ELASTX – The Swedish Cloud Provider

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: Elastx is a Swedish legal entity, HQ Stockholm, owned by Sobro (Swedish). No non-EU ownership or jurisdictional exposure found. Decision-making fully within EU/EEA.

Evidence

• Elastx – PitchBook Company Profile other 4. September 2026
  PitchBook lists Elastx as privately held, PE-backed, founded 2012, HQ Stockholm. Investor: Sobro. No non-EU investors identified.
  Relevance: Independent data provider confirms Elastx is privately held in Sweden with only Swedish investor (Sobro), supporting full EU entity control.
• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms Elastx's majority owner (Sobro) is a Swedish entity, meaning ultimate decision-making authority resides within EU/EEA jurisdiction.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Independent analysis confirms Elastx has no non-EU jurisdictional exposure, supporting assessment that legal entity control is entirely within EU/EEA.

Selected answer: 4. Unlikely takeover by or transfer to a non-EU sovereign entity Value 93 SEAL 4

Notes: Elastx is privately held by Sobro, a Swedish firm using own capital with flexible horizons. No non-EU investors. Small size raises some theoretical risk of acquisition.

Evidence

• Elastx – PitchBook Company Profile other 4. September 2026
  PitchBook lists Elastx as privately held, PE-backed, founded 2012, HQ Stockholm. Investor: Sobro. No non-EU investors identified.
  Relevance: Independent financial database confirms private Swedish ownership with no non-EU investors, supporting low change-of-control risk to non-sovereign entities.
• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms Elastx is majority-owned by Sobro, a Swedish firm investing own capital with flexible hold periods, reducing likelihood of non-EU transfer.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Independent assessment classifies Elastx as fully sovereign EU provider with no non-EU jurisdiction exposure, indicating low risk of transfer to non-EU owners.

Selected answer: 4. Full influence of EU actors Value 125 SEAL 4

Notes: Elastx is fully EU-owned and managed by Swedish founders/investors; EU actors have full roadmap control with no non-EU stakeholders.

Evidence

• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms full EU/Swedish ownership of Elastx. All decision-makers are EU actors, meaning EU stakeholders have complete influence over the provider's roadmap and strategic direction.
• Elastx – The Swedish Cloud (Company History) other 4. September 2026
  Elastx company history page showing founding by Swedish founders Henrik Grankvist and Joakim Öhman in 2012, financed privately, with ~30 employees and Swedish data sovereignty focus.
  Relevance: Demonstrates the company was founded and is run by EU citizens with no external non-EU capital or governance influence, confirming full EU actor control over technology evolution.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Confirms Elastx is entirely within EU jurisdiction with no non-EU ownership or regulatory influence, supporting full EU actor control over roadmap decisions.

Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4

Notes: Elastx is 53% owned by Sobro (Swedish PE firm), rest held by Swedish founders. No non-EU investors identified. All capital from Swedish/EU sources.

Evidence

• Elastx – PitchBook Company Profile other 4. September 2026
  PitchBook lists Elastx as privately held, PE-backed, founded 2012, HQ Stockholm. Investor: Sobro. No non-EU investors identified.
  Relevance: Independently confirms ownership is PE-backed with no non-EU investors in the profile data.
• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms majority owner is Swedish. Sobro invests own capital, not externally raised — no indication of non-EU LPs.
• Elastx – The Swedish Cloud (Company History) other 4. September 2026
  Elastx company history page showing founding by Swedish founders Henrik Grankvist and Joakim Öhman in 2012, financed privately, with ~30 employees and Swedish data sovereignty focus.
  Relevance: Establishes that Elastx was founded and privately financed by Swedish founders with no external non-EU capital.

Selected answer: 5. Fully in the EU Value 125 SEAL 4

Notes: 100% EU operations: Sweden HQ, ~30 EU jobs, SEK 53M EU revenue, EU-only data centres, EU ownership via Sobro. Small scale but fully EU-based.

Evidence

• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms EU ownership, revenue, and jobs all within Sweden/EU. No non-EU investors identified. Directly assesses EU economic contribution.
• Elastx – The Swedish Cloud (Company History) other 4. September 2026
  Elastx company history page showing founding by Swedish founders Henrik Grankvist and Joakim Öhman in 2012, financed privately, with ~30 employees and Swedish data sovereignty focus.
  Relevance: Shows all jobs, investment, and value creation anchored in Sweden/EU since founding. Confirms no non-EU economic footprint.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Independently confirms Elastx is fully EU-anchored with no non-EU operations, supporting 100% EU economic contribution assessment.

Selected answer: 1. No clear participation Value 0 SEAL 4

Notes: No evidence found of Elastx participating in IPCEI-CIS, Horizon Europe, or Gaia-X. Company focuses on Swedish data sovereignty, not EU strategic programs.

Evidence

• Elastx & Varnish Software Strategic Partnership other 4. September 2026
  Elastx press release about commercial partnership with Varnish Software for CDN, focused on Swedish data sovereignty and NIS2 compliance.
  Relevance: Illustrates Elastx's strategic activities are commercial partnerships, not EU-funded programs like IPCEI, Horizon Europe, or Gaia-X.
• European Commission — Approved IPCEI on Next Generation Cloud Infrastructure and Services other 29. August 2026
  Official EC page listing 19 companies from 7 member states participating in IPCEI-CIS, a €1.2B+ cloud-edge initiative approved Dec 2023.
  Relevance: Confirms Elastx is not a participant in IPCEI-CIS, the flagship EU cloud infrastructure strategic program.
• Gaia-X Summit 2025 Announcement – Compliant Service Providers other 4. September 2026
  Gaia-X press release listing companies with compliance labels. Elastx is not mentioned among Gaia-X members or compliant providers.
  Relevance: Shows Elastx is not a Gaia-X participant or compliant provider, indicating no involvement in this EU strategic initiative.

Selected answer: Already measured achievement and existing dedicated governance Value 83 SEAL 4

Notes: Elastx has measurable achievements (ISO 14001, renewable energy, OpenStack OSS) and governance structures aligning with EU green and digital sovereignty goals, though not in Gaia-X.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Demonstrates measurable achievements in green strategy (ISO 14001, renewable energy) and digital sovereignty (OpenStack OSS, no lock-in) consistent with EU Digital Decade goals.
• European Commission — Cloud Computing Policy other 4. September 2026
  Official EU policy page outlining digital strategy targets: 75% cloud adoption by 2030, climate-neutral data centres, CADA, and open source investments.
  Relevance: Provides the EU-level benchmark for measuring Elastx alignment: green data centres, open source adoption, and data sovereignty objectives.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Positions Elastx within the EU sovereign cloud ecosystem, confirming alignment with EU industrial sovereignty objectives and European cloud independence goals.

Selected answer: 5. Full autonomy and continuity Value 125 SEAL 4

Notes: Elastx platform built entirely on open-source OpenStack with no proprietary layers; can fork/internally maintain code or source alternative suppliers if vendors withdraw support.

