcement of Gaia-X founding membership. Aruba CEO Stefano Cecconi is CISPE Vice-President, giving Aruba direct governance influence in EU cloud initiatives.
  Relevance: Demonstrates Aruba's formal governance role in EU digital sovereignty initiatives (CISPE VP) and founding membership in Gaia-X, a flagship EU digital industrial strategy project.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 93 SEAL 2

Notes: Aruba owns its infrastructure and uses open-source tech (OpenStack, Kubernetes) to avoid lock-in, but relies on some proprietary vendors (VMware, Veeam), preventing full autonomy.

Evidence

• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms Aruba owns its entire infrastructure stack, providing operational independence from external vendors and the ability to internalise key functions if support is cut off.
• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Directly addresses vendor lock-in avoidance and operational independence — key factors in resilience to cut-off if external vendor support is withdrawn.
• Technology | Aruba Cloud other 1. October 2026
  Details Aruba's technology stack: OpenStack for public cloud, Kubernetes for containers, Proxmox/Vates VMS (European open-source) for private cloud, alongside VMware. Emphasizes interoperability and reduced vendor lock-in.
  Relevance: Shows Aruba's open-source technology foundation enabling internalisation of key functions, supporting ability to sustain operations without proprietary vendor support.

Selected answer: 3. Exclusively EU law Value 167 SEAL 4

Notes: Aruba S.p.A. is Italian, 100% EU-owned, with contracts governed by Italian law and exclusive jurisdiction of the Court of Bergamo. No non-EU legal exposure.

Evidence

• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Directly confirms the primary legal jurisdiction governing Aruba Cloud's contracts is Italian law (EU member state), with no non-EU jurisdiction clauses.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms Aruba's corporate identity as a standalone Italian/EU entity with no non-EU parent or ownership, reinforcing exclusive EU legal jurisdiction.
• European Sovereign Cloud: Compliance, Security & Data in Italy other 1. October 2026
  Aruba Cloud's sovereignty page confirming it is 100% Italian-owned, subject exclusively to European laws (GDPR), and not subject to non-EU laws like the U.S. CLOUD Act.
  Relevance: Explicitly states Aruba is subject exclusively to EU law and is not exposed to non-EU extraterritorial legislation, supporting exclusively EU jurisdiction.

Selected answer: Legal structures shielding from foreign law Value 125 SEAL 2

Notes: Aruba is 100% Italian-owned, no US nexus, EU-only infrastructure. Corporate structure shields from CLOUD Act and other extraterritorial laws.

Evidence

• Frequently Asked Questions about the U.S. CLOUD Act – Cross-Border Data Forum other 1. October 2026
  Detailed FAQ explaining CLOUD Act jurisdictional requirements, confirming it cannot compel European companies operating exclusively outside the US without personal jurisdiction.
  Relevance: Establishes that CLOUD Act requires personal jurisdiction (sufficient US contacts), which Aruba—100% EU-owned, no US parent or subsidiaries—does not have.
• Organisation, Management and Control Model of Aruba S.p.A. other 30. September 2026
  Official corporate governance document under Italian Legislative Decree 231/2001, describing Aruba S.p.A. as parent company of the Aruba Group with a Board of Directors and Board of Statutory Auditors, registered in Ponte San Pietro, Italy.
  Relevance: Confirms Aruba is an Italian joint-stock company with no foreign parent, governed entirely by Italian law—key to assessing exposure to non-EU extraterritorial laws.
• White Paper: Demystifying the US CLOUD Act vs European/UK Data Sovereignty – CMS Law other 1. October 2026
  Legal white paper analyzing CLOUD Act extraterritorial reach versus European data sovereignty, noting EU-owned providers without US nexus are in a fundamentally different position.
  Relevance: Confirms that European-owned providers like Aruba without US parent or sufficient US contacts are structurally shielded from CLOUD Act extraterritorial demands.

Selected answer: 5. Non-EU authorities requests to access data or systems are always rejected by the provider Value 167 SEAL 4

Notes: Aruba is 100% Italian-owned with no US nexus; explicitly states not subject to non-EU laws like CLOUD Act; would reject all non-EU authority data access requests.

Evidence

• European Sovereign Cloud: Compliance, Security & Data in Italy other 1. October 2026
  Aruba Cloud's sovereignty page confirming it is 100% Italian-owned, subject exclusively to European laws (GDPR), and not subject to non-EU laws like the U.S. CLOUD Act.
  Relevance: Directly states Aruba is not subject to non-EU laws, meaning non-EU authorities have no legal channel to compel data access; requests would be rejected.
• Frequently Asked Questions about the U.S. CLOUD Act – Cross-Border Data Forum other 1. October 2026
  Detailed FAQ explaining CLOUD Act jurisdictional requirements, confirming it cannot compel European companies operating exclusively outside the US without personal jurisdiction.
  Relevance: Confirms that Aruba, as a purely EU-based provider with no US presence, falls outside CLOUD Act jurisdiction; non-EU authorities cannot compel access.
• White Paper: Demystifying the US CLOUD Act vs European/UK Data Sovereignty – CMS Law other 1. October 2026
  Legal white paper analyzing CLOUD Act extraterritorial reach versus European data sovereignty, noting EU-owned providers without US nexus are in a fundamentally different position.
  Relevance: Legal analysis confirming that EU-based providers like Aruba without US nexus cannot be compelled by non-EU authorities under the CLOUD Act or similar mechanisms.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: Aruba is EU-owned using open-source tech; part of its offer (non-US-origin) is not subject to ITAR/EAR, benefiting EU MSs and intl organisations.

Evidence

• Aruba Cloud Sovereign Cloud other 1. October 2026
  Aruba's official sovereign cloud page, highlighting EU jurisdiction, data protection, and regulatory compliance under EU law.
  Relevance: Confirms Aruba's EU-only jurisdiction and use of open-source tech, meaning parts of its offer are not subject to US ITAR/EAR export controls.
• Exporting Dual-Use Items — European Commission other 1. October 2026
  Official EU page on Regulation (EU) 2021/821 governing dual-use export controls within the EU.
  Relevance: Defines the EU export control framework applicable to Aruba as an Italian company, distinct from US ITAR/EAR regimes.
• White Paper: Demystifying the US CLOUD Act vs European/UK Data Sovereignty – CMS Law other 1. October 2026
  Legal white paper analyzing CLOUD Act extraterritorial reach versus European data sovereignty, noting EU-owned providers without US nexus are in a fundamentally different position.
  Relevance: Explains that EU-owned providers without a US parent are not subject to US extraterritorial legal regimes, supporting ITAR/EAR non-applicability.

