Scaleway SAS

France · owned by Iliad Group (France) · scaleway.com · 43 vendors

Scaleway is a European cloud provider offering a full-stack cloud platform including compute, storage, networking, and AI/ML infrastructure services. It enables developers and businesses to build, train, deploy, and scale AI models and applications on a resilient and sustainable cloud ecosystem. Scaleway is known for its commitment to European data sovereignty and environmentally responsible data center operations.

Resilience scores

Disruption prediction

Scaleway SAS has an estimated 27% probability of disruption in the next 6 months.

24 of Scaleway SAS's 43 vendors monitored for disruptions.

Technology vendors

Services catalogue

14 services in catalogue across 5 categories; runs on 43 sub-vendors.

Insights

Last updated 2026-08-19 · revision 22

43 direct vendors, 389 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 9/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

Scaleway demonstrates a very high level of migration readiness, primarily due to its comprehensive and modern cloud-native tech stack. The platform offers a wide array of services, including high-performance GPU instances, managed Kubernetes (Kapsule, Kosmos), serverless computing, and a diverse portfolio of managed databases (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse, Kafka, Spark). The extensive use of open standards and APIs, such as S3-compatible object storage, Docker, and Kubernetes, significantly reduces vendor lock-in for customers, making it easier to migrate workloads to and from Scaleway. Furthermore, Scaleway's strong commitment to data residency, particularly within the EU/EEA and France (HDS-certified for health data, SecNumCloud in progress for sensitive government data), is a major advantage for customers with stringent data sovereignty requirements, facilitating their migration to a European cloud provider. The company's positive financial growth indicates a stable platform capable of continuous investment in services and features that support migration. While some regulatory frameworks like NIS2 and the EU AI Act are still under assessment or in phased implementation, Scaleway's proactive engagement (e.g., SecNumCloud qualification) suggests a commitment to addressing these, though specific customer migrations might require careful consideration of these evolving requirements. The 'Vendor lock-in Risk' for Scaleway itself is 'Unknown' due to ambiguous vendor data ('Total Vendors: 0' but lists vendor countries), which means we cannot fully assess Scaleway's internal flexibility in adopting new technologies or migrating its own systems. However, for customer migrations to/from Scaleway, the open and diverse tech stack is a strong positive.

Compliance

9 in-scope frameworks identified; showing 3.

ISAE 3000 (source) — Assessment Required

ISAE 3000 is an assurance standard used by auditors to provide assurance on non-financial information, often used as the basis for SOC 2 equivalent reports in Europe (ISAE 3402 for service organizations). Risk is assessed as Low because: (1) ISAE 3000/3402 is not a legal requirement for cloud providers, (2) Scaleway's ISO/IEC 27001:2022 certification provides equivalent or superior assurance for most purposes, (3) no evidence of ISAE 3000 reports being required by Scaleway's regulatory environment was found. The Unknown status reflects the absence of public information about ISAE 3000 engagements, not a compliance failure.

Evidence: https://security.scaleway.com/, https://www.scaleway.com/en/security-and-resilience/

GDPR (source) — Compliant

Scaleway SAS is headquartered in France (EU), making GDPR universally applicable. However, risk is assessed as Low because Scaleway has publicly demonstrated active, documented compliance: they explicitly commit to GDPR compliance on their official security page, maintain a published Data Processing Agreement (DPA), have appointed a Data Protection Officer (DPO), conduct employee privacy training, publish a subprocessors list, and operate a dedicated Trust Center. As a cloud provider, they are acutely aware of GDPR obligations both as a data controller (for their own customer data) and as a data processor (for customer workloads). Their ISO/IEC 27001:2022 certification and HDS certification further reinforce their data protection posture. The primary residual risk is the complexity of managing GDPR obligations across a large, diverse customer base and the evolving enforcement landscape in France (CNIL).

Evidence: https://www.scaleway.com/en/security-and-resilience/, https://security.scaleway.com/, https://www.scaleway.com/en/contracts/, https://www.scaleway.com/en/privacy-policy/

SOC 2 (source) — Assessment Required

SOC 2 risk is assessed as Medium because Scaleway is a major cloud services provider — the exact profile for which SOC 2 Type II reports are most commonly requested by enterprise customers, particularly those in North America. While Scaleway's Trust Center notes that 'security-related reports may be provided upon request,' no public SOC 2 certification or report is listed among their compliance items (which show GDPR, HDS, ISO/IEC 27001, and ISO/IEC 27001 SoA). The absence of a public SOC 2 report may reflect Scaleway's European focus (where ISO 27001 is the dominant standard) rather than non-compliance. However, as Scaleway expands globally and serves enterprise customers, the lack of a SOC 2 report could be a commercial risk and a gap for US-market customers. Risk is Medium rather than High because ISO 27001 certification provides substantial equivalent assurance.

Evidence: https://security.scaleway.com/, https://www.scaleway.com/en/security-and-resilience/

Financials

Three-year financials

Financial Resilience Score: 6/10

Scaleway benefits from strong parent backing by Iliad Group, controlled by billionaire Xavier Niel, which has committed significant capex including a publicly announced €200 million GPU/AI investment in 2023 and additional commitments thereafter. The company is strategically positioned to benefit from European sovereignty regulations (GAIA-X, EU AI Act, SecNumCloud, NIS2) that favor a French/European cloud provider over U.S. hyperscalers, particularly for public-sector and regulated customers. Its AI positioning is strong, hosting Mistral AI and Hugging Face workloads, and its early purchase of H100 GPU capacity drove scarcity-driven revenue growth in 2023-2024. However, Scaleway remains sub-scale versus hyperscalers, with annual revenue around €100M dwarfed by AWS (>$100B), Azure, and Google Cloud, creating structural cost-per-unit disadvantages. The business is capex-heavy and likely loss-making, with GPU clusters, datacenter expansion, and software platform development requiring large investment with long payback periods. Operating profitability has not been publicly confirmed. Its financial resilience depends substantially on Iliad's continued willingness and ability to fund the build-out, and Iliad itself carries significant leverage from its 2021 take-private transaction. Customer concentration risk on AI workloads and increasing competition from hyperscalers' own EU sovereign cloud offerings present additional risks.

Key strengths: Strong parent backing from Iliad Group and Xavier Niel, €200M GPU/AI investment commitment in 2023, European sovereignty regulation tailwinds (GAIA-X, EU AI Act, SecNumCloud, NIS2), Strategic AI positioning hosting Mistral AI and Hugging Face, Multi-region European footprint (Paris, Amsterdam, Warsaw), Stated long-term target of ~€1B revenue by 2027-2028

Risk factors: Sub-scale versus hyperscalers (AWS, Azure, GCP), Capex-heavy business model with likely negative or breakeven operating profitability, Dependence on parent Iliad funding which carries significant leverage, Customer concentration risk on AI workloads (e.g., Mistral), Competitive risk from hyperscalers launching EU sovereign cloud offerings, Structural cost-per-unit disadvantages versus larger competitors

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report