Evidence

• Digital Sovereignty in the Cloud: Seizing Opportunities, Avoiding Risks other 4. September 2026
  Comprehensive guide on digital sovereignty covering vendor lock-in risks, portability, and strategies for using open standards to maintain operational independence.
  Relevance: Contextualises how open-source architectures like Elastx's enable sourcing alternative suppliers and internalising functions when vendor support is disrupted.
• Elastx AB – OpenInfra Foundation Member Profile other 4. September 2026
  OpenInfra Foundation membership profile showing Elastx as a Public Cloud Provider and active contributor to the OpenStack project.
  Relevance: Membership proves Elastx has in-house expertise to maintain and fork OpenStack code independently, reducing dependence on any single upstream vendor.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Directly demonstrates Elastx's reliance on open-source code and open standards, enabling internalisation of key functions if suppliers withdraw.

Selected answer: 3. Exclusively EU law Value 167 SEAL 4

Notes: Elastx is a Swedish company, HQ Stockholm, Swedish owners (Sobro 53%), all datacenters in Sweden, operating exclusively under Swedish/EU law with no non-EU jurisdictional exposure.

Evidence

• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms Elastx is majority-owned by a Swedish (EU) firm with all infrastructure in Sweden, meaning operations and contracts fall under Swedish/EU jurisdiction exclusively.
• Elastx – The Swedish Cloud (Company History) other 4. September 2026
  Elastx company history page showing founding by Swedish founders Henrik Grankvist and Joakim Öhman in 2012, financed privately, with ~30 employees and Swedish data sovereignty focus.
  Relevance: Confirms Elastx was founded by Swedish citizens, operates from Sweden, and explicitly targets Swedish data sovereignty — no non-EU legal ties identified.
• SovereignSky – Elastx Datacenters & Jurisdiction other 4. September 2026
  Maps Elastx datacenters to legal jurisdiction: HQ Sweden, all 3 regions in Sweden, applicable laws include GDPR, ePrivacy, NIS2, Data Act, AI Act — all EU/Swedish.
  Relevance: Explicitly identifies Elastx's legal jurisdiction as Sweden/EU with no non-EU applicable laws, directly answering the primary legal jurisdiction question.

Selected answer: Verified legal immunity, non-EU laws unenforceable Value 167 SEAL 4

Notes: EU-only ownership and Swedish jurisdiction structurally shield Elastx from non-EU extraterritorial laws (CLOUD Act). No US parent or non-EU corporate control.

Evidence

• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms Elastx's majority ownership is Swedish — Sobro (53%) is a Swedish investment firm. No non-EU corporate parent in ownership chain.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Directly states Elastx is EU-headquartered and EU-operated, not exposed to US CLOUD Act because jurisdiction follows corporate control — Elastx has no US parent.
• White Paper: US CLOUD Act vs European/UK Data Sovereignty – CMS Law other 20. August 2026
  Legal white paper by international law firm CMS analyzing CLOUD Act jurisdiction, blocking statutes, and practical enforcement against EU providers.
  Relevance: Confirms jurisdiction follows corporate control, not data location — EU-owned providers like Elastx lack US parent entities and are inherently shielded from CLOUD Act warrants.

Selected answer: 2. Non-EU authorities can compel access to data or systems without customers being notified, in specific cases Value 41 SEAL 1

Notes: Eligible via MLAT through Swedish courts. No US CLOUD Act exposure. Some cases may allow no notification under Swedish secrecy rules.

Evidence

• Digital Sovereignty and Control — Elastx other 4. September 2026
  Elastx article by CEO on digital sovereignty. States Elastx avoids US CLOUD Act and FISA 702 exposure as a fully Swedish-owned provider.
  Relevance: Confirms Elastx is beyond direct US compulsion but the MLAT pathway via Swedish courts remains, and Elastx doesn't commit to always notifying or rejecting requests.
• Mitigating the Risk of US Surveillance for Public Sector Services in the Cloud other 4. September 2026
  Academic article (Internet Policy Review) analyzing how MLATs and Swedish secrecy law interact with foreign data access requests.
  Relevance: Explains the MLAT framework as the remaining pathway for non-EU authorities to access data from Swedish providers, and how Swedish law permits specific non-notification cases.
• SovereignSky – Elastx Datacenters & Jurisdiction other 4. September 2026
  Maps Elastx datacenters to legal jurisdiction: HQ Sweden, all 3 regions in Sweden, applicable laws include GDPR, ePrivacy, NIS2, Data Act, AI Act — all EU/Swedish.
  Relevance: Confirms Elastx operates entirely under Swedish/EU jurisdiction. The only non-EU pathway is MLAT via Swedish courts.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: Elastx is fully Swedish-owned, all data in Sweden, open-source stack, no US jurisdictional nexus—ITAR/EAR do not apply to its offer.

Evidence

• Digital Sovereignty and Control — Elastx other 4. September 2026
  Elastx article by CEO on digital sovereignty. States Elastx avoids US CLOUD Act and FISA 702 exposure as a fully Swedish-owned provider.
  Relevance: Directly addresses Elastx's freedom from US extraterritorial legal regimes, supporting absence of ITAR/EAR jurisdictional exposure.
• SovereignSky – Elastx Datacenters & Jurisdiction other 4. September 2026
  Maps Elastx datacenters to legal jurisdiction: HQ Sweden, all 3 regions in Sweden, applicable laws include GDPR, ePrivacy, NIS2, Data Act, AI Act — all EU/Swedish.
  Relevance: Confirms all operations under EU/Swedish law with no foreign jurisdictional nexus, meaning US export controls like ITAR/EAR do not apply.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Confirms Elastx is fully EU-owned and operated with no US jurisdictional exposure, supporting freedom from US export control regimes.

Selected answer: 5. Fully within the EU Value 167 SEAL 4

Notes: Elastx is a Swedish company founded and developed in Sweden; its IP—brand, platform, services—is created and registered entirely within the EU. Owned by Swedish firm Sobro.

Evidence

• Elastx – PitchBook Company Profile other 4. September 2026
  PitchBook lists Elastx as privately held, PE-backed, founded 2012, HQ Stockholm. Investor: Sobro. No non-EU investors identified.
  Relevance: Verifies Swedish origin and EU-based ownership; open-source approach means no proprietary IP registered outside EU.
• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro, a Swedish investment firm, lists Elastx as a portfolio company with 53% ownership. 27 employees, 53M SEK revenue (2024). All data stays in Sweden.
  Relevance: Confirms ownership is fully EU-based (Sobro is Swedish), supporting that IP registration and control reside within the EU.
• Elastx – The Swedish Cloud Provider other 4. September 2026
  Elastx official site: Swedish cloud provider founded 2012 in Stockholm, all operations and development within Sweden under EU jurisdiction.
  Relevance: Confirms Elastx is a Swedish company creating and developing its platform entirely within Sweden/EU, with no non-EU IP creation.

Selected answer: fully under EU law Value 167 SEAL 4

Notes: Elastx AB is Swedish-registered, fully Swedish/EU-owned (Sobro 53%), all IP rights held and enforced under Swedish/EU law. No foreign ownership or non-EU IP exposure identified.