Selected answer: 5. Fully within the EU Value 167 SEAL 4

Notes: Aruba's IP is created, registered, and developed entirely within the EU (Italy). Founded in Florence, HQ in Bergamo, R&D via ArubaKube in Turin.

Evidence

• Aruba Cloud Terms and Conditions other 1. October 2026
  Official T&C document (Article 16) stating software and trademarks are exclusive property of Aruba S.p.A., with registered office in Ponte San Pietro, Italy, governed by Italian law.
  Relevance: Confirms IP registration and ownership within EU jurisdiction — all IP rights held by Italian entity under Italian law.
• Aruba launches centre of excellence for cloud native development — Data Centre Review other 1. October 2026
  Article confirming ArubaKube, Aruba's R&D center of excellence in Turin, Italy, in collaboration with the Polytechnic University of Turin, focused on open-source cloud-native technologies.
  Relevance: Confirms all IP development occurs within the EU — ArubaKube R&D center in Turin, Italy, developing core technologies like LIQO.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms IP origin — company founded, registered, and headquartered in Italy (EU). All proprietary data centers are within the EU.

Selected answer: fully under EU law Value 167 SEAL 4

Notes: Aruba S.p.A. is 100% Italian-owned; all IP (software, trademarks) is exclusively owned and enforced under Italian/EU law with no foreign jurisdiction nexus.

Evidence

• Aruba Cloud Sovereign Cloud other 1. October 2026
  Aruba's official sovereign cloud page, highlighting EU jurisdiction, data protection, and regulatory compliance under EU law.
  Relevance: Confirms Aruba is not subject to any non-EU legal jurisdiction, reinforcing that IP holder jurisdiction is fully within the EU legal framework.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Directly confirms IP ownership by Aruba S.p.A. (Italian entity) and that all IP rights and disputes fall under Italian/EU law with no foreign jurisdiction provisions.
• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Establishes Aruba's corporate identity as a purely Italian/EU entity with no foreign ownership, meaning IP rights are held and enforceable exclusively under EU jurisdiction.

Selected answer: 4. Customer primary control but provider can read the data or some of the data Value 150 SEAL 3

Notes: Aruba Cloud Key Management Service allows BYOK.

Evidence

• Enabling the KMS encryption service and connecting it to the Virtual Private Cloud other 1. October 2026
  Describes how the Aruba KMS can be used to encrypt individual items (vApps, VMs and Named Disks) or the entire vDC of an Aruba Virtual Private Cloud.
  Relevance: Describes how KMS can be used for encryption.

Selected answer: 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) Value 100 SEAL 2

Notes: Application logs available to customers; infrastructure access logs vendor-controlled. No real-time customer oversight or independent auditability.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Describes logging framework: application logs available to customers but infrastructure access logs are vendor-controlled. Auditing is internal and periodic, not real-time or independently auditable.
• Aruba Cloud Sovereign Cloud other 1. October 2026
  Aruba's official sovereign cloud page, highlighting EU jurisdiction, data protection, and regulatory compliance under EU law.
  Relevance: Emphasizes data sovereignty and access controls but provides no evidence of real-time customer-controlled data access logging or independent auditability.
• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Confirms continuous monitoring and logging exist but no mention of real-time customer oversight or independent auditability of data access logs.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: Aruba uses disk wipe and hardware destruction for deletion with ISO 27001 logging/auditing, but no per-deletion independent verification or erasure certificates.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Describes technical deletion mechanisms (disk wipe, hardware destruction) and ISO 27001 logging/auditing, but no per-deletion proof of erasure or independent per-event verification.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Confirms contractual obligation for permanent deletion and GDPR compliance, but does not specify technical verification mechanisms or proof of erasure evidence provided to customers.
• CISPE Code of Conduct other 1. October 2026
  Official CISPE Code requiring data deletion/return at service end (Section 4.11), data subject erasure requests (4.7), and compliance verification by independent monitoring bodies like Bureau Veritas and EY CertifyPoint.
  Relevance: CISPE requires independent verification of overall compliance including deletion procedures, but this is framework-level auditing, not per-deletion proof of erasure for individual customer requests.

Selected answer: 4. Data in the EU by default, tightly controlled exceptions Value 150 SEAL 1

Notes: Data centers in EU (Italy, Czech Republic); UK partner facilities and Virtuozzo sub-processor create tightly controlled third-country exceptions under GDPR safeguards.

Evidence

• Aruba Cloud | European Cloud & Data Center Services — Datacenters.com other 1. October 2026
  Third-party overview of Aruba's data center footprint: Italy (IT1–IT4), Czech Republic (CZ2), and partner facilities in France, Germany, Poland, and UK.
  Relevance: Confirms all proprietary data centers are in EU/EEA; UK partner facilities are the only third-country presence, supporting option 4.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Art. 2.2.1 confirms EU+UK data location; Art. 2.2.2 and 21.4 show tightly controlled third-country exceptions via GDPR safeguards and SCCs.
• European Sovereign Cloud: Compliance, Security & Data in Italy other 1. October 2026
  Aruba Cloud's sovereignty page confirming it is 100% Italian-owned, subject exclusively to European laws (GDPR), and not subject to non-EU laws like the U.S. CLOUD Act.
  Relevance: Directly addresses data location in EU/EEA and Aruba's commitment to keeping data under European law with no non-EU jurisdictional access.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: Aruba hosts open-source AI models (Llama, Mistral, Gemma) on EU infrastructure with full data sovereignty, but relies on NVIDIA GPUs (non-EU chips) and does not develop EU-origin models.

Evidence

• Aruba Cloud — How to Implement Generative AI Models (Ollama + WebUI) other 1. October 2026
  Official Aruba documentation for deploying open-source LLMs (Gemma, Llama 3, Llama 2, Mistral, Phi3) via Ollama + WebUI on Aruba's EU-hosted infrastructure, with RAG and vector database support.
  Relevance: Lists specific open-source, auditable AI models deployed on EU infrastructure. Models like Llama and Gemma are non-EU-developed but open-source; Mistral is EU-origin. No proprietary EU model development by Aruba.
• Aruba Cloud — Private AI Solutions other 1. October 2026
  Details Aruba's sovereign Private AI offerings: GPU servers with AI frameworks, GPU on-demand via Kubernetes, private cloud with GPU, and dedicated AI infrastructure — all in EU data centers.
  Relevance: Confirms support for open-source models (Ollama) on EU-hosted infrastructure with full data governance, but infrastructure depends on NVIDIA accelerators (non-EU chips). No EU-origin model development.
• Aruba Cloud AI Stack other 1. October 2026
  Aruba's modular AI technology stack on European infrastructure: GPU compute (NVIDIA RTX 4070/4080/L40S), AI endpoints, private AI environments, and AI tools for text generation, RAG, and translation.
  Relevance: Shows Aruba uses NVIDIA (non-EU) GPUs but hosts everything in EU data centers with open/composable architecture and no vendor lock-in. Supports open-source and proprietary models, but no EU-origin models.

