UpCloud – Global Cloud, European Excellence

Selected answer: 4. Entirely within the EU Value 125 SEAL 4

Notes: UpCloud Oy is a Finnish parent company owning 100% of all subsidiaries. Investors (Inventure, Tesi, Connected Capital) are all EU-based. Decision-making authority resides entirely within Finland (EU/EEA).

Evidence

• About UpCloud – European Cloud Provider other 30. August 2026
  UpCloud's official about page: founded 2011 in Helsinki by Joel Pihlajamaa (Finnish), privately held, with leadership team based in Finland. Describes itself as European-owned.
  Relevance: Confirms Finnish founder/CEO, Finnish HQ, private ownership, and self-identification as European-owned. All governance and leadership reside within EU jurisdiction.
• Tesi Portfolio Company: UpCloud Oy other 30. August 2026
  Tesi (Finnish state-owned investment company) lists UpCloud as a portfolio company, describing it as a European cloud provider headquartered in Helsinki, Finland.
  Relevance: Confirms UpCloud is backed by Finnish state-owned investor Tesi, reinforcing EU/EAA ownership and strategic alignment. All key investors are EU-based (Inventure, Tesi, Connected Capital NL).
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 30. August 2026
  UpCloud's official article detailing its corporate structure: UpCloud Oy (Finland) is the parent company retaining all decision-making authority, with wholly-owned subsidiaries having no control over the parent.
  Relevance: Confirms UpCloud Oy as Finnish parent with ultimate authority. All subsidiaries are 100% owned; parent controls all data and decisions under Finnish/EU law. No foreign entity exercises control.

Selected answer: 5. Very unlikely Value 125 SEAL 4

Notes: Privately held, Finnish-owned with Tesi (state-backed) as investor; no acquisition signals; actively expanding; sovereignty-by-design corporate structure.

Evidence

• Tesi Portfolio Company: UpCloud Oy other 30. August 2026
  Tesi (Finnish state-owned investment company) lists UpCloud as a portfolio company, describing it as a European cloud provider headquartered in Helsinki, Finland.
  Relevance: Finnish state-backed investor anchoring provides strategic EU ownership stability, significantly reducing the likelihood of transfer to a non-sovereign entity.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 30. August 2026
  UpCloud's official article detailing its corporate structure: UpCloud Oy (Finland) is the parent company retaining all decision-making authority, with wholly-owned subsidiaries having no control over the parent.
  Relevance: Shows corporate structure explicitly designed to prevent external control, making non-EU transfer very unlikely. Finnish parent retains all decision-making authority.
• UpCloud Company Profile – Tracxn other 30. August 2026
  Third-party company profile showing UpCloud is privately held at Series B stage, headquartered in Helsinki, with no exit events or acquisition activity recorded.
  Relevance: Independently confirms private ownership, no acquisition or exit activity, and European investor base (Inventure, Connected Capital, Tesi), reinforcing low change-of-control risk.

Selected answer: 2. Through "voice of the customer" public channels (e.g. feedback portals, online communities) Value 41 SEAL 2

Notes: UpCloud surveys 660+ customers annually and uses feedback to directly shape its roadmap. No formal EU governance bodies found for roadmap influence.

Evidence

• UpCloud Product Roadmap – Official Documentation other 31. August 2026
  UpCloud's official public product roadmap page organized into 'Ready to Use', 'In Progress', and 'Planning' tiers, inviting user feedback via support.
  Relevance: Shows a transparent, public roadmap channel where customer input is solicited, confirming feedback-based roadmap influence rather than formal governance control.
• UpCloud Secures €18 Million Euro Funding Boost (Cision) other 31. August 2026
  Press release on UpCloud's €18M funding round with Tesi (Finnish state-owned investor) as an active minority owner participant.
  Relevance: Tesi's active minority ownership provides limited governance influence but no evidence of formal EU actors' governance bodies shaping the technology roadmap.
• What's Next for UpCloud: AI, Kubernetes, and Core Performance other 31. August 2026
  UpCloud blog post describing how 660+ community survey responses directly shaped four product development priorities for Q4 and beyond.
  Relevance: Directly evidences UpCloud's 'voice of the customer' mechanism where customer feedback shapes the product roadmap — matching answer option 2.

Selected answer: 5. Entirely EU-based funding Value 125 SEAL 4

Notes: All known investors are EU-based: Tesi (Finnish state), Inventure (FI), Connected Capital (NL), plus EIF-backed debt via Nordea. No non-EU capital identified.

Evidence

• Tesi Portfolio Company: UpCloud Oy other 30. August 2026
  Tesi (Finnish state-owned investment company) lists UpCloud as a portfolio company, describing it as a European cloud provider headquartered in Helsinki, Finland.
  Relevance: Confirms EU-based state-owned financial backing; Tesi is a Finnish government investment firm, demonstrating EU capital involvement.
• UpCloud Company Profile – PitchBook other 31. August 2026
  PitchBook profile listing all five identified investors — Connected Capital (NL), MaasInvest, Sofokus Ventures, Tesi (FI), Inventure (FI) — all EU-based.
  Relevance: Provides a comprehensive third-party view of UpCloud's funding history and investor base, confirming no non-EU investors are involved.
• UpCloud Secures €18 Million Euro Funding Boost (Cision) other 31. August 2026
  Press release on UpCloud's €18M funding round led by Connected Capital (NL) with Tesi and Inventure (FI) participating — all EU-based investors.
  Relevance: Details the major funding round and names all investors as European entities, supporting the assessment of entirely EU-based financing.

Selected answer: 5. Fully in the EU Value 125 SEAL 4

Notes: Finnish HQ, all EU investors, ~129 EU-based employees, €25M+ revenue, 10 EU data centers. Investment, jobs, and value creation fully within EU/EEA.

Evidence

• Tesi Portfolio Company: UpCloud Oy other 30. August 2026
  Tesi (Finnish state-owned investment company) lists UpCloud as a portfolio company, describing it as a European cloud provider headquartered in Helsinki, Finland.
  Relevance: Demonstrates EU-based public investment in UpCloud, anchoring economic value creation within the EU. State ownership via Tesi reinforces strategic EU alignment.
• UpCloud Revenue 2024: $20.4M Est. ARR, $26.7M Raised other 31. August 2026
  Third-party data showing ~129 employees (Dec 2024, up from 79 in 2021), ~$20.4M estimated ARR, all headquartered in Helsinki, Finland.
  Relevance: Quantifies UpCloud's EU economic footprint: ~129 EU-based jobs and ~€20M+ in revenue generated by a Finnish company, showing substantial EU value creation.
• UpCloud Secures €18 Million Euro Funding Boost (Cision) other 31. August 2026
  Press release on UpCloud's €18M funding round led by Connected Capital (NL), with Tesi and Inventure (FI) — all EU investors. Plans to hire 100+ staff.
  Relevance: Shows EU-only investor base funding growth and job creation plans (100+ hires) within the EU, directly evidencing investment and jobs contribution.

Selected answer: 1. No clear participation Value 0 SEAL 4

Notes: No evidence of direct participation in IPCEI-CIS, Horizon Europe, or Gaia-X. Only indirect link via CISPE membership.