Evidence

• Allabolag — Elastx AB Official Company Information other 4. September 2026
  Swedish companies registry: Elastx AB (556906-5617), Aktiebolag, 21 owners, CEO Joakim Öhman, active in Stockholm, Sweden.
  Relevance: Confirms Elastx AB is a Swedish limited company with all ownership registered in Sweden, supporting that IP holder jurisdiction is fully within EU/Swedish law.
• Elastx — Terms of Service (Swedish Law Governing IP & Jurisdiction) other 4. September 2026
  Elastx AB (org.nr. 556906-5617) Terms of Service: IP rights governed under Swedish substantive law, arbitration via Stockholm Chamber of Commerce.
  Relevance: Directly establishes that IP-related legal provisions are governed entirely by Swedish/EU law, with Swedish arbitration for enforcement — no non-EU jurisdictional elements.
• Elastx Trust Center — Ownership, Data Rights & Jurisdiction other 4. September 2026
  Elastx trust center confirming Swedish company, Swedish owners, all employees EU citizens, not subject to third-country legislation like US CLOUD Act or FISA.
  Relevance: Confirms Elastx's IP holder jurisdiction: Swedish company with Swedish/EU ownership, no foreign IP claims, fully under EU/Swedish law without exceptions.

Selected answer: 5. Customer exclusive control - provider can not read the data Value 200 SEAL 4

Notes: Elastx DSM offers customer-owned keys via FIPS 140-2 L3 HSMs, client-side encryption, and Double Key Encryption — provider cannot read customer data.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Shows DSM with HSM-based key management is integrated into the core platform, enabling customer-exclusive key control as a platform capability.
• Elastx Data Security Manager other 4. September 2026
  DSM page detailing FIPS 140-2 Level 3 HSMs as a service, KMS, and encryption services where customers own and control their encryption keys.
  Relevance: Directly confirms customer-exclusive encryption key ownership and control with HSM-backed key management, including client-side and Double Key Encryption.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Confirms platform encryption approach and that staff cannot access customer data in daily operations, supporting customer key exclusivity via DSM.

Selected answer: 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) Value 100 SEAL 2

Notes: Logs exist (Event Viewer captures When, Initiated-by, Status) but lack real-time customer oversight and independent auditability. No AI-specific usage logging found.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: ISO certifications and 24/7 monitoring exist but no specific real-time customer-controlled data access logging or AI model auditability is mentioned. Vendor-controlled monitoring.
• Elastx DBaaS Event Viewer Documentation other 4. September 2026
  Documents Elastx's Event Viewer for DBaaS, recording When, Status, Initiated by, and Description for datastore events.
  Relevance: Event Viewer provides access logs with timestamp, initiator, and action type — but offered through vendor UI, not real-time or customer-controlled. No independent auditability.
• Elastx DBaaS Logs Viewer Documentation other 4. September 2026
  Elastx Logs Viewer tool for database logs, displaying log Name, When (timestamp), and Actions to view/download.
  Relevance: Logs Viewer offers database-level logs with timestamps but with limited fields — no full data access auditing, no real-time capability, vendor-controlled UI.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: OpenStack volume wiping and cryptographic erasure via Barbican provide technical deletion; event viewer logs verify actions. No independent erasure verification found.

Evidence

• Elastx DBaaS Event Viewer Documentation other 4. September 2026
  Elastx event viewer records When, Status, Initiated by, and Description for datastore events, providing an audit trail of deletion actions.
  Relevance: Provides the access log layer verifying that deletion events occurred, with who/when/what metadata — supporting technically verified deletion rather than just policy-based assurance.
• ELASTX OpenStack IaaS Overview other 4. September 2026
  Describes Elastx OpenStack IaaS platform (Yoga) across three Stockholm data centers, including Cinder SSD block storage with Barbican-managed encryption.
  Relevance: Confirms Elastx uses OpenStack Cinder with Barbican encryption, enabling cryptographic erasure (key deletion) as a secure deletion mechanism on their platform.
• OpenStack Security Guide — Volume Wiping other 4. September 2026
  Documents OpenStack Cinder volume wiping mechanism: volume_clear writes zeroes over deleted volumes; cryptographic erasure by deleting encryption keys via Barbican.
  Relevance: Describes the technical secure deletion mechanisms available on Elastx's OpenStack platform — zero-pass overwriting and cryptographic key destruction for irreversible removal.

Selected answer: 5. All data exclusively in the EU with no third-country fallback Value 200 SEAL 4

Notes: All data stored/processed exclusively in Sweden (EU/EEA). No sub-processors, no third-country corporate ties, no fallback mechanisms. Fully Swedish/EU jurisdiction.

Evidence

• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Directly confirms strict EU/EEA data confinement with no third-country fallback, no sub-processors, and exclusive Swedish/EU jurisdiction.
• SovereignSky – Elastx Datacenters & Jurisdiction other 4. September 2026
  Maps Elastx datacenters to legal jurisdiction: HQ Sweden, all 3 regions in Sweden, applicable laws include GDPR, ePrivacy, NIS2, Data Act, AI Act — all EU/Swedish.
  Relevance: Third-party verification that all datacenters are in Sweden/EU with no third-country jurisdiction exposure, supporting exclusive EU data confinement.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Confirms Elastx as EU-native with all-Sweden residency and no third-country legal exposure, reinforcing exclusive EU data location.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: Open-source AI stacks with EU partners (ConfidentialMind, Eyevinn) but dependent on Nvidia (US) GPU accelerators.

Evidence

• Case Study: Elastx – Generative AI for a Cloud Computing Provider other 4. September 2026
  Case study of Elastx partnering with Finnish startup ConfidentialMind to deploy a multi-tenant RAG stack and shared LLM services on managed Kubernetes with tenant isolation.
  Relevance: Demonstrates EU-led AI service delivery via open-source/partner approach (Finnish AI company), showing auditable open AI rather than licensed non-EU models.
• Elastx GPU Hosting for AI & Machine Learning other 4. September 2026
  Elastx's GPU hosting page: GPU instances for ML, generative AI, and HPC via OpenStack IaaS and Kubernetes CaaS, hosted in Swedish data centers with full regulatory compliance.
  Relevance: Shows Elastx offers AI/ML GPU compute hosted under EU sovereignty but relies on Nvidia (foreign) accelerators — a key dependency for the assessment.
• Eyevinn Technology & Elastx Partner for Digital Sovereignty other 4. September 2026
  Eyevinn and Elastx partnership launching open-source cloud with 188+ services including AI tools, all running on Swedish infrastructure under Swedish law.
  Relevance: Highlights Elastx's open-source AI approach with 188+ services on EU infrastructure, supporting the 'auditable/open source AI' characterization of mixed control.