Selected answer: 4. Formal migration services are available to assist with moving data and workloads Value 125 SEAL 4

Notes: Aruba Cloud offers structured 4-step migration and repatriation services with open standards (OpenStack, Kubernetes) to reduce vendor lock-in, plus documented data export per EU Data Act.

Evidence

• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Explicitly addresses vendor lock-in reduction and portability through open standards (OpenStack, Kubernetes, SECA API), core to interoperability assessment.
• Cloud Migration: Secure and Seamless IT Transition | Aruba Cloud other 1. October 2026
  Aruba Cloud's official migration solutions page detailing a structured 4-step migration journey, Lift & Shift with VMware, and Cloud-Native transformation with OpenShift.
  Relevance: Directly demonstrates formal migration services for moving data and workloads, with structured methodology and expert support, addressing portability and interoperability.
• Cloud Repatriation: Regain Control of Your Cloud | Aruba Cloud other 1. October 2026
  Aruba Cloud's repatriation service offering with a 4-step process and multiple solution types for migrating workloads back to sovereign infrastructure.
  Relevance: Shows formal migration services for workload portability in both directions (to and from Aruba Cloud), strengthening evidence of structured portability support.

Selected answer: 4. Operational services are predominantly delivered by EU-based teams Value 125 SEAL 3

Notes: Aruba is 100% Italian-owned with EU-based R&D (ArubaKube, Turin) and 24/7 EU support. Open-source core (OpenStack), but some VMware usage prevents full independence.

Evidence

• Aruba Cloud | European Cloud & Data Center Services — Datacenters.com other 1. October 2026
  Third-party overview of Aruba's data center footprint: Italy (IT1–IT4), Czech Republic (CZ2), and partner facilities in France, Germany, Poland, and UK.
  Relevance: Independent source confirming EU ownership, EU-based infrastructure, and managed services delivered from within Europe without non-EU vendor involvement.
• Aruba launches centre of excellence for cloud native development — Data Centre Review other 1. October 2026
  Article confirming ArubaKube, Aruba's R&D center of excellence in Turin, Italy, in collaboration with the Polytechnic University of Turin, focused on open-source cloud-native technologies.
  Relevance: Demonstrates EU-based capacity to develop and maintain cloud-native technology independently, reducing reliance on non-EU vendors for innovation and support.
• Why Choose Aruba Cloud other 1. October 2026
  Aruba's official page: 100% Italian, EU-governed cloud with open-source tech (OpenStack), proprietary EU data centers, and multi-level EU-based technical support.
  Relevance: Confirms EU-based operations, open-source stack reducing vendor lock-in, and support delivered by EU specialists — directly relevant to operating without foreign dependencies.

Selected answer: All EU staff Value 125 SEAL 3

Notes: Aruba is 100% Italian-owned with 98.8% of staff in Southern Europe (Italy/EU). Operations, support, and R&D are EU-based with no escalation abroad.

Evidence

• Aruba Number of Employees 2026 | Revelio Labs other 1. October 2026
  Workforce intelligence data showing ~1,241 employees with 98.8% concentrated in Southern Europe (Italy), across Engineering (34.8%), Operations (40.4%), and Sales (24.8%).
  Relevance: Quantitative evidence of an overwhelmingly EU-based talent pool with engineering and operations expertise to sustain the cloud service.
• ArubaKube R&D Centre other 1. October 2026
  Center of excellence in Turin, Italy, in partnership with Polytechnic University of Turin, focused on open-source cloud-native technologies and Kubernetes.
  Relevance: Demonstrates EU-based R&D capability and skill development for operating and evolving the cloud platform independently.
• Why Choose Aruba Cloud other 1. October 2026
  Aruba's official page: 100% Italian, EU-governed cloud with open-source tech (OpenStack), proprietary EU data centers, and multi-level EU-based technical support.
  Relevance: Directly confirms EU-based operational staff, local authorized personnel, and no non-EU dependencies for service operation and support.

Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3

Notes: Aruba is 100% Italian-owned with support staff based in Italy. Job postings and operations confirm EU-only support. No non-EU escalation teams found.

Evidence

• Aruba S.p.A. — Wikipedia other 30. September 2026
  Encyclopedia article confirming Aruba S.p.A. is an Italian joint-stock company founded in Florence (1994), headquartered in Italy, with ~€300M revenue and data centers in Italy and Czech Republic (both EU).
  Relevance: Confirms Italian headquarters and European-only operational footprint, supporting EU-only support staff assessment.
• LinkedIn Jobs – Aruba S.p.A. Job Listings in Italy other 1. October 2026
  Active Aruba S.p.A. job postings showing support roles (e.g., Service Desk Data Center Enterprise) located in Ponte San Pietro and Bergamo, Italy.
  Relevance: Direct evidence that support staff positions are exclusively based in Italian cities, reinforcing EU-only support operations.
• Why Choose Aruba Cloud other 1. October 2026
  Aruba's official page: 100% Italian, EU-governed cloud with open-source tech (OpenStack), proprietary EU data centers, and multi-level EU-based technical support.
  Relevance: Confirms all operations including support are EU-based under EU legal frameworks, with no mention of non-EU support teams.

Selected answer: 4. EU-only primary repositories - All primary documentation and knowledge repositories are stored in the EU (no routine non-EU storage/processing) Value 125 SEAL 4

Notes: Aruba stores primary documentation and knowledge repos in EU data centers (Italy, Czech Republic). UK partner facilities exist but are not routine for documentation storage.

