Cyso Cloud in 2026: an honest review for teams leaving AWS or Azure

Cyso Cloud, called Fuga Cloud until 1 January 2025, is the public cloud of Cyso, a privately held Dutch hosting group founded in 1997 and based in Alkmaar. It runs plain OpenStack in two regions, Amsterdam and Frankfurt, each with three availability zones and the same prices, and holds ISO 27001 and NEN 7510 certificates we could read. Compute is cheap and the price list has no charge for traffic leaving instances: our production workload costs EUR 254.40 a month in Frankfurt, though without the managed PostgreSQL that the AWS and Azure totals include, because Cyso Cloud sells one only as a closed beta. The weak points are a narrow catalogue, three Amsterdam network outages in 2025 that its zones did not contain, office-hours support with no response targets, no default encryption at rest or published DPA, and a provider that has written about moving away from OpenStack without saying what that means for its public cloud.

This article is one of a series comparing 24 European cloud providers with AWS and Azure; the overview puts them side by side. Everything below was checked on 15 and 16 October 2026 against Cyso Cloud's documentation, legal terms, price list and status page, company registries and archived price pages, each at its source. We did not open an account or run workloads.

At a glance

What you can build

Status is general availability unless noted, as Cyso Cloud labelled it on 16 October 2026. Every API service exists in both regions.

Missing outright: bare metal, GPUs, any generally available managed database, file storage, a container registry (EMK has a pull-through cache), functions, queues, a CDN, a WAF, a key management service, managed logging and AI model APIs. For more, Cyso Cloud points to its sister company Cyso, which sells managed services on top. Object storage documents versioning, Object Lock, lifecycle rules and customer-supplied keys (SSE-C), but not SSE-S3 or SSE-KMS, event notifications, website hosting or replication between regions.

The tooling is OpenStack's, not Cyso's: the community OpenStack Terraform provider (3.4.0, published 11 November 2025), the community openstack CLI, and Gardener YAML for EMK clusters. There is no Cyso provider, CLI or SDK. The documentation, about 144 pages, still says Fuga in places, describes Amsterdam only on some pages and calls load balancer sizes "coming soon" on one. A public roadmap and changelog run on Canny. EMK upgrades a deprecated Kubernetes version 28 days after deprecation "even if automatic updates for Kubernetes are turned off".

What it costs

Cyso Cloud list prices in EUR, VAT excluded, from its price page, checked 15 and 16 October 2026, in Frankfurt; Amsterdam costs the same. Everything is billed by the hour up to a monthly cap at 672 hours, so a 730-hour month costs the monthly price.

Workload A, a starter setup: one VM with 2 vCPU and 4 GB, a 40 GB disk, one IPv4 address, 1 TB of egress and 100 GB of object storage.

No flavour matches 2 vCPU and 4 GB with a 40 GB disk: c5.small has the 4 GB but only 25 GB of disk and costs more (EUR 30.92 with a 15 GB volume), so s5.small, with twice the memory, is the cheapest fit. One trap: pick a distribution image and the dashboard creates a boot volume, billed as block storage, unless you choose ephemeral storage. AWS charges EUR 112.37 and Azure EUR 116.15 for workload A in Frankfurt, most of it for the 1 TB of egress.

Workload B, a small production system: three VMs of 4 vCPU and 16 GB with an IPv4 address each, 300 GB of SSD block storage, a load balancer, PostgreSQL with 2 vCPU, 8 GB and 100 GB as primary plus standby, 1 TB of object storage with 1 million PUT and 10 million GET requests, a Kubernetes control plane and 2 TB of egress.

The HA control plane, which spreads etcd over three zones, costs EUR 59.99 and brings the total to EUR 284.40. There is one VM variant only: Cyso Cloud sells no separate shared and dedicated vCPU families and does not say which s5 is; the platform page promises "guaranteed CPU and memory allocation" without a ratio.

AWS charges EUR 1,082.61 for workload B and Azure EUR 1,091.88, but both totals include a managed HA PostgreSQL (USD 320.13 a month on AWS with storage), so the numbers do not compare directly. Running PostgreSQL yourself on two s5.small instances with two 100 GB volumes adds EUR 54.00, for EUR 308.40, or EUR 338.40 with the HA control plane: 31% of the AWS price, with no managed failover, backups or patching. One line is dearer at Cyso Cloud: object storage, at EUR 55 per TB-month, more than twice S3 Standard in Frankfurt (USD 0.0245 per GB-month).

Egress and IPv4. The platform page promises "no outbound data transfer fees" and "zero fees for outgoing network transfers", and the price list has no line for instance egress. The billing FAQ, though, says "the only variable costs are bandwidth", and Cyso has not resolved the two. We found no volume cap; the general conditions define fair use only as "reasonable use" and let Cyso "reduce the overload". Object storage egress is billed at EUR 0.055 per GB, EUR 55 per TB, against USD 0.09 per GB on AWS and USD 0.087 on Azure beyond their free 100 GB. A public IPv4 address costs EUR 1.99 a month against USD 3.65 on AWS and Azure; an IPv6 /48 is free.