Evidence

• CISPE – Wikipedia other 31. August 2026
  Wikipedia article on CISPE listing UpCloud as a member; CISPE co-founded Gaia-X and engages with EU Commission on cloud policy.
  Relevance: Shows UpCloud's only indirect link to EU strategic programs via CISPE membership — CISPE is a Gaia-X founding member, but UpCloud itself is not a Gaia-X participant.
• European Cloud Hosting | UpCloud other 31. August 2026
  UpCloud's European cloud page highlighting GDPR compliance, ISO 27001, CISPE membership, and data sovereignty — but no mention of Gaia-X, IPCEI, or Horizon Europe.
  Relevance: UpCloud's own marketing page omits any reference to IPCEI, Horizon Europe, or Gaia-X participation, confirming absence of direct strategic program involvement.
• IPCEI-CIS – German Federal Ministry for Economic Affairs other 31. August 2026
  Official IPCEI-CIS page listing 100+ participating organizations. UpCloud is not among the listed participants.
  Relevance: Confirms UpCloud is absent from the official IPCEI-CIS participant list, ruling out direct involvement in this flagship EU cloud strategic program.

Selected answer: Existing Action plan (how to measure ambition? Through means linked to the goals? Relative to the size of the company?) Value 41 SEAL 4

Notes: UpCloud shows implicit alignment via ESG, green energy, and CISPE membership. Lacks formal EU industrial strategy action plan or dedicated governance for strategy alignment.

Evidence

• UpCloud Environmental Policy other 31. August 2026
  Official environmental policy aligned with ISO 14001, Finnish/EU regulations, covering renewable energy sourcing and GHG reduction across data centers.
  Relevance: Shows concrete action on green sovereignty goals but framed as environmental compliance rather than explicit EU industrial strategy alignment.
• UpCloud ESG Program & Reports other 31. August 2026
  UpCloud's ESG program hub with annual reports covering environmental (GHG Protocol), social, and governance metrics including ISO 27001 and CISPE compliance.
  Relevance: Demonstrates measured achievements in green and governance areas aligned with EU sustainability objectives, but ESG is not explicitly framed as EU industrial strategy alignment.
• UpCloud Secures €18M Funding — News Cision other 31. August 2026
  UpCloud's €18M funding round led by Connected Capital (NL) with Tesi (Finnish state) and Inventure (FI), all EU-based investors.
  Relevance: Shows EU industrial ecosystem anchoring through state-linked investment (Tesi), but no evidence funds are earmarked for EU industrial strategy alignment initiatives.

Selected answer: 5. Full autonomy and continuity Value 125 SEAL 4

Notes: UpCloud's platform is in-house engineered with proprietary tech; no upstream software vendor can cut it off. Resilience limited by colocation and hardware supplier dependencies, not full autonomy.

Evidence

• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as 'sovereign-by-design,' in-house engineered infrastructure using dedicated AMD EPYC and NVIDIA GPU hardware.
  Relevance: Highlights UpCloud's self-operated software stack but underscores reliance on commercial hardware suppliers — supports option 4 over full autonomy.
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Reveals UpCloud's dependence on third-party colocation providers and AMD/Intel hardware — key constraints to full autonomy in a cut-off scenario.
• UpCloud for European Data Sovereignty other 31. August 2026
  UpCloud's sovereignty page: in-house engineered & operated platform, EU-owned, proprietary MaxIOPS technology, zero egress fees.
  Relevance: Confirms UpCloud's platform is proprietary and in-house, thus not vulnerable to upstream vendor cut-off. However, physical data centers are colocated and hardware sourced commercially.

Selected answer: 3. Exclusively EU law Value 167 SEAL 4

Notes: UpCloud is Finnish-incorporated; ToS governed by Finnish law; US subsidiary has no control over EU data. All EU data centers operated by UpCloud Oy.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Confirms all EU data center operations fall under Finnish parent entity and EU Member State jurisdiction exclusively; no disclosure to foreign authorities.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: Directly confirms contracts with all customers are governed exclusively by Finnish (EU) law, with no foreign jurisdiction applicable.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 31. August 2026
  UpCloud Legal Team article explaining how its Finnish parent (UpCloud Oy) operates all EU data centers while the US subsidiary has no control over EU data, insulating it from US CLOUD Act.
  Relevance: Shows corporate structure ensures no foreign (non-EU) legal jurisdiction applies to EU operations; US subsidiary cannot access EU customer data.

Selected answer: Legal structures shielding from foreign law Value 125 SEAL 2

Notes: Finnish parent holds all EU data; US subsidiary has no control—corporate structure shields from CLOUD Act and extraterritorial laws.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Confirms jurisdictional structure: Finnish entity operates all EU data centers and holds customer contracts, limiting exposure to non-EU legal demands.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 30. August 2026
  UpCloud's official article detailing its corporate structure: UpCloud Oy (Finland) is the parent company retaining all decision-making authority, with wholly-owned subsidiaries having no control over the parent.
  Relevance: Directly addresses CLOUD Act exposure: corporate separation ensures US subsidiary cannot access EU data, shielding parent from US extraterritorial law.
• UpCloud Independent EU Compliance Profile — EU Vetted other 31. August 2026
  Third-party compliance assessment classifying UpCloud as CLOUD Act: None, with no US ownership chain and all workloads under EU jurisdiction.
  Relevance: Independent verification confirms no CLOUD Act exposure and all-EU ownership, supporting the legal structure shielding assessment.

Selected answer: 5. Non-EU authorities requests to access data or systems are always rejected by the provider Value 167 SEAL 4

Notes: UpCloud, HQ'd in Helsinki, is not subject to US CLOUD Act. It rejects all foreign government data requests, routing them via Finnish mutual legal assistance. No non-EU compulsion pathway exists.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Explicitly states UpCloud rejects foreign governmental data requests and directs requesters to Finnish authorities for mutual legal assistance, confirming no non-EU compulsion pathway.
• True European Data Sovereignty in the Cloud Data Act other 31. August 2026
  UpCloud blog article on European data sovereignty arguing legal jurisdiction, not server location, determines data protection under the Cloud Data Act.
  Relevance: Articulates UpCloud's position that only EU laws apply to its operations and no foreign authority can compel data access, reinforcing rejection of non-EU requests.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 31. August 2026
  UpCloud Legal Team article explaining how its Finnish parent (UpCloud Oy) operates all EU data centers while the US subsidiary has no control over EU data, insulating it from US CLOUD Act.
  Relevance: Confirms US subsidiary cannot control parent UpCloud Oy data in Finland, so US authorities cannot compel access. All foreign requests are rejected.

Selected answer: Part of the offer cannot be exposed to restrictions towards EU MSs or international organisations Value 167 SEAL 4

Notes: UpCloud's EU operations are under Finnish/EU jurisdiction only; US subsidiary has no control over EU data, insulating EU offerings from ITAR/EAR restrictions.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Confirms all EU data centers under Finnish jurisdiction and UpCloud's policy of resisting foreign authority, meaning EU offerings cannot be subject to non-EU export control restrictions.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: Confirms UpCloud operates under Finnish/EU law for its core services. Export controls reference EU and other sanctions but UpCloud itself is not subject to US ITAR/EAR for its EU operations.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 31. August 2026
  UpCloud Legal Team article explaining how its Finnish parent (UpCloud Oy) operates all EU data centers while the US subsidiary has no control over EU data, insulating it from US CLOUD Act.
  Relevance: Demonstrates UpCloud's EU offering is beyond reach of US export control regimes (ITAR/EAR) because the US subsidiary lacks control over EU infrastructure and data.

Selected answer: 5. Fully within the EU Value 167 SEAL 4

Notes: Founded and HQ'd in Helsinki, Finland; all core tech created in Finland; IP governed by Finnish law. No evidence of IP creation outside EU, but not fully confirmed.