Evidence

• Aruba Cloud | European Cloud & Data Center Services — Datacenters.com other 1. October 2026
  Third-party overview of Aruba's data center footprint: Italy (IT1–IT4), Czech Republic (CZ2), and partner facilities in France, Germany, Poland, and UK.
  Relevance: Shows primary EU data centers (Italy, Czech Republic) but also UK partner facilities (non-EU post-Brexit), supporting Option 4 over Option 5.
• Aruba Cloud Knowledge Base other 1. October 2026
  Aruba Cloud's official Knowledge Base serving as central hub for technical documentation, guides, tutorials, API docs, and support resources across European data centers.
  Relevance: Demonstrates availability of full technical documentation and operational know-how hosted on EU-based infrastructure, enabling long-term autonomy for EU actors.
• European Sovereign Cloud: Compliance, Security & Data in Italy other 1. October 2026
  Aruba Cloud's sovereignty page confirming it is 100% Italian-owned, subject exclusively to European laws (GDPR), and not subject to non-EU laws like the U.S. CLOUD Act.
  Relevance: Confirms Aruba's documentation and operations are governed under EU law with data centers in Italy, supporting EU-only primary repository storage.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: Aruba owns infrastructure, uses open-source stack, and has supplier management policies, but relies on some non-EU vendors (Cisco, Honeywell). Can source alternatives.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Shows supplier oversight practices and jurisdictional scope of infrastructure, key to assessing supplier location and legal control.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Directly addresses subcontractor jurisdiction, sub-processor management, and non-EU data access dependencies relevant to the assessment question.
• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Demonstrates Aruba's strategy for supply chain independence and ability to internalize or source alternatives, supporting Option 4.

Selected answer: Partial disclosure Value 35 SEAL 1

Notes: Aruba discloses data center locations and some infrastructure partners but lacks systematic transparency on geographic origin of physical components.

Evidence

• Aruba Cloud | European Cloud & Data Center Services — Datacenters.com other 1. October 2026
  Third-party overview of Aruba's data center footprint: Italy (IT1–IT4), Czech Republic (CZ2), and partner facilities in France, Germany, Poland, and UK.
  Relevance: Provides overview of Aruba's infrastructure footprint and European sovereignty focus, but lacks any supply chain provenance or component origin transparency details.
• Aruba Global Cloud Data Center — Honeywell Case Study other 1. October 2026
  Details specific hardware suppliers (Honeywell, Rosslare, Notifier) used in Aruba's IT3 data center in Bergamo, including security, CCTV, and fire detection systems.
  Relevance: Reveals named hardware vendors in Aruba's data centers, but geographic origin of underlying components (chips, boards) remains undisclosed, showing partial supply chain visibility.
• Private AI: Xference launches its European infrastructure from Aruba data centres other 1. October 2026
  Article showing Aruba's role as hardware procurement and deployment provider (HaaS) at its IT3 data center, with emphasis on EU data sovereignty.
  Relevance: Confirms Aruba procures and deploys server hardware but provides no disclosure on the geographic origin or provenance of the physical components used.

Selected answer: Mixed sourcing, EU audit rights Value 71 SEAL 3

Notes: Aruba uses a mix of EU (Socomec, Pramac) and non-EU suppliers (Cisco, Dell, Intel, NVIDIA) for hardware; ISO 27001 and EU jurisdiction provide audit rights.

Evidence

• Aruba Data Center — SlideShare Presentation by Aruba S.p.A. other 1. October 2026
  Official Aruba presentation confirming Cisco Nexus 7000 core network, Dell and Intel partnerships for servers and compute infrastructure.
  Relevance: Aruba's own presentation discloses key non-EU hardware suppliers (Cisco, Dell, Intel), confirming partial disclosure of manufacturing origins.
• Aruba Global Cloud Data Center — Honeywell Case Study other 1. October 2026
  Details specific hardware suppliers (Honeywell, Rosslare, Notifier) used in Aruba's IT3 data center in Bergamo, including security, CCTV, and fire detection systems.
  Relevance: Directly identifies non-EU hardware vendors used in Aruba data centers, confirming mixed sourcing of critical components from non-EU manufacturers.
• Colocation Data Center Monitoring at the Largest Campus in Italy — Inductive Automation other 1. October 2026
  Details Aruba IT3 monitoring system listing ABB PLCs, Socomec UPS, Pramac gensets, and Honeywell firefighting systems as deployed hardware.
  Relevance: Lists specific hardware vendors in Aruba's data center, showing a mix of EU (Socomec-France, Pramac-Italy) and non-EU (Honeywell-US) suppliers for critical infrastructure.

Selected answer: Partial disclosure Value 35 SEAL 4

Notes: Aruba claims supply chain oversight and discloses some suppliers (Cisco, Dell, Honeywell) via case studies, but lacks systematic firmware/code provenance disclosure.

Evidence

• Aruba Global Cloud Data Center — Honeywell Case Study other 1. October 2026
  Honeywell customer story detailing fire/security hardware (DVM600, Galaxy, Notifier, VESDA) deployed at Aruba IT3 data center in Bergamo.
  Relevance: Confirms specific non-EU hardware suppliers (Honeywell is US-based) used in Aruba data centers, showing partial supplier visibility without firmware provenance.
• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Mentions end-to-end supply chain oversight and ACN qualification, but no disclosure of embedded code provenance or firmware origin details.
• Why Choose Aruba Cloud other 1. October 2026
  Aruba's official page: 100% Italian, EU-governed cloud with open-source tech (OpenStack), proprietary EU data centers, and multi-level EU-based technical support.
  Relevance: Claims full supply chain sovereignty but provides no component-level or firmware provenance disclosure, supporting partial disclosure assessment.

Selected answer: 3. Core and essential parts of the software are designed and maintained by EU teams Value 71 SEAL 3

Notes: Aruba develops proprietary cloud software in Italy (Turin Software Factory, ArubaKube R&D) but relies on non-EU components like VMware and NVIDIA.

Evidence

• Aruba announces the birth of ArubaKube — Bdaily other 1. October 2026
  Article announcing ArubaKube as a spin-off of Polytechnic University of Turin and Aruba's R&D centre for cloud-native open-source software, alongside the Aruba Software Factory opened in 2019 in Turin.
  Relevance: Confirms Aruba's core software (cloud management, Kubernetes platform, Liqo) is architected and maintained by EU teams in Turin, Italy, but also shows reliance on open-source projects with global contributors.
• Aruba Cloud Technology Stack other 1. October 2026
  Official Aruba Cloud technology page detailing the platform stack: OpenStack for public cloud, Kubernetes for containers, Proxmox/Vates VMS for private cloud, and VMware Cloud Foundation.
  Relevance: Shows Aruba's software stack includes both EU-developed/open-source components and non-EU proprietary software (VMware by Broadcom/US), indicating not all software is EU-origin.
• ArubaKube R&D Centre other 1. October 2026
  Official site of ArubaKube, Aruba's Cloud Native competence centre in Turin, Italy, focused on Kubernetes and open-source cloud-native R&D, main contributor to the Liqo project.
  Relevance: Demonstrates that core cloud-native software development for Aruba's platform is conducted by EU-based teams in Turin, spun off from an Italian university partnership.