Selected answer: 3. Standard documented methods for data export are available Value 83 SEAL 4

Notes: Elastx uses open-source OpenStack with open APIs/standards, explicitly states no lock-in, and offers DBaaS backup/restore + migration docs; but no dedicated formal migration service offering is evident.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Directly states no lock-in via open-source code and open standards. Supports that standardized, documented portability methods exist rather than best-effort only.
• Elastx Kubernetes CaaS Overview Documentation other 4. September 2026
  Elastx docs: CNCF-conformant Kubernetes cluster, DBaaS backup/restore, migration guide to CaaS v2, persistent storage via Cinder.
  Relevance: Shows concrete standard documented migration/export methods (CNCF conformance, backups, migration guide) rather than formal managed migration services.
• VMware to OpenStack Migration Guide — OpenInfra Foundation other 4. September 2026
  Official OpenInfra migration guide listing Elastx among OpenStack providers; covers open standards-based portability and vendor lock-in avoidance.
  Relevance: Confirms Elastx operates on OpenStack's open, standardized APIs enabling interoperability and reasoned workload migration rather than proprietary lock-in.

Selected answer: 5. The entire technology stack is managed and supported by a fully EU-based team Value 167 SEAL 4

Notes: Full Swedish team operates OpenStack/K8s 24/7 with no foreign legal exposure. Minor optional deps (MSSQL) exist but core stack is EU-sovereign.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Confirms 24/7 support is provided by Elastx's own team and the core platform is open-source OpenStack/Kubernetes, operable without foreign vendor involvement.
• ELASTX OpenStack IaaS Overview other 4. September 2026
  Describes Elastx OpenStack IaaS platform (Yoga) across three Stockholm data centers, including Cinder SSD block storage with Barbican-managed encryption.
  Relevance: Demonstrates the core infrastructure is independently operated by Elastx's Swedish team using open-source OpenStack (Yoga), confirming capacity for EU-only operational management.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Directly confirms Elastx is a Swedish company with no foreign ownership, operated by Swedish staff 24/7, and fully outside foreign jurisdiction — core to assessing EU operational independence.

Selected answer: All EU staff Value 125 SEAL 3

Notes: Elastx ~30 staff based in Stockholm, all EU citizens per Trust Center. All ops in Sweden. No evidence of formal security clearances. No non-EU escalation paths.

Evidence

• Elastx – Sobro (Söderberg & Partners) other 4. September 2026
  Sobro portfolio page listing Elastx with 53% ownership, 27 employees, 53M SEK revenue, data stays in Sweden.
  Relevance: Confirms 27 employees under Swedish parent — all staff within EU, supporting the all-EU staffing assessment.
• Elastx – The Swedish Cloud (Company History) other 4. September 2026
  Elastx company history page showing founding by Swedish founders Henrik Grankvist and Joakim Öhman in 2012, financed privately, with ~30 employees and Swedish data sovereignty focus.
  Relevance: Confirms small team of ~30 based in Sweden with specialized skills to operate OpenStack/K8s — evidence of EU-based talent pool for service operation.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Directly confirms EU citizen staff requirement — all employees are EU citizens, no non-EU staffing for operations or escalation.

Selected answer: 4. All support staff are located within the EU Value 125 SEAL 3

Notes: All Elastx staff are Swedish citizens with 24/7 support from Sweden under EU law. Background checks confirmed but no formal security clearances documented.

Evidence

• Elastx – The Swedish Cloud Provider other 4. September 2026
  Elastx official site: Swedish cloud provider founded 2012 in Stockholm, all operations and development within Sweden under EU jurisdiction.
  Relevance: Confirms all employees are EU citizens and support is Swedish-based, subject exclusively to EU/EEA legal frameworks. Existing evidence item ID 582 aligns with this source.
• Elastx | European Alternatives other 4. September 2026
  European Alternatives directory listing Elastx as fully Swedish-owned and operated cloud provider under EU jurisdiction.
  Relevance: Independent directory confirms Elastx is fully Swedish-owned and operated under EU jurisdiction, supporting that operational support is delivered from within the EU.
• The Swedish Cloud Provider: Everything You Need for Secure Cloud Operations other 4. September 2026
  Elastx official page confirming all staff are Swedish citizens with thorough background checks, 24/7 support, and exemption from US CLOUD Act.
  Relevance: Directly confirms support staff are EU-based Swedish citizens with background checks. States 24/7 support available, all under Swedish/EU jurisdiction. No formal security clearances mentioned.

Selected answer: 5. EU-only end-to-end - Content, metadata, and backups/replicas are stored in the EU and privileged administration/support access is restricted to EU-based staff under EU jurisdiction Value 167 SEAL 4

Notes: Elastx provides full technical docs hosted in Sweden, uses open-source (OpenStack/K8s) source code, and all admin staff are Swedish citizens under EU jurisdiction. No non-EU dependencies.

Evidence

• Elastx – The Swedish Cloud Provider other 4. September 2026
  Elastx official site: Swedish cloud provider founded 2012 in Stockholm, all operations and development within Sweden under EU jurisdiction.
  Relevance: Confirms that privileged administration and support access is restricted to EU-based staff under EU jurisdiction, satisfying end-to-end EU-only criteria.
• ELASTX – The Swedish Cloud Provider (European Cloud Directory) other 4. September 2026
  Third-party profile confirming Elastx uses vanilla OpenStack and open-source components with no proprietary layers; 3 data centers in Stockholm area; ISO certified.
  Relevance: Open-source technology ensures source code is publicly available, enabling long-term autonomy. No proprietary lock-in to foreign-controlled code or documentation.
• Elastx Documentation Site other 4. September 2026
  Official Elastx operational documentation site covering OpenStack IaaS, Kubernetes CaaS, DBaaS, security, and APIs. Hosted on Swedish infrastructure.
  Relevance: Comprehensive technical documentation enabling operational autonomy is fully available and hosted within the EU. Covers source-level details of all managed services.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: Elastx uses open-source stack with EU/EEA suppliers, exit clauses, no data sub-processors, and NIS2 supplier reviews, enabling supplier substitution.

Evidence

• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Directly addresses supplier/subcontractor jurisdiction controls, NIS2 supply chain reviews, exit clauses, and absence of data sub-processors.
• LeadIQ — Elastx Company Profile, Partnerships & Tech Stack other 4. September 2026
  Provides detailed breakdown of Elastx's technology partners, hardware vendors, and supplier relationships.
  Relevance: Identifies specific critical suppliers (Lightbits, Severalnines, NVIDIA, Digital Realty) and their geographies, informing supplier substitution feasibility.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Independent third-party assessment of Elastx's sovereignty level, validating their capacity for autonomous operations and supplier independence.

Selected answer: Partial disclosure Value 35 SEAL 1

Notes: Elastx discloses some hardware partners via third-party sources (Intel, Cisco, Lightbits) but does not systematically document geographic origin of all key physical components.

Evidence

• Elastx — Virtuozzo PaaS Partners (Hardware & Infrastructure) other 4. September 2026
  Virtuozzo partner page specifying Elastx uses Intel Xeon Gold 5220R CPUs, Cisco networking, and Tier 3 data centers in three Stockholm locations.
  Relevance: Confirms specific hardware components (Intel CPUs, Cisco networking) from a partner page, demonstrating partial disclosure of physical infrastructure but without geographic origin traceability.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Shows that Elastx's own Trust Center addresses sovereignty and jurisdiction but omits geographic provenance of physical infrastructure components, supporting partial disclosure.
• LeadIQ — Elastx Company Profile other 4. September 2026
  Third-party profile listing Elastx's technology partners, hardware vendors, and suppliers including Intel and Cisco.
  Relevance: Partially reveals hardware vendors in Elastx's supply chain through a third-party source, but Elastx does not systematically publish this itself.