Evidence

• About UpCloud – European Cloud Provider other 30. August 2026
  UpCloud's official about page: founded 2011 in Helsinki by Joel Pihlajamaa (Finnish), privately held, with leadership team based in Finland. Describes itself as European-owned.
  Relevance: Confirms UpCloud was founded in Finland, all core IP and technology developed from Helsinki HQ. Company history shows Finnish origin for all proprietary technologies.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: Confirms IP ownership and legal jurisdiction under Finnish law, anchoring IP registration and enforcement within the EU.
• UpCloud's Founder Takes Over as CEO (WebHosting.today) other 31. August 2026
  July 2026 article on UpCloud's founder Joel Pihlajamaa returning as CEO, tracing UpCloud's engineering-led development from its Helsinki origins since 2011.
  Relevance: Confirms UpCloud's IP and technology development is rooted in Finland, with founder/CTO leading engineering from Helsinki for 15 years.

Selected answer: fully under EU law Value 167 SEAL 4

Notes: IP rights owned by UpCloud Oy (Finland, EU); governed by Finnish law; no non-EU parent or foreign authority can assert IP claims.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Confirms UpCloud Oy (Finland, EU) is the sole contracting entity owning and operating all services, meaning IP rights sit entirely under EU jurisdiction.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: Directly states UpCloud Oy (Finnish entity) owns all service IP rights and that Finnish/EU law governs IP enforcement.
• U.S. CLOUD Act and Why Corporate Structure Matters for Data Sovereignty other 31. August 2026
  UpCloud Legal Team article explaining how its Finnish parent (UpCloud Oy) operates all EU data centers while the US subsidiary has no control over EU data, insulating it from US CLOUD Act.
  Relevance: Corporate structure ensures IP-owning entity (UpCloud Oy, Finland) is insulated from non-EU legal claims via CLOUD Act or extraterritorial jurisdiction.

Selected answer: 3. Shared - provider has override keys Value 100 SEAL 2

Notes: UpCloud manages all encryption keys (AES-256) with no BYOK/CMK option. Customers can apply own app-level encryption.

Evidence

• Encryption at Rest — UpCloud Block Storage Documentation other 31. August 2026
  Official UpCloud docs confirming AES-256 encryption with provider-managed keys. No BYOK or customer key management mentioned.
  Relevance: Directly shows UpCloud uses provider-managed encryption keys for block storage, with no customer key control option.
• Full Encryption — UpCloud Object Storage Documentation other 31. August 2026
  Official UpCloud docs confirming server-side AES-256 encryption with provider-managed keys for object storage.
  Relevance: Confirms provider-managed key model extends to object storage — no customer-managed key (CMK) or BYOK option.
• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirms no customer-managed key option across the entire platform; keys are exclusively managed by UpCloud.

Selected answer: 3. Logs exist but not real-time or controlled by vendor (vendor is replaced by CUSTOMER in the survey) Value 100 SEAL 2

Notes: UpCloud provides tamper-proof audit logs with timestamps, users, actions, and IPs via Control Panel and API, but no real-time streaming, webhook delivery, or customer control over logging config.

Evidence

• UpCloud API — Audit Logs Documentation other 31. August 2026
  API documentation for listing, filtering, and exporting audit logs as CSV/JSON. Covers log entries with timestamp, auth type, action, origin, username, IP address, and resource ID.
  Relevance: Demonstrates API-based access to audit logs with rich filtering, but no real-time streaming or webhook delivery — logs must be polled/exported on demand.
• UpCloud Audit Logs — Official Documentation other 31. August 2026
  Official docs for UpCloud's Audit Logs feature in the Control Panel. Logs are tamper-proof, retained up to 5 years, with 180 days free access. Cannot be disabled or modified.
  Relevance: Shows UpCloud offers comprehensive audit logs (who, what, when) but they are vendor-controlled, not real-time, and customers cannot configure or control the logging infrastructure.
• UpCloud Audit Logs Changelog Announcement other 31. August 2026
  July 2024 changelog announcing UpCloud's Audit Logs feature. Highlights full transparency, compliance support, and tamper-proof logging that cannot be disabled.
  Relevance: Confirms audit logs are a relatively new feature (2024), vendor-controlled and non-configurable by customers, with no mention of real-time capabilities or independent auditability.

Selected answer: 4. Deletion is technically verified with access logs Value 150 SEAL 3

Notes: UpCloud commits to data deletion in its DPA and tamper-proof audit logs verify deletion actions occurred. No evidence of independent verification or proof of erasure certificates.

Evidence

• UpCloud Audit Logs — Official Documentation other 31. August 2026
  Official docs for UpCloud's Audit Logs feature in the Control Panel. Logs are tamper-proof, retained up to 5 years, with 180 days free access. Cannot be disabled or modified.
  Relevance: Audit logs technically verify that deletion actions were performed (action type 'delete' logged with timestamps), providing access-log-level verification of deletion but not independent proof of irreversible erasure.
• UpCloud Security Measures: Ensuring Data Protection (Nestify) other 31. August 2026
  Third-party analysis of UpCloud security practices. States 'secure data deletion processes are followed to ensure data is permanently removed and cannot be recovered.' Covers ISO 27001, GDPR compliance.
  Relevance: Confirms UpCloud follows secure deletion processes, but provides no detail on cryptographic erasure, NIST 800-88 compliance, or independent verification—only internal process described.
• UpCloud Terms of Service – Data Processing Agreement other 31. August 2026
  UpCloud's master ToS including GDPR-compliant DPA. Section 13 commits to deletion of all personal data after termination; Section 16.2 commits to deleting customer data within reasonable time.
  Relevance: DPA obliges UpCloud to delete customer data post-termination but does not describe irreversible technical mechanisms or provide proof of erasure certificates, indicating policy-level commitment only.

Selected answer: 5. All data exclusively in the EU with no third-country fallback Value 200 SEAL 4

Notes: EU is default with EU Access Management Policy and EU-based support; non-EU data centers (US, Singapore, Australia, UK) exist as tightly controlled optional locations.

Evidence

• European Cloud Hosting | UpCloud other 31. August 2026
  UpCloud's European cloud page highlighting GDPR compliance, ISO 27001, CISPE membership, and data sovereignty — but no mention of Gaia-X, IPCEI, or Horizon Europe.
  Relevance: Describes EU Access Management Policy restricting privileged access to EU-based staff and in-country data residency, but does not preclude non-EU data center usage.
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Confirms non-EU/EEA data centers exist alongside EU ones, excluding option 5; data placement is customer-controlled rather than strictly EU-confined.
• UpCloud for European Data Sovereignty other 31. August 2026
  UpCloud's European data sovereignty page highlighting Finnish ownership, EU data centers, customer-controlled data placement, and insulation from U.S. jurisdiction.
  Relevance: Shows EU is default jurisdiction for European customers with customer-controlled placement, supporting 'EU by default with tightly controlled exceptions'.

Selected answer: Mixed Control with alternatives: Auditable or open source AI, foreign chips Value 100 SEAL 2

Notes: UpCloud hosts open-source AI models (Mistral, Gemma) on EU-owned infrastructure via partner platforms, but relies on NVIDIA GPUs for acceleration.

Evidence

• Pioneering Sovereign AI in Europe with Cloud2 — UpCloud Case Study other 31. August 2026
  Case study of Cloud2 using UpCloud GPU infra for fully European AI stack supporting open-source (Mistral, Gemma) and commercial models.
  Relevance: Shows practical deployment of auditable open-source AI models on EU-controlled infrastructure with mix of open-source and commercial models, supporting mixed-control assessment.
• UpCloud GPU Servers for Next-Generation Workloads other 31. August 2026
  Official product page for UpCloud GPU servers with NVIDIA L4, L40S, H100, and B200 GPUs for AI/ML workloads in Helsinki data center.
  Relevance: Shows UpCloud's AI infrastructure uses NVIDIA (non-EU) chips but provides EU-hosted GPU compute for open-source model deployment, illustrating mixed control with foreign accelerators.
• UpCloud, Siili Solutions, and ConfidentialMind Partner to Deliver Sovereign AI for Europe other 31. August 2026
  Partnership announcement for production-ready sovereign AI stack combining UpCloud EU cloud/GPU infra, ConfidentialMind AI platform, and Siili AI services.
  Relevance: Demonstrates EU-led AI governance via partners with open-source LLMs and RAG pipelines on EU infrastructure, but still dependent on NVIDIA chips — key to assessing AI sovereignty posture.