Selected answer: 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) Value 143 SEAL 4

Notes: 100% Italian-owned; R&D in Turin; ISO 27001 change mgmt, segregation of duties, vulnerability checks enforced as pipeline gates.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Demonstrates EU-based compliance/security gates — segregation of duties, vulnerability checks, change approvals — governing software packaging and deployment under EU jurisdiction.
• Aruba launches centre of excellence for cloud native development — Data Centre Review other 1. October 2026
  Article confirming ArubaKube, Aruba's R&D center of excellence in Turin, Italy, in collaboration with the Polytechnic University of Turin, focused on open-source cloud-native technologies.
  Relevance: Confirms software development and R&D executed by EU-based teams in Italy under EU jurisdiction, supporting EU control and execution of the software supply chain.
• ArubaCloud — Official GitHub Organization other 1. October 2026
  Aruba's official open-source GitHub organization hosting 24 repositories including Terraform provider, CLI tools, Go SDK, Helm charts, Kubernetes operators, and GitHub Actions self-hosted runners.
  Relevance: Shows software packaging, distribution, and update pipeline actively managed by Aruba under EU control with CI/CD integration and security-focused development practices.

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: Few non-EU vendors in critical services (VMware, Cisco, Dell, Intel, NVIDIA); partially documented via case studies but full supplier list not publicly disclosed.

Evidence

• Aruba Cloud Terms and Conditions other 1. October 2026
  Official T&C document (Article 16) stating software and trademarks are exclusive property of Aruba S.p.A., with registered office in Ponte San Pietro, Italy, governed by Italian law.
  Relevance: Documents specific non-EU vendor (Virtuozzo) involvement in critical PaaS services and acknowledges data transfer outside the EU, directly relevant to single point of dependency assessment.
• Aruba Cloud vs Open Telekom Cloud – EuropeanStack other 1. October 2026
  Comparison profiling Aruba's full technology stack: OpenStack public cloud, VMware (US) private cloud, Kubernetes, GPU servers; notes subprocessor list available only on request.
  Relevance: Identifies VMware (US-based) as a non-EU dependency in Aruba's critical private cloud stack and highlights that full supplier transparency is not publicly available.
• Aruba, Hyperscaler Transitions and the Italian Data Centre Potential — Capacity Magazine other 1. October 2026
  Interview with Aruba's Head of Data Centre Services covering Bergamo campus (200,000 sqm, 45MW) and Rome IT4 (30MW), sustainability via renewables, and European expansion strategy.
  Relevance: Aruba leadership acknowledges GPU and hardware supply chain dependencies and describes carrier-neutral approach to reduce single-vendor reliance, relevant to non-EU dependency assessment.

Selected answer: Critical suppliers and subcontractors can be audited Value 71 SEAL 2

Notes: Aruba manages critical suppliers/subcontractors via ISO 27001 processes and GDPR Art. 28, but no evidence of full sub-supplier chain audit rights.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Directly addresses supplier management and subcontractor oversight under ISO 27001, including verification that subcontractors meet same security requirements. No evidence of sub-supplier (Tier 2+) audit rights.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Shows customer audit rights are limited to Aruba itself, not extending to full supply chain. Sub-processors managed via contract but no evidence of sub-supplier chain visibility or audit rights.
• Aruba S.p.A. — Code of Ethics (v.1.0, 2025) other 1. October 2026
  Aruba's Code of Ethics applies to suppliers and subcontractors, requiring compliance with regulations, anti-bribery (ISO 37001), transparent third-party dealings, and data protection obligations.
  Relevance: Confirms suppliers and subcontractors must comply with ethical and regulatory standards, but does not establish audit rights or visibility into sub-supplier chain beyond direct contractors.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: OpenStack-based stack with OAuth2, OpenAPI specs, SECA co-creation, Terraform provider & Go SDK. SECA still rolling out; some APIs remain Aruba-specific.

Evidence

• ArubaCloud — Official GitHub Organization other 1. October 2026
  Aruba's official open-source GitHub organization hosting 24 repositories including Terraform provider, CLI tools, Go SDK, Helm charts, Kubernetes operators, and GitHub Actions self-hosted runners.
  Relevance: Demonstrates broad commitment to open, documented interfaces — SDK, CLI, IaC provider, and K8s operator all publicly available, enabling third-party integration without proprietary barriers.
• ArubaCloud Terraform Provider (Terraform Registry) other 2. October 2026
  Official Terraform provider documentation covering compute, storage, network, containers, databases, security (KMS) with OAuth2 authentication and full provisioning examples.
  Relevance: Shows critical cloud functions accessible via well-documented, standards-aligned interfaces (OAuth2, Terraform/OpenTofu ecosystem) with versioned releases, though resource names are Aruba-specific.
• European cloud providers unite over data sovereignty-focused API (Computer Weekly) other 1. October 2026
  Article on Aruba, IONOS, and Dynamo co-creating SECA open-source API for EU cloud interoperability. CISPE restructured to exclude non-European providers from governance.
  Relevance: Shows Aruba actively co-creating an open, OpenAPI-based standard for cloud infrastructure management interoperability across European providers, directly addressing open interfaces and anti-lock-in.

Selected answer: 4. Policy for most core services - A formal policy mandates and documents open standards for most core services, with managed exceptions Value 150 SEAL 3

Notes: Aruba documents open standards (OpenStack, Kubernetes, SECA API) for most core services with VMware as a managed exception, reinforced by Gaia-X membership.

Evidence

• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Directly documents Aruba's formal commitment to open standards for core cloud services, addressing vendor lock-in risk and portability as policy objectives.
• Open Source Private Cloud Vates | Aruba Cloud other 2. October 2026
  Aruba's open-source private cloud offering powered by Vates VMS (XCP-ng + Xen Orchestra), emphasizing zero vendor lock-in and European data sovereignty.
  Relevance: Demonstrates open standards adoption across private cloud services, complementing OpenStack and Kubernetes in the public cloud, with explicit no-lock-in positioning.
• SECA – Sovereign European Cloud API other 28. August 2026
  IONOS co-founded open, royalty-free API standard for cross-provider cloud infrastructure management based on OpenAPI, with public GitHub RFC process.
  Relevance: Shows Aruba actively develops and governs an open cloud standard (SECA) for interoperability, reinforcing a formal policy approach to open standards beyond adoption.