Selected answer: Foreign origin, partial disclosure Value 35 SEAL 1

Notes: Hardware (Intel CPUs, Cisco networking) is foreign-sourced with no EU manufacturing guarantees; suppliers disclosed but specific fab/factory origins not fully transparent.

Evidence

• Elastx — Virtuozzo PaaS Partners (Hardware & Infrastructure) other 4. September 2026
  Virtuozzo partner page specifying Elastx uses Intel Xeon Gold 5220R CPUs, Cisco networking, and Tier 3 data centers in three Stockholm locations.
  Relevance: Confirms Elastx's hardware suppliers are Intel (US) and Cisco (US)—foreign origin with partial disclosure of component origins.

Selected answer: Transparent with exceptions Value 71 SEAL 4

Notes: Elastx discloses supply chain, ownership, and supplier review practices but uses US-origin hardware (Intel, Cisco, NVIDIA); firmware provenance of embedded controllers not fully disclosed.

Evidence

• Elastx OpenStack — Infrastructure as a Service other 4. September 2026
  Elastx OpenStack IaaS page detailing three Stockholm data centers with KVM compute, NVIDIA GPUs, Cisco networking, and Cinder/OpenStack Swift storage.
  Relevance: Discloses specific hardware vendors (Intel CPUs, Cisco networking, NVIDIA GPUs) used in the platform, critical for assessing component jurisdiction and provenance.
• Elastx Trust Center — Ownership, Data Rights & Jurisdiction other 4. September 2026
  Elastx trust center confirming Swedish company, Swedish owners, all employees EU citizens, not subject to third-country legislation like US CLOUD Act or FISA.
  Relevance: Directly addresses supply chain transparency: Elastx owns hardware, prioritizes EU/EEA suppliers, and discloses supplier review processes, but does not detail firmware provenance of commercial components.
• Lightbits Software-Defined Storage Powers Elastx Cloud other 4. September 2026
  Press release on Elastx adopting Lightbits LightOS storage, moving from Intel Optane to commodity NVMe SSDs, backed by Cisco, Intel, Dell, and Lenovo.
  Relevance: Reveals Elastx hardware dependencies on US-origin suppliers (Intel, Cisco, NVIDIA) and their shift to commodity hardware, relevant to component jurisdiction assessment.

Selected answer: 3. Core and essential parts of the software are designed and maintained by EU teams Value 71 SEAL 3

Notes: Elastx builds on global open-source (OpenStack). Essential platform integration, tooling, and ops software are by their Swedish EU team, but core upstream is global community-developed.

Evidence

• Elastx — GitHub Organization other 4. September 2026
  98 repos (Python, Go, Shell) including OpenStack forks (Cinder, Nova, Swift, Keystone) and custom tooling by Elastx's Swedish engineering team.
  Relevance: Shows Elastx's EU team actively architects and maintains essential platform software on top of globally-developed OpenStack, supporting option 3 over 4–5.
• Elastx AB – OpenInfra Foundation Member Profile other 4. September 2026
  OpenInfra Foundation membership profile showing Elastx as a Public Cloud Provider and active contributor to the OpenStack project.
  Relevance: Confirms Elastx contributes to and maintains OpenStack-based software, but OpenStack core is globally developed — hence core parts by EU, not all.
• Elastx Trust Center — Ownership, Data Rights & Jurisdiction other 4. September 2026
  Elastx trust center confirming Swedish company, Swedish owners, all employees EU citizens, not subject to third-country legislation like US CLOUD Act or FISA.
  Relevance: Establishes that Elastx's engineering and development team is entirely EU-based, supporting EU origin for platform-specific software.

Selected answer: 5. EU control and EU policy gates - As (4), plus EU-based compliance/security gates enforced in the pipeline (e.g., signing under your control, vulnerability checks, segregation of duties, auditable approvals) Value 143 SEAL 4

Notes: Fully Swedish EU-owned provider; all staff are Swedish citizens. ISO 27001 with ISAE 3000 audits enforce security testing, SoD, and change mgmt gates in their build pipeline.

Evidence

• Elastx — GitHub Organization other 4. September 2026
  98 repos (Python, Go, Shell) including OpenStack forks (Cinder, Nova, Swift, Keystone) and custom tooling by Elastx's Swedish engineering team.
  Relevance: Shows Elastx directly maintains, builds, and packages OpenStack components from within Sweden, confirming EU-based software packaging and distribution under their control.
• Elastx AB – OpenInfra Foundation Member Profile other 4. September 2026
  OpenInfra Foundation membership profile showing Elastx as a Public Cloud Provider and active contributor to the OpenStack project.
  Relevance: Independently confirms that Elastx owns and manages all infrastructure in Sweden with no external dependencies, supporting EU control and execution of software deployment.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Confirms EU jurisdiction for all operations, EU-only staff, and compliance/security controls (vuln scanning, HSM signing, SoD via least-privilege, auditable ISMS) enforced under EU governance.

Selected answer: Few non-EU vendors or facilities involved in critical services, non documented, or non-EU vendors/facilities transparently documented Value 71 SEAL 2

Notes: Few non-EU vendors (Intel, Cisco, NVIDIA, Lightbits Labs—all US) in critical services; dependencies documented via press releases and partner pages; all facilities in Sweden (EU).

Evidence

• Elastx — Virtuozzo PaaS Partners other 4. September 2026
  Partners page listing Elastx with Intel Xeon Gold 5220R CPUs and Cisco networking hardware in Stockholm Tier 3 data centers.
  Relevance: Shows non-EU hardware vendors (Intel, Cisco) used in critical compute and networking services; key evidence of non-EU vendor dependency in critical infrastructure.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Confirms all facilities in Sweden (EU) and no non-EU facilities; key for assessing geographic dependency on non-EU facilities.
• Lightbits Software-Defined Storage Powers Elastx Cloud other 4. September 2026
  Press release on Elastx adopting Lightbits LightOS storage, moving from Intel Optane to commodity NVMe SSDs, backed by Cisco, Intel, Dell, and Lenovo.
  Relevance: Demonstrates a documented dependency on a non-EU (US) vendor for critical storage infrastructure, directly relevant to single-point-of-dependency assessment.

Selected answer: Critical suppliers and subcontractors can be audited Value 71 SEAL 2

Notes: Elastx audits critical/essential suppliers annually per ISO 27001 & NIS2. Customer audit rights via DPA. Sub-supplier oversight through supplier assessments.