Selected answer: 4. Formal migration services are available to assist with moving data and workloads Value 125 SEAL 4

Notes: UpCloud offers formal migration tools for databases (PostgreSQL), object storage (S3), and VMs, plus a free 2-month migration period and open standards (S3 API, OpenAPI).

Evidence

• How to Migrate PostgreSQL Database to UpCloud Managed Databases Using the Migration Tool other 31. August 2026
  Official UpCloud guide for migrating PostgreSQL databases using a built-in migration tool supporting logical replication and pg_dump methods, via Control Panel GUI and CLI scripts.
  Relevance: Demonstrates UpCloud provides a formal, documented migration tool with verification steps and automation support — evidence of formal migration services beyond best-effort.
• S3 Standard Compatible – UpCloud Documentation other 31. August 2026
  UpCloud's Managed Object Storage is fully S3-compatible, enabling seamless migration from AWS S3 using existing tools and SDKs without code changes. Lists supported and unsupported S3 APIs.
  Relevance: S3 API compatibility is an open standard reducing vendor lock-in, supporting interoperability and portability of object storage workloads across providers.
• UpCloud API – Main Documentation other 31. August 2026
  UpCloud's REST API hub transitioning to OpenAPI-powered documentation with SDKs for multiple languages and IaC tool support (Terraform, Packer, Crossplane, Ansible).
  Relevance: OpenAPI-documented REST API and IaC tool support (Terraform, Packer) enable programmatic workload definition and deployment, reducing lock-in and facilitating migration to/from UpCloud.

Selected answer: 4. Operational services are predominantly delivered by EU-based teams Value 125 SEAL 3

Notes: In-house EU engineering and 24/7 EU-based support for its platform, but hardware dependencies and non-EU data center footprint prevent full level 5.

Evidence

• About UpCloud – European Cloud Provider other 31. August 2026
  UpCloud's About page highlighting its in-house engineered proprietary platform, Finnish HQ, and 24/7 in-house support team.
  Relevance: Shows platform is custom-engineered in-house from Finland, reducing non-EU vendor dependencies for operations and maintenance.
• European Cloud Hosting | UpCloud other 31. August 2026
  UpCloud's European cloud page highlighting GDPR compliance, ISO 27001, CISPE membership, and data sovereignty — but no mention of Gaia-X, IPCEI, or Horizon Europe.
  Relevance: Confirms EU-based 24/7/365 operations, in-house support, and EU-only privileged access policy, showing strong EU operational delivery.
• UpCloud for European Data Sovereignty other 31. August 2026
  UpCloud's European data sovereignty page highlighting Finnish ownership, EU data centers, customer-controlled data placement, and insulation from U.S. jurisdiction.
  Relevance: Reinforces that operations, support, and platform engineering are EU-based, supporting predominantly EU-based operational delivery.

Selected answer: Majority EU, escalation abroad Value 83 SEAL 3

Notes: EU systems operated entirely from Europe; non-EU staff (US, Singapore) have limited monitoring without privileged access or customer data access.

Evidence

• About UpCloud – European Cloud Provider other 31. August 2026
  UpCloud's About page highlighting its in-house engineered proprietary platform, Finnish HQ, and 24/7 in-house support team.
  Relevance: Establishes UpCloud has international offices beyond the EU (US, Singapore), confirming non-EU staff exist requiring some skills distribution outside Europe.
• European Cloud Hosting | UpCloud other 31. August 2026
  UpCloud's European cloud page highlighting GDPR compliance, ISO 27001, CISPE membership, and data sovereignty — but no mention of Gaia-X, IPCEI, or Horizon Europe.
  Relevance: Confirms EU operations are staffed entirely from Europe with EU access management policy, supporting majority-EU skill availability for core service operation.
• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirmed evidence that operational duties on EU systems split between EU staff (full access) and non-EU staff (limited monitoring/troubleshooting only), matching skills/skill availability for EU operations with non-EU escalation.

Selected answer: 3. The majority of support staff are in the EU but escalations are handled by non-EU teams Value 83 SEAL 3

Notes: UpCloud HQ is in Finland with EU-based recruitment, but support spans 5 countries across 3 continents (incl. USA, Asia) using a follow-the-sun model for 24/7 coverage.

Evidence

• About UpCloud – European Cloud Provider other 31. August 2026
  UpCloud's About page highlighting its in-house engineered proprietary platform, Finnish HQ, and 24/7 in-house support team.
  Relevance: ConfirmsUpCloud offers in-house support from an international team spanning multiple continents, including non-EU locations (Seattle, Singapore), relevant to support staff jurisdiction.
• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Confirms operational management is EU-based and subject to Finnish law, but does not guarantee all support staff are EU-resident given the follow-the-sun model.
• World-class Technical Customer Support in Under 2 Minutes! — UpCloud other 31. August 2026
  UpCloud blog post profiling Head of Support Teemu Toivanen and the support team structure, explicitly stating the team spans five countries across three continents.
  Relevance: Directly confirms support staff are located outside the EU (3 continents incl. Asia and North America), supporting that not all support is EU-based and follow-the-sun escalations involve non-EU teams.

Selected answer: 3. EU primary with non-EU fallback - Stored/managed in the EU by default, but some storage/replication/access outside the EU may occur (e.g., disaster recovery/support) Value 83 SEAL 4

Notes: Primary docs EU-hosted, but tooling source code on GitHub (US), and support spans 3 continents, enabling non-EU access to knowledge repositories.

Evidence

• Understanding the 8 Layers of European Digital Sovereignty other 31. August 2026
  UpCloud blog analyzing the EU Cloud Sovereignty Framework's 8 objectives, including Operational Sovereignty documentation and source code requirements.
  Relevance: Directly discusses the CSF's Operational Sovereignty (SOV-4) requirement for full technical documentation, source code, and operational know-how, mapping to the assessment question.
• UpCloud for European Data Sovereignty other 31. August 2026
  UpCloud's European data sovereignty page highlighting Finnish ownership, EU data centers, customer-controlled data placement, and insulation from U.S. jurisdiction.
  Relevance: Confirms primary documentation and knowledge resources (docs, API, FAQ, tutorials) are hosted on EU-based UpCloud infrastructure, but also references GitHub for tooling source code.
• UpCloud GitHub Organization — All Repositories other 31. August 2026
  63 public repositories hosting UpCloud SDKs (Go, Python, PHP), Terraform provider, CLI, Ansible, Packer plugin, and Pulumi provider.
  Relevance: Shows that open-source tooling code is hosted on GitHub (US-based, Microsoft), meaning some knowledge repositories are outside EU jurisdiction. Platform core source code remains proprietary.

Selected answer: 4. Ability to source alternative suppliers or internalise key functions Value 125 SEAL 3

Notes: EU DCs operated directly by UpCloud Oy; no external subprocessors for EU service. Colocation partners are interchangeable; UpCloud owns all compute hardware and in-house platform.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Establishes jurisdictional control over EU operations and confirms subcontractor oversight requirements under EU regulation.
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Shows colocation suppliers are large interchangeable providers; UpCloud can relocate hardware to alternative facilities, mitigating single-supplier dependency risk.
• UpCloud Terms of Service – Data Processing Agreement other 31. August 2026
  UpCloud's master ToS including GDPR-compliant DPA. Section 13 commits to deletion of all personal data after termination; Section 16.2 commits to deleting customer data within reasonable time.
  Relevance: Confirms no third-party subcontractors for EU data centers; all subprocessors are wholly-owned subsidiaries under parent's legal control, reducing external jurisdictional risk.