Selected answer: 4. The software is open source with significant EU contributions but governance is restricted and handover is possible Value 150 SEAL 4

Notes: Aruba uses open-source tech (OpenStack, Vates VMS, Kubernetes) with full audit/modify rights. ArubaKube contributes to Liqo, but governance is centralised under Aruba subsidiaries. Handover is feasible.

Evidence

• ArubaCloud — Official GitHub Organization other 1. October 2026
  Aruba's official open-source GitHub organization hosting 24 repositories including Terraform provider, CLI tools, Go SDK, Helm charts, Kubernetes operators, and GitHub Actions self-hosted runners.
  Relevance: Shows Aruba actively publishes open-source software under permissive licenses, but repos are centrally governed by ArubaCloud with no independent foundation overseeing stewardship.
• Big Changes are Happening to Liqo: Welcome to ArubaKube! other 2. October 2026
  Blog post detailing Liqo's transition from university research to ArubaKube, an Aruba-backed spin-off, remaining open source with plans to strengthen community governance.
  Relevance: Illustrates significant EU open-source contributions via ArubaKube, but governance is centralised under a single-company entity. The university-to-ArubaKube transition shows handover is possible.
• Open Source Private Cloud Vates | Aruba Cloud other 2. October 2026
  Aruba's open-source private cloud offering powered by Vates VMS (XCP-ng + Xen Orchestra), emphasizing zero vendor lock-in and European data sovereignty.
  Relevance: Demonstrates Aruba uses genuinely open-source virtualization tech developed in EU, with full rights to audit and modify, but governance is under Vates/Aruba, not an independent foundation.

Selected answer: Some public insight exists (all) Value 100 SEAL 3

Notes: Public KB governance docs, technical diagrams, open-source repos cover architecture, data flows, dependencies—but not a large corpus; some details on request only.

Evidence

• Aruba Cloud Data Center Networks – Knowledge Base other 2. October 2026
  KB article under Governance > Architecture & Technology describing Aruba Cloud's data center network infrastructure, topology, and design.
  Relevance: Directly provides public architectural documentation on service design and infrastructure, covering network topology and dependencies—core to service architecture transparency.
• ArubaCloud — Official GitHub Organization other 1. October 2026
  Aruba's official open-source GitHub organization hosting 24 repositories including Terraform provider, CLI tools, Go SDK, Helm charts, Kubernetes operators, and GitHub Actions self-hosted runners.
  Relevance: Publicly exposes API schemas, automation tooling, and service interfaces—enabling transparency into service architecture and dependencies through open-source code.
• Data Protection in Our Services – Aruba Cloud other 2. October 2026
  Details data protection measures, ISO 27001/CISPE compliance, shared responsibility model, and technical diagrams for Public Cloud, VPC, Backup, Object Storage.
  Relevance: Provides public technical diagrams and architectural documentation for multiple service types, plus data flow and dependency visibility through shared responsibility model.

Selected answer: EU-hosted, foreign stack Value 50 SEAL 3

Notes: Aruba hosts HPC in Italian data centers but relies entirely on Intel/AMD processors and NVIDIA GPUs — no EU processor IP or fabrication.

Evidence

• Dedicated Servers Range | Aruba Cloud other 2. October 2026
  Aruba Cloud's dedicated server catalog listing AMD Ryzen, Intel Xeon, and NVIDIA GPU configurations hosted in Italian data centers, suitable for HPC and AI/ML.
  Relevance: Confirms the specific processors (Intel, AMD) and accelerators (NVIDIA) used in Aruba's HPC stack — all non-EU designed and fabricated.
• Europe built sovereign clouds to escape US control. Then forgot about the processors — The Register other 5. September 2026
  Investigative analysis revealing that EU sovereign cloud frameworks certify operations but not the silicon layer. Intel ME and AMD PSP run below OS at Ring -3; US RISAA 2024 can compel hardware makers. Asks: can sovereignty exist on non-sovereign silicon?
  Relevance: Contextualizes that EU cloud providers like Aruba, despite sovereignty claims, remain dependent on US-designed processors with no EU alternative at competitive performance.
• Use Case: Dedicated Servers for High Performance Computing | Aruba Cloud other 2. October 2026
  Aruba Cloud's official HPC use case page detailing dedicated bare-metal servers for compute-intensive HPC workloads hosted in owned Italian data centers.
  Relevance: Directly shows Aruba's HPC offering is EU-hosted but does not mention any EU-designed processors or accelerators, only generic high-performance hardware.

Selected answer: ELA3 Value 107 SEAL 3

Notes: Comprehensive EU/int'l certifications (ISO 27001/27017/27018/27701, CSA STAR, CISPE) but lacks Common Criteria EAL4+ or SecNumCloud-level certification.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Confirms ISO 27001-certified ISMS, CISPE compliance, and shared responsibility model — matches existing evidence ID 733 on data protection and security practices.
• Aruba Data Centers – Certifications other 2. October 2026
  Lists certifications across all Aruba data centers: ISO 27001, 9001, 14001, 50001, 22301, 20000-1, 27017, 27018, 27035, 22237, and ANSI/TIA-942 Rating 4 for Arezzo, Bergamo, and Rome.
  Relevance: Provides granular certification details per data center location, confirming breadth of internationally recognized certifications across security, quality, continuity, and cloud data protection.
• Aruba Group Certifications other 2. October 2026
  Official Aruba Group certifications page listing ISO 27001, 27017, 27018, 27035, 27701, 9001, 22301, 37001, CSA STAR, CISPE Code of Conduct, and ANSI/TIA-942 Rating 4.
  Relevance: Comprehensive list of Aruba's security certifications spanning ISO standards, cloud-specific (CSA STAR), and EU-specific (CISPE) — directly supports security certification attainment assessment.