Evidence

• Elastx LeadIQ Company Profile — Technology Partners & Suppliers other 5. September 2026
  LeadIQ profile lists Elastx's technology partners, hardware vendors (Intel Xeon Gold, Cisco networking), and supplier relationships.
  Relevance: Provides visibility into Elastx's supplier ecosystem, supporting assessment of supply chain transparency scope and identified critical suppliers.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Confirms Elastx has controls for direct suppliers with requirements adapted by criticality, plus customer audit rights; covers supplier management but focuses on critical/essential suppliers.
• ISO 27001:2022 Annex A.5 — Supplier Management Controls other 3. September 2026
  Practical guidance on ISO 27001:2022 controls A.5.19–A.5.23 covering supplier relationships, security agreements, ICT supply chain, monitoring, and cloud service security including audit rights.
  Relevance: Explains the ISO 27001 framework Elastx certifies against, including A.5.20 (right-to-audit clauses in supplier agreements) and A.5.21 (ICT supply chain awareness), contextualizing audit rights scope.

Selected answer: 5. Open-by-default with portability - All critical functions are accessible via open, well-documented, non-proprietary APIs and standard formats, with published specifications and minimal vendor-specific dependencies enabling easy third-party integration Value 200 SEAL 4

Notes: Runs unmodified OpenStack, standard Kubernetes, Keycloak identity, Swift S3 compat. No proprietary layers; uses standard Terraform providers.

Evidence

• Elastx AB – OpenInfra Foundation Member Profile other 5. September 2026
  OpenInfra Foundation member profile for Elastx AB, confirming upstream community participation.
  Relevance: Confirms Elastx as a formal OpenInfra member, reinforcing commitment to upstream OpenStack standards and community governance of stack.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Shows Elastx explicitly bases services on non-proprietary open-source/open standards, explicitly committing to no lock-in — central to open-by-default portability.
• Elastx Documentation Site other 4. September 2026
  Official Elastx operational documentation site covering OpenStack IaaS, Kubernetes CaaS, DBaaS, security, and APIs. Hosted on Swedish infrastructure.
  Relevance: Provides documented APIs for all critical functions using upstream open standards (OpenStack APIs, Swift S3, Keycloak, Kubernetes), confirming openness and third-party portability.

Selected answer: 3. Partial core adoption - Open standards are used and documented for some core services, while other core services remain proprietary/vendor-specific Value 100 SEAL 2

Notes: Vanilla OpenStack (IaaS) and Kubernetes (CaaS) use open standards, but PaaS (Virtuozzo) and DBaaS (Severalnines CCX) remain proprietary. No formal policy covers all core services.

Evidence

• Elastx AB – OpenInfra Foundation Member Profile other 4. September 2026
  OpenInfra Foundation membership profile showing Elastx as a Public Cloud Provider and active contributor to the OpenStack project.
  Relevance: Confirms Elastx's institutional commitment to OpenStack open standards for IaaS, but scope is limited to OpenStack-based services, not all core offerings like PaaS or DBaaS.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Explicitly documents open standards use for IaaS (OpenStack) and CaaS (Kubernetes) while also listing Virtuozzo PaaS and commercial services, confirming partial adoption across core services.
• European Alternatives – Elastx other 5. September 2026
  Curated European alternatives directory listing Elastx as an OpenStack-based Swedish cloud platform with managed Kubernetes, object storage, and WAF services.
  Relevance: Independent directory confirms OpenStack foundation but also lists services like WAF that are not inherently open-standard-based, supporting partial core adoption assessment.

Selected answer: 5. Fully open-source software is governed by an independent or EU-based entity, granting full rights to audit, modify, redistribute, and seamlessly transfer stewardship Value 200 SEAL 4

Notes: Elastx's entire platform is built on vanilla OpenStack (Apache 2.0 license) governed by the independent OpenInfra Foundation. Full audit, modify, redistribute rights. No proprietary lock-in.

Evidence

• Elastx — GitHub Organization other 4. September 2026
  98 repos (Python, Go, Shell) including OpenStack forks (Cinder, Nova, Swift, Keystone) and custom tooling by Elastx's Swedish engineering team.
  Relevance: Provides direct evidence that the underlying code is publicly auditable and modifiable under open licenses. The forks show Elastx's ability to inspect, modify, and contribute to the OpenStack codebase — fulfilling the audit, modify, and redistribute criteria.
• Elastx AB – OpenInfra Foundation Member Profile other 4. September 2026
  OpenInfra Foundation membership profile showing Elastx as a Public Cloud Provider and active contributor to the OpenStack project.
  Relevance: Demonstrates Elastx's active membership in the independent foundation governing OpenStack, confirming their platform runs on fully open-source software with community-driven stewardship rather than proprietary or single-company-controlled governance.
• OpenInfra Foundation – About other 5. September 2026
  Describes the OpenInfra Foundation as a neutral, independent home for open source infrastructure projects. Follows the '4 Opens' principles: Open Source, Open Development, Open Community, Open Design. 110,000+ individuals across 182+ countries.
  Relevance: Establishes that OpenStack governance is independent and community-driven, not centralised under a single company. The '4 Opens' principles guarantee open governance, ensuring EU actors can audit, modify, and redistribute without lock-in.

Selected answer: Large corpus of public insight exists (all) Value 150 SEAL 3

Notes: Elastx provides extensive public docs covering architecture, data flows, dependencies, limitations and changelogs for all services (OpenStack IaaS, Kubernetes CaaS, DBaaS) on docs.elastx.cloud, hosted open-source on GitHub.

Evidence

• Elastx Documentation Site other 4. September 2026
  Official Elastx operational documentation site covering OpenStack IaaS, Kubernetes CaaS, DBaaS, security, and APIs. Hosted on Swedish infrastructure.
  Relevance: Comprehensive public documentation of all service architectures, data flows, and dependencies — directly addresses service architecture transparency for all offerings.
• Elastx Kubernetes CaaS Overview Documentation other 4. September 2026
  Elastx docs: CNCF-conformant Kubernetes cluster, DBaaS backup/restore, migration guide to CaaS v2, persistent storage via Cinder.
  Relevance: Demonstrates same level of transparency for CaaS — architecture, dependencies, limitations, and version history all publicly documented, confirming broad insight across all services.
• ELASTX OpenStack IaaS Overview other 4. September 2026
  Describes Elastx OpenStack IaaS platform (Yoga) across three Stockholm data centers, including Cinder SSD block storage with Barbican-managed encryption.
  Relevance: Highest-value source for IaaS architecture transparency — publicly discloses service components, dependencies, limitations, and API access, enabling full architectural audit.

Selected answer: EU-hosted, foreign stack Value 50 SEAL 3

Notes: Elastx hosts HPC/GPU workloads in Swedish data centers, but all processors (Intel Xeon), accelerators (NVIDIA GPUs), and networking (Cisco) are foreign-designed and manufactured. No EU processor IP.