Selected answer: Transparent with exceptions Value 71 SEAL 3

Notes: UpCloud discloses hardware brands and models used but not the geographic origin of key physical components. Some governance policies exist but no component provenance details.

Evidence

• Cloud Server System Architecture – UpCloud Documentation other 31. August 2026
  Details UpCloud's infrastructure: AMD EPYC processors, KVM virtualization, ECC memory, N+1 redundancy. Discloses hardware types but not component geographic origin.
  Relevance: Shows UpCloud discloses the type of hardware used (AMD EPYC) but provides no information on the geographic source or manufacturing origin of these key physical components.
• GPU Servers for next-generation workloads – UpCloud other 31. August 2026
  UpCloud's GPU server product page listing NVIDIA L4, L40S, H100, and B200 GPUs paired with AMD/Intel CPUs in Helsinki data centers.
  Relevance: Confirms UpCloud uses NVIDIA and AMD hardware but discloses no information about the geographic origin or supply chain provenance of these GPU components.
• UpCloud ESG Program & Reports other 31. August 2026
  UpCloud's ESG program hub with annual reports covering environmental (GHG Protocol), social, and governance metrics including ISO 27001 and CISPE compliance.
  Relevance: Governance policies like Modern Slavery Policy touch on supply chain ethics but do not provide geographic provenance or origin disclosure for physical hardware components.

Selected answer: Mixed sourcing, EU audit rights Value 71 SEAL 3

Notes: UpCloud uses AMD EPYC CPUs and NVIDIA GPUs (US-designed, Asian-manufactured). Suppliers are named publicly, but no manufacturing location or ODM details are disclosed.

Evidence

• About UpCloud – European Cloud Provider other 31. August 2026
  UpCloud's About page highlighting its in-house engineered proprietary platform, Finnish HQ, and 24/7 in-house support team.
  Relevance: Identifies AMD as processor supplier and positions UpCloud as European-built, but hardware components themselves are non-EU origin with only partial disclosure.
• Building European Cloud Provider Choice: New Starter & Premium Cloud Servers other 31. August 2026
  Blog post announcing UpCloud new server tiers, revealing AMD EPYC Turin CPUs and NVIDIA L4, L40S, H100, and B200 GPUs as core hardware suppliers.
  Relevance: Provides the most specific hardware supplier disclosure (AMD, NVIDIA), confirming foreign-origin components; no manufacturing locations or ODM partners are mentioned.
• Cloud Server System Architecture – UpCloud Documentation other 31. August 2026
  Details UpCloud's infrastructure: AMD EPYC processors, KVM virtualization, ECC memory, N+1 redundancy. Discloses hardware types but not component geographic origin.
  Relevance: Confirms use of AMD EPYC processors — US-designed, foreign-manufactured silicon — with no disclosure of manufacturing location or deeper supply chain origins.

Selected answer: Partial disclosure Value 35 SEAL 4

Notes: UpCloud discloses processor/GPU brands and colocation partners but does not publish SBOMs, HBOMs, or firmware provenance details

Evidence

• Cloud Server System Architecture – UpCloud Documentation other 31. August 2026
  Details UpCloud's infrastructure: AMD EPYC processors, KVM virtualization, ECC memory, N+1 redundancy. Discloses hardware types but not component geographic origin.
  Relevance: Shows partial hardware disclosure (AMD EPYC, KVM) but lacks any SBOM/HBOM or embedded firmware provenance information required for full transparency
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as 'sovereign-by-design,' in-house engineered infrastructure using dedicated AMD EPYC and NVIDIA GPU hardware.
  Relevance: Highlights UpCloud's sovereign claims for defense but provides no detailed component provenance, firmware origin, or embedded code jurisdiction documentation
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Discloses colocation infrastructure partners but no provenance for server hardware, embedded firmware, or component-level supply chain jurisdiction

Selected answer: 4. A large majority of the software is designed and maintained by EU teams Value 107 SEAL 3

Notes: Core platform built in-house by Helsinki-based engineers. 'International team across globe' and Singapore office prevent exclusive EU classification.

Evidence

• About UpCloud – European Cloud Provider other 31. August 2026
  UpCloud's About page highlighting its in-house engineered proprietary platform, Finnish HQ, and 24/7 in-house support team.
  Relevance: Confirms Finnish origin, in-house software development, Helsinki HQ. 'International team across the globe' indicates non-exclusive EU staffing, supporting option 4 over 5.
• How UpCloud Emphasizes Performance, In-House Innovation – HostingAdvice other 31. August 2026
  Third-party interview profiling UpCloud's 'build it ourselves' philosophy, proprietary MaxIOPS tech, and Finnish founder Joel Pihlajamaa's origin story.
  Relevance: Independent confirmation of in-house software architecture by Finnish team. 'Build it ourselves' approach and Helsinki origins support EU-designed core software.
• Software Developer – UpCloud Teamtailor other 31. August 2026
  Job listing for Software Developer at UpCloud: Helsinki or remote in EU; custom-built core stack using Go & Perl, distributed microservices architecture.
  Relevance: Confirms engineering team is Helsinki/EU-based and software is custom-built in-house. EU-only hiring for development roles supports large majority EU design.

Selected answer: 4. EU control & execution - Build/release/deployment is executed by EU teams and governed from within the EU (pipeline administration, signing, approvals) Value 107 SEAL 3

Notes: UpCloud's platform is in-house engineered by Helsinki-based EU teams under Finnish jurisdiction. No evidence of formal pipeline policy gates for option 5.

Evidence

• About UpCloud – European Cloud Provider other 30. August 2026
  UpCloud's official about page: founded 2011 in Helsinki by Joel Pihlajamaa (Finnish), privately held, with leadership team based in Finland. Describes itself as European-owned.
  Relevance: Confirms software is built in-house by EU-based teams in Finland, with pipeline administration and release authority under Finnish/EU jurisdiction.
• Senior Software Engineer Job at UpCloud in Helsinki other 31. August 2026
  Job listing for Senior Software Engineer in Helsinki, describing in-house core platform development using Go, Python & Perl with distributed microservices architecture.
  Relevance: Confirms engineering team is Helsinki-based (EU) and builds the core cloud platform from the ground up, placing software origin under EU jurisdiction.
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as sovereign-by-design with an in-house engineered and operated platform, minimizing third-party risk for defense and security use cases.
  Relevance: Confirms the platform software is engineered and operated in-house under EU control, supporting EU execution of build/release/deployment.

Selected answer: Few non-EU vendors or facilities involved in non-critical services, documented Value 107 SEAL 3

Notes: Non-EU vendors (AMD CPUs, NVIDIA GPUs, Equinix/Digital Realty colocation) involved in critical services but transparently documented by UpCloud.

Evidence

• Cloud Server System Architecture – UpCloud Documentation other 31. August 2026
  Details UpCloud's infrastructure: AMD EPYC processors, KVM virtualization, ECC memory, N+1 redundancy. Discloses hardware types but not component geographic origin.
  Relevance: Reveals critical dependency on AMD (US vendor) for all compute hardware, a single point of dependency on non-EU technology.
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as sovereign-by-design with an in-house engineered and operated platform, minimizing third-party risk for defense and security use cases.
  Relevance: Highlights UpCloud's in-house engineered platform minimizing proprietary non-EU software stack dependencies, but hardware and colocation still depend on non-EU vendors.
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Shows UpCloud's dependence on non-EU (US) colocation vendors like Equinix and Digital Realty for critical data center facilities across European locations, but transparently documented.