Selected answer: 4. Partial compliance to most of the well-known EU Regulations (requirements implemented and operational with minor exceptions) Value 107 SEAL 4

Notes: GDPR independently verified via CISPE & ISO; NIS2 and DORA claimed but lack同等 independent audit depth.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Demonstrates independently audited GDPR compliance and ISMS controls, but focuses on ISO/GDPR rather than NIS2 or DORA specifically.
• CISPE — First Code of Conduct for Data Protection Goes Live other 2. October 2026
  CISPE announcement confirming Aruba among first providers declaring compliance with the EDPB-validated GDPR Code of Conduct, independently monitored by Bureau Veritas and others.
  Relevance: Provides strong independent verification of GDPR compliance via EDPB-validated code with third-party monitoring, but does not cover NIS2 or DORA.
• Cloud Cybersecurity: Integrated Protection and Compliance | Aruba Cloud other 2. October 2026
  Aruba's cybersecurity solutions page explicitly referencing compliance with NIS2 and DORA regulations, alongside SOC services, MDR, and vulnerability assessment offerings.
  Relevance: Directly mentions NIS2 and DORA compliance, but presents these as marketing claims without independent audit evidence for those specific frameworks.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: Aruba's SOC and incident management are EU-based (ISO 27035 certified, all sites in Italy), using European tech (Bitdefender). No evidence of ENISA ISAC participation, so option 5 not met.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Confirms incident management lifecycle follows ISO 27035 and is managed within Aruba's Italian data centers, supporting EU-exclusive incident handling.
• Certificate IT336297 – Aruba S.p.A. ISO 27035 (Bureau Veritas) other 2. October 2026
  ISO/IEC 27035 certification for Aruba S.p.A. issued by Bureau Veritas Italia, covering incident management for data centers IT1-IT4, all located in Italy.
  Relevance: All certified incident management sites are in Italy, confirming the entire incident lifecycle is handled by EU-based teams exclusively.
• Cloud Cybersecurity: Integrated Protection and Compliance | Aruba Cloud other 2. October 2026
  Aruba's cybersecurity solutions page explicitly referencing compliance with NIS2 and DORA regulations, alongside SOC services, MDR, and vulnerability assessment offerings.
  Relevance: Describes Aruba's SOC operations, incident detection/response, and use of European security technologies, supporting EU-exclusive security operations.

Selected answer: 4. Customers have full direct access to their security monitoring and logs which are stored in the EU Value 107 SEAL 3

Notes: Customers get direct access to application logs and monitoring via management panels; all data stored in EU (Italy). No evidence of immutable tamper-proof logs.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Confirms customers have direct access to application logs (VM ops, firewall changes, etc.) via management panels, with 24/7 monitoring and alerting, all in EU data centers.
• Cloud for Public Sector | Aruba Cloud other 1. October 2026
  Aruba Cloud's public sector page explicitly states it is 'built on open-source technologies and open standards to avoid lock-in and ensure portability and long-term independence,' with ACN qualification and NIS2 compliance.
  Relevance: Details continuous monitoring, logging, and auditing tools available to customers, plus SOC monitoring for hosted private cloud, all in EU data centers.
• European Sovereign Cloud: Compliance, Security & Data in Italy other 1. October 2026
  Aruba Cloud's sovereignty page confirming it is 100% Italian-owned, subject exclusively to European laws (GDPR), and not subject to non-EU laws like the U.S. CLOUD Act.
  Relevance: Confirms all logs and monitoring data are stored exclusively within the EU (Italy), with no exposure to non-EU laws or jurisdictions.

Selected answer: 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time Value 71 SEAL 2

Notes: ISO 27035-certified incident management with GDPR/NIS2-aligned timelines; CSIRT Italia cooperation via Italian framework. No evidence of real-time CSIRT data sharing or proactive disclosure.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Describes structured incident reporting procedures, vulnerability management, and GDPR-compliant breach notification timelines central to this assessment.
• Cloud Cybersecurity: Integrated Protection and Compliance | Aruba Cloud other 2. October 2026
  Aruba's cybersecurity solutions page explicitly referencing compliance with NIS2 and DORA regulations, alongside SOC services, MDR, and vulnerability assessment offerings.
  Relevance: Confirms NIS2 compliance, vulnerability assessment practices, and threat intelligence capabilities relevant to breach disclosure and incident reporting obligations.
• ISO 27035 Certificate (Bureau Veritas) other 2. October 2026
  Bureau Veritas certification of Aruba SPA for ISO/IEC 27035 incident management covering IT1–IT4 data centers, valid until Oct 2027.
  Relevance: Directly proves audit-backed incident management processes including breach detection, response, and notification procedures aligned to international standards.

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: Aruba manages infra patches (VMware/OpenStack) with customer notice; VMware patches depend on US vendor schedules. OpenStack offers more autonomy. Zero-day may bypass testing.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Details Aruba's centralized patch management process and shared responsibility model, showing patches are managed by Aruba with customer control over VMs, supporting moderate autonomy assessment.
• Aruba Cloud Sovereign Cloud other 1. October 2026
  Aruba's official sovereign cloud page, highlighting EU jurisdiction, data protection, and regulatory compliance under EU law.
  Relevance: Contextualizes Aruba's EU sovereignty positioning and proprietary infrastructure, which supports OpenStack-based autonomy but still relies on VMware for private cloud services.
• VMware Hosted Private Cloud: Managed VCF & EU Sovereignty other 2. October 2026
  Aruba's VMware VCF private cloud page: Aruba manages hardware, VMware security updates/patches, and platform; customers control VMs via vCloud Director. ACN QC3 qualified.
  Relevance: Confirms VMware security patches are managed by Aruba but depend on VMware (Broadcom, US vendor) release schedules, limiting full independence from non-EU vendors.

Selected answer: 4. High control by independent entities to request data from the vendor Value 107 SEAL 1

Notes: Aruba grants contractual audit rights (T&C Art. 21.3), CISPE independent monitoring, ISO 27001 external audits, and ACN qualifications — but with notice, frequency, and NDA conditions.

Evidence

• Aruba Cloud Security — Your Information Securely other 1. October 2026
  Aruba Cloud's ISO 27001-certified security page detailing logging, monitoring, and auditing. Infrastructure privileged access logs are vendor-collected; application logs are made available to customers.
  Relevance: Describes Aruba's audit framework including internal audits, periodic event analysis, and independent verification by the Security Department — directly relevant to auditability assessment.
• Aruba Cloud Terms and Conditions other 30. September 2026
  Official legal terms identifying Aruba S.p.A. (Ponte San Pietro, Italy) as the contracting entity with €4M share capital, governed by Italian law with exclusive jurisdiction of the Court of Bergamo for non-consumer disputes.
  Relevance: Contractual audit provisions define the scope and limits of independent entity access — key to assessing auditability level. Restrictions prevent full unrestricted audit access.
• CISPE — First Code of Conduct for Data Protection Goes Live other 2. October 2026
  CISPE announcement confirming Aruba among first providers declaring compliance with the EDPB-validated GDPR Code of Conduct, independently monitored by Bureau Veritas and others.
  Relevance: Demonstrates independent third-party verification of Aruba's compliance via accredited monitoring bodies, supporting high but not unlimited audit access by independent entities.

Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4

Notes: Aruba has energy-efficient infrastructure (geothermal cooling, 100% renewables, ISO 50001) and Climate Neutral Data Centre Pact roadmap, but no published verified PUE below 1.5.

Evidence

• EU Assessment of Energy Performance and Sustainability of Data Centres other 2. October 2026
  European Commission technical report benchmarking PUE across EU data centres. Lists Aruba as stakeholder; Italy average PUE ~1.46; CNDCP targets PUE ≤1.3–1.4.
  Relevance: Provides EU-level PUE benchmarks for Italy and confirms Aruba as a contributing operator, contextualizing energy efficiency without a verified sub-1.3 PUE.
• Sustainability First at Aruba's Global Cloud Data Centre IT3 other 2. October 2026
  Data Centre Review article detailing Aruba IT3's energy-efficient design: geothermal cooling, free cooling, 100% renewable energy, ISO 50001, and CISPE Climate Neutral commitments.
  Relevance: Directly describes Aruba's energy-efficient infrastructure and sustainability roadmap including Climate Neutral Data Centre Pact membership and measurable targets.
• Sustainable Cooling for Global Cloud Data Center in Italy (Alfa Laval Case Study) other 2. October 2026
  Alfa Laval case study on Aruba IT3's geothermal cooling system using groundwater heat exchangers, 2N redundancy, and 100% renewable energy.
  Relevance: Details specific energy-efficient cooling technologies at Aruba's data center, supporting the infrastructure side of the energy efficiency assessment.

Selected answer: Circular economy EU-aligned Value 187 SEAL 4

Notes: Aruba is a CNDCP signatory with circular economy targets for 100% server reuse/repair/recycling and holds ISO 14001, but no specific documented program found.

Evidence

• Aruba Data Centers – Certifications other 2. October 2026
  Lists certifications across all Aruba data centers: ISO 27001, 9001, 14001, 50001, 22301, 20000-1, 27017, 27018, 27035, 22237, and ANSI/TIA-942 Rating 4 for Arezzo, Bergamo, and Rome.
  Relevance: ISO 14001 certification covers environmental management including waste and end-of-life equipment handling, providing a framework for hardware lifecycle management at Aruba's data centers.
• Climate Neutral Data Centre Pact other 27. September 2026
  EU-aligned initiative with 100+ signatories committing to server reuse/repair, circular economy targets by 2025, and climate neutrality by 2030.
  Relevance: Confirms Aruba's direct commitment to EU-aligned circular economy practices for hardware, including repair, reuse, and recycling of server equipment.
• EUDCA – Climate Neutral Data Centre Pact other 2. October 2026
  European Data Centre Association page outlining CNDCP's five pledge areas including Circular Economy: 100% of used server equipment assessed for reuse, repair, or recycling with repair/reuse targets by 2025.
  Relevance: Aruba is a CNDCP signatory; this page details the EU-aligned circular economy commitments Aruba has pledged to, including server hardware reuse and recycling targets.

Selected answer: EU-audited reporting Value 250 SEAL 4

Notes: Aruba has ISO 14001/50001 certified environmental & energy management systems audited by Bureau Veritas, plus CNDCP compliance with third-party audits and transition to mandatory EU EED reporting.

Evidence

• Aruba Data Centers – Certifications other 2. October 2026
  Lists certifications across all Aruba data centers: ISO 27001, 9001, 14001, 50001, 22301, 20000-1, 27017, 27018, 27035, 22237, and ANSI/TIA-942 Rating 4 for Arezzo, Bergamo, and Rome.
  Relevance: Confirms Aruba's environmental reporting is governed by ISO 14001/50001 certified systems requiring regular third-party audits by accredited bodies, enabling EU-audited environmental impact disclosure.
• Aruba on Track to Meet the CNDCP 2030 Targets other 2. October 2026
  DCNN Magazine article confirming Aruba completed CNDCP certification, is on track for 2030 PUE and clean energy targets, with Bureau Veritas conducting third-party audits.
  Relevance: Third-party verification by Bureau Veritas of Aruba's CNDCP compliance demonstrates EU-audited environmental reporting covering energy efficiency, water, and circular economy metrics.
• Green Digital Infrastructure for Europe | Enterprise Aruba other 2. October 2026
  Aruba's official sustainability page detailing 100% renewable energy, 11 hydroelectric plants, 50 GWh self-generation, GO certificates, CNDCP commitment, and support for customer ESG/CSRD reporting.
  Relevance: Shows Aruba's sustainability commitments and transparent disclosure of energy sources and environmental practices within an EU framework, supporting EU-audited reporting assessment.

Selected answer: Only green EU energy supplies Value 250 SEAL 4

Notes: Aruba powers all data centers with 100% renewable EU energy from owned hydroelectric plants and GO-certified purchases. All infrastructure is in Italy/EU.

Evidence

• Aruba S.p.A on Growth and Sustainable Data Centre Management other 1. October 2026
  Interview covering Aruba's sustainability commitments: Climate Neutral Data Centre Pact certification, European Green Digital Coalition membership, hydroelectric and photovoltaic investments, 100% renewable Rome campus.
  Relevance: Confirms Aruba's renewable energy strategy, CNDCP certification, and that all energy sourcing is from EU-based renewable generation in Italy.
• Green Digital Infrastructure for Europe | Enterprise Aruba other 2. October 2026
  Aruba's official sustainability page detailing 100% renewable energy, 11 hydroelectric plants, 50 GWh self-generation, GO certificates, CNDCP commitment, and support for customer ESG/CSRD reporting.
  Relevance: Directly confirms Aruba uses exclusively renewable EU energy with GO certificates and owns hydroelectric generation assets in Italy, answering the energy sourcing question.
• Sustainable Cooling for Global Cloud Data Center in Italy (Alfa Laval Case Study) other 2. October 2026
  Alfa Laval case study on Aruba IT3's geothermal cooling system using groundwater heat exchangers, 2N redundancy, and 100% renewable energy.
  Relevance: Independent verification that Aruba's data centers use 100% renewable energy certified via EU Guarantee of Origin, from EU-based generation assets.