Evidence

• Elastx GPU Hosting for AI & Machine Learning other 4. September 2026
  Elastx's GPU hosting page: GPU instances for ML, generative AI, and HPC via OpenStack IaaS and Kubernetes CaaS, hosted in Swedish data centers with full regulatory compliance.
  Relevance: Shows Elastx explicitly markets HPC workloads on EU-hosted infrastructure, confirming EU operations for HPC. However, GPU models are non-EU (NVIDIA), and no EU processor/accelerator IP is mentioned.
• Elastx OpenStack — Infrastructure as a Service other 5. September 2026
  Elastx IaaS overview: 3 Stockholm data centers with KVM compute, NVIDIA GPUs, Cisco networking, Cinder/Swift storage on OpenStack Yoga.
  Relevance: Details Elastx's HPC-relevant hardware: Intel Xeon CPUs, NVIDIA GPUs, Cisco networking—all foreign-designed/foreign-fab components. No EU processor IP, no EU co-design, confirming foreign stack.
• Europe built sovereign clouds to escape US control. Then forgot about the processors — The Register other 5. September 2026
  Investigative analysis revealing that EU sovereign cloud frameworks certify operations but not the silicon layer. Intel ME and AMD PSP run below OS at Ring -3; US RISAA 2024 can compel hardware makers. Asks: can sovereignty exist on non-sovereign silicon?
  Relevance: Explains why EU-hosted clouds with foreign Intel/NVIDIA stacks fail HPC processor sovereignty. Elastx fits this pattern: EU-hosted but foreign processors/accelerators throughout the HPC stack.

Selected answer: EAL2 Value 71 SEAL 2

Notes: Elastx holds ISO 27001, 27017, 27018, 14001 but lacks advanced certs like BSI C5 or SecNumCloud. Standard ISO portfolio fits EAL2, below EAL3.

Evidence

• About Elastx – Certifications other 5. September 2026
  Official Elastx page listing their ISO 27001, 27017, 27018, and 14001 certifications, plus GDPR and Cloud Act-free status.
  Relevance: Directly confirms Elastx's full certification portfolio, which is the core evidence for assessing SOV-7 security certification level.
• Elastx Information Security Policy other 5. September 2026
  Elastx's ISMS policy page detailing their ISO 27001-certified security management framework, audits, and risk treatment processes.
  Relevance: Shows ISMS governance under ISO 27001 with bi-annual risk analysis and annual BCP testing — supports EAL2 assessment.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Third-party verification of Elastx's certification level relative to peers with stronger certs (C5, SecNumCloud), supporting EAL2 ranking.

Selected answer: 3. Moderate compliance to some well-know EU Regulations (controls exist but gaps remain; compliance not fully demonstrated) Value 71 SEAL 4

Notes: GDPR well-demonstrated via ISO certs & Swedish jurisdiction; NIS2 only presumed; DORA not addressed. Gaps remain across all four frameworks.

Evidence

• About Elastx – Certifications other 5. September 2026
  Official Elastx page listing their ISO 27001, 27017, 27018, and 14001 certifications, plus GDPR and Cloud Act-free status.
  Relevance: Directly demonstrates GDPR compliance and ISO certifications (independently audited) but no mention of NIS2, DORA, or other EU regulatory frameworks.
• Elastx News & Articles — NIS2 Customer Stories other 5. September 2026
  Elastx news hub with customer stories referencing NIS2 compliance, regulatory requirements, and Swedish data hosting choices over US-based alternatives.
  Relevance: Shows NIS2 compliance is referenced in customer context but not as a formally certified framework; no DORA-specific content found.
• NIS2, DORA and the Sovereign Cloud Question other 5. September 2026
  Third-party analysis assessing Elastx against NIS2/DORA, citing Sweden's Cybersäkerhetslagen transposition and assessing Elastx at SEAL-2 to SEAL-3 sovereignty level.
  Relevance: Assesses Elastx specifically against NIS2 and DORA, noting gaps in key custody and hardware supply chain; SEAL-2/3 rating confirms moderate compliance level.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: All staff are Swedish citizens with background checks; 24/7 monitoring and incident management run from Sweden under EU jurisdiction. No evidence of ENISA participation.

Evidence

• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Shows security operations and threat intelligence are embedded in the Swedish-operated platform with no non-EU escalation paths.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Confirms incident handling and security operations run exclusively by EU-based Swedish staff under EU jurisdiction with 24/7 monitoring.
• The Swedish Cloud Provider: Everything You Need for Secure Cloud Operations other 4. September 2026
  Elastx official page confirming all staff are Swedish citizens with thorough background checks, 24/7 support, and exemption from US CLOUD Act.
  Relevance: Confirms all security operations including incident response handled by Swedish (EU) teams with no non-EU involvement.

Selected answer: 4. Customers have full direct access to their security monitoring and logs which are stored in the EU Value 107 SEAL 3

Notes: Elastx provides direct log access via Logs Viewer, Event Viewer, and OpenStack-native logging, all stored in Sweden (EU). No tamper-proof guarantee excludes option 5.

Evidence

• Elastx DBaaS Logs Viewer Documentation other 4. September 2026
  Elastx Logs Viewer tool for database logs, displaying log Name, When (timestamp), and Actions to view/download.
  Relevance: Demonstrates direct customer access to logs via a portal interface (viewing, downloading), supporting level 4 over options 2–3. No evidence of tamper-proof immutability.
• Elastx Trust Center — Ownership, Data Rights & Jurisdiction other 5. September 2026
  Elastx's security and trust center page covering DDoS protection, WAAS, threat intelligence, and data security manager, all operating under Swedish/EU jurisdiction.
  Relevance: Confirms security services (monitoring, alerts) are under EU jurisdiction and customers can access security monitoring features directly.
• OpenStack Security Guide — Monitoring and Logging other 5. September 2026
  Official OpenStack Security Guide covering monitoring and logging practices including access logs, event detection, and forensic logging capabilities for OpenStack cloud environments.
  Relevance: Elastx runs vanilla OpenStack; customers can access native OpenStack logging and monitoring (audit logs, access logs, events) directly via API or dashboard, stored in Sweden.

Selected answer: 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time Value 71 SEAL 2

Notes: Elastx has ISO 27001 ISMS with GDPR/NIS2 compliance and reporting to CERT-SE via Swedish law, but no evidence of real-time CSIRT data sharing or proactive disclosure.

Evidence

• Elastx Trust Center other 5. September 2026
  Elastx Trust Center detailing ISO 27001/27017/27018 certifications, GDPR/NIS2/DORA compliance, vulnerability management, and 24/7 monitoring across Stockholm zones.
  Relevance: Confirms Elastx has formal ISMS with incident management, stated GDPR/NIS2 compliance, and vulnerability management within an audited framework supporting EU-mandated reporting timelines.
• NIS2 Directive Article 12: Coordinated Vulnerability Disclosure other 5. September 2026
  EU regulation mandating CSIRT-coordinated vulnerability disclosure, European Vulnerability Database by ENISA, and cross-member-state CSIRT cooperation.
  Relevance: Defines EU-level vulnerability disclosure obligations applicable to Elastx as a NIS2-compliant provider, but does not require proactive public disclosure or real-time CSIRT data feeds.
• NIS2 Sweden: Cybersäkerhetslagen in Force 15 January 2026 other 5. September 2026
  Details Sweden's NIS2 transposition requiring incident reporting to CERT-SE/NCSC with 24h early warning, 72h notification, and 1-month final report timelines.
  Relevance: Establishes the regulatory framework Elastx must follow for breach disclosure, including mandatory CSIRT cooperation via CERT-SE under Swedish law, but no real-time sharing requirement.