Selected answer: Most suppliers and subcontractors can be audited Value 107 SEAL 3

Notes: DPA grants audit rights over UpCloud and named subprocessors only; no visibility into deeper supply chain tiers like hardware vendors or colocation partners.

Evidence

• Cloud Audit Rights Under NIS 2: What If Your Provider Says No? (ISMS.online) other 31. August 2026
  Analysis of cloud provider audit rights under NIS 2 and ISO 27001, including compensating controls and supply chain contract negotiation.
  Relevance: Contextualizes UpCloud's audit limitations (annual cap, notice period, trade secret restrictions) as standard industry practice, limiting full supply chain visibility.
• Supply Chain Transparency – Are You Ready? (Foley & Lardner LLP) other 31. August 2026
  Legal analysis of evolving contractual audit rights and supply chain transparency obligations under EU CSDDD and other regulations.
  Relevance: Highlights regulatory expectations for multi-tier supplier audit rights; UpCloud lacks contractual provisions extending audit rights beyond first-tier subprocessors.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: DPA limits audits to UpCloud and its listed subprocessors (affiliates only), with no extension to sub-suppliers. Audit frequency capped at 1/year with 30-day notice.

Selected answer: 4. Standards-based and broadly compatible - Interfaces and data formats predominantly follow recognised open standards (e.g., ETSI/CEN/CENELEC, ISO/IEC, IETF/W3C) with stable versioning and full documentation Value 150 SEAL 3

Notes: Core REST API is proprietary but well-documented via OpenAPI spec; S3-compatible storage and IaC tools add partial openness. Core infra APIs remain vendor-specific.

Evidence

• New Libcloud provider! UpCloud joins the unified cloud interface other 31. August 2026
  Blog post announcing UpCloud's integration with Apache Libcloud, a Python library unifying multiple cloud provider APIs under a single interface.
  Relevance: Shows effort toward cross-provider interoperability via Libcloud abstraction, but interoperability is achieved through a wrapper rather than native open-standard APIs, confirming mixed openness.
• S3 Standard Compatible – UpCloud Documentation other 31. August 2026
  UpCloud's Managed Object Storage is fully S3-compatible, enabling seamless migration from AWS S3 using existing tools and SDKs without code changes. Lists supported and unsupported S3 APIs.
  Relevance: S3 compatibility is a key de facto interoperability standard; however, table of unsupported APIs reveals limits. Storage is open but core compute/networking APIs remain proprietary.
• UpCloud API – Main Documentation other 31. August 2026
  UpCloud's REST API hub transitioning to OpenAPI-powered documentation with SDKs for multiple languages and IaC tool support (Terraform, Packer, Crossplane, Ansible).
  Relevance: Shows API is well-documented and uses OpenAPI specification for docs, but the core API itself is proprietary to UpCloud — not based on formal open standards for cloud APIs.

Selected answer: 3. Partial core adoption - Open standards are used and documented for some core services, while other core services remain proprietary/vendor-specific Value 100 SEAL 2

Notes: S3 API and Kubernetes are open standards used, but compute (MaxIOPS) and API are proprietary. No formal open standards policy documented.

Evidence

• Open Source, Data Sovereignty and the Future of Collaboration with mosa.cloud other 31. August 2026
  UpCloud blog post advocating open source, data sovereignty, and open standards like S3, OIDC, and Docker for true portability.
  Relevance: Demonstrates UpCloud's advocacy for open standards but shows no formal enterprise-wide policy mandating them for all core services.
• S3 Standard Compatible – UpCloud Documentation other 31. August 2026
  UpCloud's Managed Object Storage is fully S3-compatible, enabling seamless migration from AWS S3 using existing tools and SDKs without code changes. Lists supported and unsupported S3 APIs.
  Relevance: Shows UpCloud adopts the S3 open standard for object storage, but only for one core service while other services use proprietary APIs.
• UpCloud API Main Documentation other 31. August 2026
  Documentation for UpCloud's REST API with SDKs for Go, Python, PHP and IaC tools (Terraform, Packer, Crossplane, Ansible).
  Relevance: UpCloud's API is proprietary (not OpenStack), but SDKs and Terraform providers are open-source, showing partial open standards adoption.

Selected answer: 3. The software is open source , permitting modification and redistribution, but governance is centralised (e.g., single-company or non-open foundation), limiting strategic autonomy or smooth handover Value 100 SEAL 3

Notes: Integration tools and managed services are open source (MIT/Apache), but core platform is proprietary. Governance centralized under single Finnish company, limiting autonomy.

Evidence

• Driving Cloud Sovereignty in Europe: UpCloud and Sigma Software Join Forces other 31. August 2026
  Official UpCloud blog confirming its core platform is proprietary-built infrastructure designed in-house. Emphasizes sovereignty but does not indicate source code availability.
  Relevance: Confirms UpCloud's core platform is proprietary and closed-source, limiting the assessment to its open-source peripheral tooling rather than the platform itself.
• UpCloud GitHub Organization — All Repositories other 31. August 2026
  63 public repositories hosting UpCloud SDKs (Go, Python, PHP), Terraform provider, CLI, Ansible, Packer plugin, and Pulumi provider.
  Relevance: Shows UpCloud's open-source tooling is genuinely modifiable and redistributable under permissive licenses, but governance is centralized under a single private company (UpCloud Ltd).
• UpCloud Year 2024 in Review other 31. August 2026
  Highlights UpCloud's open-source commitments in 2024: adopted Valkey over Redis, released Crossplane Provider, certified CNCF Kubernetes, Silver CNCF membership, community meetups.
  Relevance: Demonstrates active EU-based company contributions to open-source ecosystems, but governance of these projects is centralized under UpCloud or external entities, not an independent EU foundation.

Selected answer: Some public insight exists (all) Value 100 SEAL 3

Notes: UpCloud publishes architecture docs, API specs, and security policies publicly, but coverage of data flows and dependencies is partial.

Evidence

• Cloud Server System Architecture – UpCloud Documentation other 31. August 2026
  Details UpCloud's infrastructure: AMD EPYC processors, KVM virtualization, ECC memory, N+1 redundancy. Discloses hardware types but not component geographic origin.
  Relevance: Directly evidences architectural transparency — publicly documents server design, virtualization, hardware, storage, and failover mechanisms for all visitors.
• Compliance and Security – UpCloud other 31. August 2026
  Public hub linking to ISO 27001 certification, CISPE Code of Conduct, security policies, DPA, GDPR compliance, and vulnerability disclosure program.
  Relevance: Shows transparency into security architecture and compliance posture, with publicly downloadable policies and certifications relevant to service functioning and data handling.
• UpCloud API Documentation (Developer Portal) other 31. August 2026
  Comprehensive REST API reference covering servers, storages, networks, databases, Kubernetes, audit logs, and more, with downloadable OpenAPI specification.
  Relevance: Demonstrates transparency into service interfaces and data flows via full public API documentation, enabling customers to understand and control resource interactions.

Selected answer: EU-hosted, foreign stack Value 50 SEAL 3

Notes: UpCloud's HPC uses US-designed AMD EPYC CPUs and NVIDIA GPUs in Finnish data centers. No EU-designed processors or accelerators. Foreign stack, EU-hosted.

Evidence

• Advancing European Sovereignty in HPC with RISC-V (EuroHPC JU) other 31. August 2026
  EuroHPC JU article on DARE project designing EU sovereign RISC-V HPC accelerators and processors with €120M budget.
  Relevance: Contextualizes what EU HPC processor sovereignty looks like — UpCloud does not use any EU-designed HPC silicon like SiPearl or RISC-V accelerators.
• GPU Servers for next-generation workloads – UpCloud other 31. August 2026
  UpCloud's GPU server product page listing NVIDIA L4, L40S, H100, and B200 GPUs paired with AMD/Intel CPUs in Helsinki data centers.
  Relevance: Shows all HPC accelerators (NVIDIA) and CPUs (AMD/Intel) are US-designed — no EU processor or accelerator IP used.
• UpCloud Cloud Servers – Infrastructure other 31. August 2026
  Product page listing 5th Gen AMD EPYC 9575F Turin processors, DDR5 RAM, MaxIOPS storage across 15 data centers.
  Relevance: Confirms compute infrastructure relies entirely on AMD (US company) processors — no EU-designed silicon in the stack.

Selected answer: EAL2 Value 71 SEAL 2

Notes: UpCloud holds ISO 27001 and CISPE compliance but lacks SOC 2, PCI DSS, FedRAMP, and other widely recognized certifications for higher levels.

Evidence

• Compliance and Security – UpCloud other 31. August 2026
  Public hub linking to ISO 27001 certification, CISPE Code of Conduct, security policies, DPA, GDPR compliance, and vulnerability disclosure program.
  Relevance: Directly shows UpCloud's limited certification portfolio: ISO 27001 and CISPE only, no SOC 2, PCI DSS, or FedRAMP present.
• GDPR, ISO 27001 and CISPE Code of Conduct: A Guide to European Compliance other 31. August 2026
  Blog post explaining UpCloud's ISO 27001 certification and CISPE Code of Conduct adherence as core compliance pillars.
  Relevance: Provides context confirming UpCloud's compliance scope is limited to ISO 27001 and CISPE without broader international certifications.
• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirms ISO 27001 as the primary security certification; no SOC 2, PCI DSS, FedRAMP, or other major certifications mentioned.

Selected answer: 4. Partial compliance to most of the well-known EU Regulations (requirements implemented and operational with minor exceptions) Value 107 SEAL 4

Notes: GDPR and ISO 27001 independently audited; DORA addressed via contract terms, NIS2 mentioned but lacks independent audit verification.

Evidence

• Compliance and Security – UpCloud other 31. August 2026
  Public hub linking to ISO 27001 certification, CISPE Code of Conduct, security policies, DPA, GDPR compliance, and vulnerability disclosure program.
  Relevance: Lists independently audited certifications (ISO 27001, CISPE) and GDPR commitments, directly relevant to EU regulatory compliance assessment.
• GDPR, ISO 27001 and CISPE Code of Conduct: A Guide to European Compliance other 31. August 2026
  Blog post explaining UpCloud's ISO 27001 certification and CISPE Code of Conduct adherence as core compliance pillars.
  Relevance: Confirms independent audit practices for ISO 27001 and CISPE, strengthening evidence for demonstrable adherence to EU frameworks.
• True European Data Sovereignty in the Cloud Data Act — UpCloud other 31. August 2026
  Blog post where UpCloud explicitly claims compliance with GDPR, NIS2 Directive, DORA, and the Data Governance Act.
  Relevance: Directly addresses the assessment question by listing UpCloud's claimed adherence to multiple EU regulatory frameworks beyond GDPR.

Selected answer: 4. The entire incident lifecycle is handled by teams operating exclusively within the EU. Threat intelligence and incident data obtained mostly via EU sources Value 107 SEAL 3

Notes: UpCloud's SIRT and incident management operate under EU jurisdiction with EU-only access controls. No ENISA participation evidence, excluding option 5.

Evidence

• EU Data Act | UpCloud other 31. August 2026
  UpCloud's official EU Data Act disclosure page confirming all EU data centers are operated by UpCloud Oy (Finland) and data is subject to EU Member State jurisdiction.
  Relevance: Demonstrates all EU operations under Finnish/EU jurisdiction with incident response protocols controlled within the EU, supporting exclusive EU incident handling.
• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirms dedicated Security Incident Response Team (SIRT) and EU-only access controls, indicating incident lifecycle handled within EU jurisdiction.
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as 'sovereign-by-design,' in-house engineered infrastructure using dedicated AMD EPYC and NVIDIA GPU hardware.
  Relevance: Confirms EU Access Management Policy ensuring only EU-based employees handle EU data center operations, supporting exclusive EU jurisdiction over incident handling.

Selected answer: 5. Customers have full access to immutable tamper-proof logs stored exclusively within the EU Value 143 SEAL 4

Notes: UpCloud audit logs are explicitly tamper-proof, cannot be disabled or modified, retained 5 yrs, stored in EU. Accessible via Control Panel and API.

Evidence

• Audit Logs – UpCloud API Documentation other 31. August 2026
  API reference for programmatic access to UpCloud audit logs with filtering by action, origin, resource type, and export to CSV/JSON.
  Relevance: Shows full direct programmatic access to logs with granular filtering and export, supporting customer and EU authority oversight capability.
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as 'sovereign-by-design,' in-house engineered infrastructure using dedicated AMD EPYC and NVIDIA GPU hardware.
  Relevance: Confirms all infrastructure and data exclusively within EU, with no cross-border data movement, supporting exclusive EU storage of logs.
• UpCloud Audit Logs — Official Documentation other 31. August 2026
  Official docs for UpCloud's Audit Logs feature in the Control Panel. Logs are tamper-proof, retained up to 5 years, with 180 days free access. Cannot be disabled or modified.
  Relevance: Directly evidences tamper-proof, immutable logging with direct customer access, stored in EU data centers. Existing evidence IDs 316-323 confirm this.

Selected answer: 3. Moderate compliance - GDPR/NIS2-aligned reporting procedures in place with vulnerabilities and breaches communicated within mandated timelines; CSIRT cooperation available but not real-time Value 71 SEAL 2

Notes: GDPR/NIS2-aligned breach reporting via DPA and ISO 27001 ISMS; active VDP with defined timelines; no evidence of real-time CSIRT integration or proactive threat intel sharing.

Evidence

• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirms GDPR/NIS2-aligned breach reporting (without delay), ISO 27001 ISMS audit-backed processes, and active vulnerability disclosure program. No mention of real-time CSIRT integration.
• Security Requirements under NIS2 Directive — UpCloud Global other 31. August 2026
  UpCloud blog addressing EU NIS2 Directive compliance including risk analysis, security measures, and incident reporting within strict deadline to national authorities.
  Relevance: Demonstrates alignment with NIS2 incident reporting requirements (early warning binnen 24h, detailed reports binnen 72h) through ISO 27001 ISMS. No evidence of real-time CSIRT cooperation.
• UpCloud VDP – Bug Bounty Program – Intigriti other 31. August 2026
  UpCloud's official Vulnerability Disclosure Program on Intigriti with ISO 29147/30111 alignment, 2-working-day validation for critical findings, and safe harbor for researchers.
  Relevance: Shows proactive vulnerability disclosure with defined SLAs (2-day critical validation) aligned to ISO standards. Indicates structured but not real-time threat disclosure to CSIRTs.

Selected answer: 3. Moderate Autonomy - security patches are deployed with sufficient notice to the customer and testing is possible, except for zero-day patching Value 71 SEAL 4

Notes: UpCloud's in-house EU platform eliminates non-EU vendor dependency. Patches are UpCloud-scheduled with notice; customers can test. Zero-day patches may bypass customer testing windows.