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: Elastx runs vanilla OpenStack as contributor; customers can test patches with notice, but zero-day patches depend on upstream OpenStack VMT timing.

Evidence

• Elastx Documentation Site other 4. September 2026
  Official Elastx operational documentation site covering OpenStack IaaS, Kubernetes CaaS, DBaaS, security, and APIs. Hosted on Swedish infrastructure.
  Relevance: Contains announcements and changelogs documenting how Elastx communicates maintenance windows and patches to customers, supporting Moderate Autonomy rating.
• Elastx OpenStack — Infrastructure as a Service other 4. September 2026
  Elastx OpenStack IaaS page detailing three Stockholm data centers with KVM compute, NVIDIA GPUs, Cisco networking, and Cinder/OpenStack Swift storage.
  Relevance: Shows Elastx directly operates vanilla OpenStack without proprietary overlays, enabling independent patching and testing. Monthly image updates and changelogs show customer-facing patch notice practices.
• OpenStack Project Team Guide: Vulnerability Management other 5. September 2026
  Details the OpenStack Vulnerability Management Team (VMT) process: embargoed private patch development, stakeholder notification before public disclosure, and OSSA/OSSN advisories.
  Relevance: Explains upstream patching process Elastx depends on. Embargoed zero-day patches leave limited customer notice window; otherwise adequate notice and testing is feasible.

Selected answer: 4. High control by independent entities to request data from the vendor Value 107 SEAL 1

Notes: Elastx provides GDPR Art 28.3(h) audit rights, DORA addendums, ISAE 3000 Type II, and ISO certs. Audits are contractual, not open to any entity.

Evidence

• Elastx Information Security Policy other 5. September 2026
  Elastx's ISMS policy page detailing their ISO 27001-certified security management framework, audits, and risk treatment processes.
  Relevance: Demonstrates structured internal audit processes and continuous compliance monitoring relevant to independent audit capacity assessment.
• Elastx Trust Center — Data Protection & Encryption FAQ other 4. September 2026
  Trust Center covering AES-256 encryption at rest, TLS in transit, HSM via Barbican, and least-privilege staff access model.
  Relevance: Directly addresses auditability: shows contractual audit rights for customers and mandated auditors, independent third-party audits, and public compliance transparency.
• Top EU Sovereign Cloud Platforms 2026 (Qovery Blog) other 4. September 2026
  Article maps EU sovereign cloud providers. Elastx listed in Tier 2 as privately held Swedish company with no US CLOUD Act exposure, fully under EU/Swedish jurisdiction.
  Relevance: Third-party assessment of Elastx sovereignty credentials and compliance posture, including audit-relevant transparency and certification details.

Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4

Notes: Swedish DC avg PUE ~1.37 (<1.5); ISO 14001 with annual reviews = roadmap. No self-published or EU-verified PUE.

Evidence

• Elastx | European Alternatives other 4. September 2026
  European Alternatives directory listing Elastx as fully Swedish-owned and operated cloud provider under EU jurisdiction.
  Relevance: Confirms renewable energy use and ISO 14001 cert, supporting energy-efficient infrastructure claims relevant to PUE assessment.
• Elastx Environment Policy other 5. September 2026
  Elastx's official environmental policy page detailing their ISO 14001:2015 EMS with annual objective reviews.
  Relevance: Shows ISO 14001 commitment with annual environmental objective reviews, serving as the 'roadmap' component for energy efficiency improvement.
• Responsible AI by Design – Elastx Press Release other 5. September 2026
  Elastx press release on sustainable AI discussing data center energy optimization, workload consolidation, and quantified ~25% energy savings potential.
  Relevance: Shows Elastx actively pursuing measurable energy efficiency improvements and infrastructure optimization, supporting roadmap credibility.

Selected answer: Documented program Value 125 SEAL 3

Notes: Elastx has ISO 14001-certified EMS with hazardous waste management, but no specific circular economy program for hardware.

Evidence

• Elastx – Environmental Policy other 5. September 2026
  Elastx's official environmental policy page detailing ISO 14001:2015 EMS commitments including hazardous waste management and material footprint reduction.
  Relevance: Shows Elastx has a documented EMS with hazardous waste management relevant to hardware end-of-life, but lacks specific circular economy measures.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Confirms Elastx holds ISO 14001 and operates on renewable energy, but does not mention hardware reuse or recycling practices.
• Why Data Centers Need ISO 14001 Certification – Schellman other 5. September 2026
  Industry article explaining how ISO 14001 helps data centers manage e-waste, hardware disposal, and environmental impact systematically.
  Relevance: Provides third-party context on how ISO 14001 applies to data center hardware waste management and recycling, contextualizing Elastx's certification.

Selected answer: No reporting Value 0 SEAL 1

Notes: Elastx holds ISO 14001 and uses renewable energy, but does not publicly disclose carbon emissions, water usage, or other sustainability metrics. No formal reporting exists.

Evidence

• Elastx | European Alternatives other 4. September 2026
  European Alternatives directory listing Elastx as fully Swedish-owned and operated cloud provider under EU jurisdiction.
  Relevance: Independent confirmation that Elastx's environmental claims are limited to renewable energy use and ISO 14001, with no evidence of detailed emissions or water reporting.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Shows Elastx mentions sustainability qualitatively but does not provide transparent measurement or public disclosure of carbon emissions, water usage, or specific sustainability indicators.
• Lack of big tech transparency hides reality of data center environmental costs other 5. September 2026
  Article showing most data center operators, including smaller providers, lack transparent reporting of electricity use, water consumption, and CO2 emissions.
  Relevance: Provides industry context showing that the absence of detailed sustainability reporting is a systemic issue, particularly among smaller cloud providers like Elastx.

Selected answer: Only green EU energy supplies Value 250 SEAL 4

Notes: All Elastx data centres in Stockholm run on renewable energy. Green Web Foundation certified. All energy sourced within EU (Sweden).

Evidence

• Elastx | European Alternatives other 4. September 2026
  European Alternatives directory listing Elastx as fully Swedish-owned and operated cloud provider under EU jurisdiction.
  Relevance: Independent third-party verification that Elastx uses only renewable energy across all three Swedish data centres.
• Elastx Cloud Platform Overview other 4. September 2026
  Official Elastx page describing ISO-certified platform, renewable energy use, GDPR compliance, and no-vendor-lock-in open source approach.
  Relevance: Primary source confirming Elastx infrastructure is powered by renewable energy at all Stockholm data centres, all within EU jurisdiction.
• Elastx Sets the Standard for Green Cloud Providers other 5. September 2026
  Elastx announcement of Green Web Foundation certification confirming renewable energy (solar and wind) powers both infrastructure and services.
  Relevance: Directly confirms Elastx uses only renewable energy, certified by independent third party (Green Web Foundation). Data centres in Sweden = EU energy.