Evidence

• Security & Privacy — UpCloud other 31. August 2026
  UpCloud's security overview page covering encryption, ISO 27001, GDPR compliance, and platform security features.
  Relevance: Confirms UpCloud uses in-house software for faster patching, actively monitors vulnerabilities, and managed services have automated security updates — patches deployed on UpCloud's schedule with customer notice implied.
• Sovereign Cloud Infrastructure for Defense and Security other 31. August 2026
  Describes UpCloud as 'sovereign-by-design,' in-house engineered infrastructure using dedicated AMD EPYC and NVIDIA GPU hardware.
  Relevance: Demonstrates UpCloud's sovereign-by-design approach: platform is entirely in-house engineered, giving EU-based control over maintenance and patching without non-EU vendor dependency.
• UpCloud Information Security Policy (v. 1.1) other 1. September 2026
  Formal ISMS policy document aligned with ISO 27001, covering software security management, vulnerability disclosure, and patch governance under CISO oversight.
  Relevance: Establishes formal governance for security patching under an EU-based CISO, supporting controlled patch deployment with testing procedures independent of non-EU vendors.

Selected answer: 5. Full control by any idependent entity to perform security and compliance audits Value 143 SEAL 4

Notes: DPA allows customer audits with conditions (30-day notice, annual limit, cost bearing). ISO 27001 & CISPE audited by third parties. Restricted but structured audit access.

Evidence

• Compliance and Security – UpCloud other 31. August 2026
  Public hub linking to ISO 27001 certification, CISPE Code of Conduct, security policies, DPA, GDPR compliance, and vulnerability disclosure program.
  Relevance: Publicly available certifications and policies enable independent entities to assess UpCloud's compliance posture and request audit data.
• GDPR, ISO 27001 and CISPE Code of Conduct: A Guide to European Compliance other 31. August 2026
  Blog post explaining UpCloud's ISO 27001 certification and CISPE Code of Conduct adherence as core compliance pillars.
  Relevance: Confirms independent third-party audits for ISO 27001 and CISPE, giving EU entities visibility into security posture via certified audits.
• Terms of Service – UpCloud other 31. August 2026
  UpCloud's official Terms of Service. Section 31 states governing law is Finland and arbitration seat is Helsinki under Finland Chamber of Commerce rules.
  Relevance: DPA Section 11 defines audit rights for EU entities—structured but conditional access, supporting high rather than full control assessment.

Selected answer: PUE < 1.5 + roadmap Value 125 SEAL 4

Notes: UpCloud has ESG program, global power efficiency initiative, and colocation in ISO 50001-certified facilities. No public fleet-wide PUE, but efficient Nordic sites (one at PUE 1.2).

Evidence

• UpCloud Data Centers other 1. September 2026
  UpCloud's data center page listing 15 facilities. Helsinki sites use 100% hydro/renewable power, ISO 50001 energy management, CEEDA and LEED certifications. Norway site uses fjord cooling with PUE as low as 1.2.
  Relevance: Shows adoption of energy-efficient infrastructure across all data centers, with ISO 50001-certified colocation facilities and at least one site achieving PUE 1.2.
• UpCloud Environmental Policy other 31. August 2026
  Official environmental policy aligned with ISO 14001, Finnish/EU regulations, covering renewable energy sourcing and GHG reduction across data centers.
  Relevance: Confirms formal energy efficiency policy with ISO 14001 alignment, renewable energy commitments, and continuous improvement framework for data center energy efficiency.
• UpCloud ESG Program & Reports other 31. August 2026
  UpCloud's ESG program hub with annual reports covering environmental (GHG Protocol), social, and governance metrics including ISO 27001 and CISPE compliance.
  Relevance: Demonstrates measurable energy efficiency targets and roadmap via ESG program, global power efficiency program, and carbon intensity ratio tracking (114.1 to 112.7 improvement).

Selected answer: Circular economy EU-aligned Value 187 SEAL 4

Notes: UpCloud documents hardware reuse (device donations to schools) and WEEE-compliant end-of-life recycling in Finland. Not yet a full EU-certified lifecycle.

Evidence

• UpCloud Environmental Policy other 31. August 2026
  Official environmental policy aligned with ISO 14001, Finnish/EU regulations, covering renewable energy sourcing and GHG reduction across data centers.
  Relevance: Establishes the policy framework referencing entire product lifecycle and recyclable/sustainable materials, supporting the documented program assessment.
• UpCloud ESG Program & Reports other 31. August 2026
  UpCloud's ESG program hub with annual reports covering environmental (GHG Protocol), social, and governance metrics including ISO 27001 and CISPE compliance.
  Relevance: Documents UpCloud's hardware reuse practices (donating EOL devices to schools) and ESG reporting framework covering environmental sustainability.
• UpCloud Year 2024 in Review other 31. August 2026
  Highlights UpCloud's open-source commitments in 2024: adopted Valkey over Redis, released Crossplane Provider, certified CNCF Kubernetes, Silver CNCF membership, community meetups.
  Relevance: Provides specific evidence of documented hardware reuse (server/router donations) and responsible end-of-life treatment (WEEE directive compliance) practices.

Selected answer: Detailed EU methodology Value 187 SEAL 3

Notes: UpCloud publishes annual ESG reports (2024, 2025) with GHG Protocol Scope 1-3 carbon emissions, renewable energy data, but lacks detailed EU methodology or EU audit.

Evidence

• UpCloud Blog: We're a Green Web Provider other 1. September 2026
  Blog post announcing Green Web Foundation verification for UpCloud, noting 70% of data centers on renewable energy and commitment to 1.5°C IPCC scenario alignment.
  Relevance: Supports assessment showing UpCloud reports sustainability metrics publicly via blog and ESG reports but relies on independent verification rather than detailed EU-level auditing framework.
• UpCloud ESG Program & Reports other 31. August 2026
  UpCloud's ESG program hub with annual reports covering environmental (GHG Protocol), social, and governance metrics including ISO 27001 and CISPE compliance.
  Relevance: Directly shows UpCloud uses annual self-published ESG reports with GHG Protocol-aligned carbon disclosure, but no specific EU methodology or EU audit verification.
• UpCloud ESG Report 2025 other 1. September 2026
  UpCloud's 2025 ESG report covering total emissions (2,807 tCO2e), 70% renewable energy data centers, Scope 1-2 offsetting via biochar, and e-waste management practices.
  Relevance: Demonstrates annual reporting with quantitative carbon data and sustainability measures, confirming assessment as annual report level rather than detailed EU methodology or EU-audited.

Selected answer: Mix of EU and non-EU supplies Value 125 SEAL 4

Notes: EU DCs run on 100% renewable/hydro energy; US DCs use mixed fossil-based energy. ~70% of all DCs on renewables. Mix of EU and non-EU supplies.

Evidence

• 2025 Cloud Sustainability Top 10 – Computing other 1. September 2026
  Independent sustainability assessment ranking cloud providers. UpCloud scored 10/50 points due to limited public ESG data transparency; acknowledges 70% renewable DCs but no detail on energy form.
  Relevance: Third-party assessment highlights that UpCloud's renewable energy claims lack transparency and that US/mixed-energy DCs pull overall renewable coverage below 100%, reinforcing mix-of-EU-and-non-EU conclusion.
• UpCloud Blog: We're a Green Web Provider other 1. September 2026
  Blog post announcing Green Web Foundation verification for UpCloud, noting 70% of data centers on renewable energy and commitment to 1.5°C IPCC scenario alignment.
  Relevance: Independent verification confirms 70% renewable coverage; remaining 30% implies non-EU DCs using non-renewable energy, supporting the mix-of-supplies assessment.
• UpCloud Data Center Information other 31. August 2026
  Lists 15 data centers across 12 countries. UpCloud owns compute hardware but colocates in third-party facilities (Equinix, Digital Realty, etc.).
  Relevance: Directly shows energy sourcing per data center, confirming EU DCs use 100% renewable energy while US DCs use mixed fossil-based energy — a clear mix of EU green and non-EU non-green supplies.