Billing. Stopped instances keep billing until deleted. Invoices are monthly in arrears, in euros. There are no spending limits beyond quotas, no reserved or spot prices, and volume discounts only through sales. A free trial goes to "selected new customers" by request and does not end automatically, so resources keep billing afterwards. A Startup Program gives EUR 2,500, 5,000 or 10,000 in credits over 18 months. There is no permanent free tier.

Price changes. Cyso published no announcement for any of these; the dates are windows between archived copies of the price page.

Volume prices fell by 14% to 48% across the four tiers. The m5.large rise is the only list increase we saw in 2025 and 2026, and object storage has not changed since March 2024. Whether customers on the old flavours were moved is not stated. The contract allows price changes, including indexation to CPI or the CBS index, "30 days after Customer is notified", and lets you terminate only if the year's total increase exceeds CBS inflation by 5%.

Reliability

What a zone is. Each region "contains isolated availability zones (3 per region)" in "TIER 3 data centers ... fully managed by Cyso". Nothing says whether a zone is a separate building, power feed or room, and no facility is named. PeeringDB lists Cyso's network, AS25151, at two Amsterdam facilities and none in Frankfurt, which records where the network connects, not where the zones are. Anti-affinity, to keep instances on different hosts, can be set only through the API or CLI. EMK's HA control plane runs three etcd members, "each member in a different zone".

The database standby. There is none to judge: Cloud Databases is a closed beta outside the SLA. Its page claims "99.9% uptime through 3 availability zones", with no HA design published. If you run PostgreSQL yourself, the replica and failover are yours to build.

The SLA:

The Kubernetes pages advertise "Production-grade Kubernetes with 99.9% SLA", but the SLA document does not mention EMK. Outside the SLA, liability is capped at fees received, with a maximum of EUR 200,000, and lost data is excluded (general conditions 1.8.1 and 1.8.8). AWS also commits to 99.99% for EC2 across two or more zones, but pays credits up to 100% and allows claims until the end of the second billing cycle; Azure gives 99.99% across zones and 60 days to claim.

Status page and incidents. status.cyso.cloud redirects to the older Fuga address and runs on Atlassian Statuspage, with components per availability zone. Its public API returns the last 50 incidents, back to 22 June 2023, with hour-by-hour updates. Causes, where given, are a short paragraph inside the incident, not separate postmortems. Times are as published (CET or CEST).

The three Amsterdam incidents of 2025 took external connectivity down across the whole region, so the three zones did not contain them, and all three sit in the virtual network layer. In December the team stopped overnight ("Our engineers will take a rest and continue the investigation", at 00:13) with customers asked not to reboot. No incident in the window is described as lost data, and we found no court case or compensation dispute.

Support

There is one level. Phone, email, chat and tickets are staffed during office hours, Monday to Friday 9:00 to 17:00, in Dutch and English, with no published response target: the Trust Centre says the SLA "spells out ... response times", and the SLA has none. The Impressum lists the same phone number as an "Emergency service ... (24/7)", without saying what counts as an emergency or who may use it. Cyso promises "Direct access to real cloud engineers without escalation tiers", which we could not test.

Round-the-clock cover is sold by the sister company Cyso as "Managed Public Cloud", with a 24/7 NOC and SOC under "an additional, different SLA"; its price is not published. For comparison, AWS Basic cannot open technical cases at all and Azure Basic has no response targets, so office hours with a human are more than either includes. A one-hour target for a production outage costs the greater of USD 29 or 9% of spend on AWS Business Support+, or USD 100 a month on Azure Standard; at Cyso Cloud it means buying managed services.

Getting an account

Signup is self-service at my.cyso.cloud, with two-factor authentication required at registration (TOTP, passkeys supported). A credit card is checked with a 1 euro debit; debit and prepaid cards are refused, and EU customers can pay by SEPA. Companies and individuals may sign up. We found no statement on identity documents, company registration or country restrictions.

Default quotas are not published. Increases are checked by hand, "usually ... within one working day". A free trial is reviewed by staff. DNS zones are added only after "We will check your domain manually". Outbound port 25 is blocked and stays blocked ("You can't change that"); mail goes out on 465 or 587.

Workload B on day one: without an account we could not tell whether three s5.medium instances, a load balancer and an EMK cluster fit the default quota, and the managed PostgreSQL cannot be bought on any day. On AWS the default of 5 vCPUs for standard instances is below workload B's 12; Azure's 20 cores per region fit on paper.

Three clauses matter later. Under the Dutch notice-and-takedown code, you get two working days to respond to a complaint, after which Cyso may remove material, and it may give the complainant your name and address if it judges the complaint justified. Unpaid invoices let Cyso "suspend all services", with collection costs of 15% and at least EUR 500. And the general conditions set a one-year term that renews automatically, ended by registered letter 30 days ahead, for agreements with a periodic fee; how that applies to a pay-as-you-go account is not stated.

Compliance and data protection

Encryption at rest is not on by default. The storage FAQ says: "Currently, we do not apply standard encryption to objects stored in our storage systems. The data is not encrypted but is stored in chunks (split files) on our systems." Cyso recommends client-side encryption or SSE-C and argues that provider-managed keys give "a false sense of security". The FAQ heading covers object and volume storage, but the answer speaks only of objects. There is no key management service.

No DPA and no sub-processor list for Cyso Cloud. The processor terms that exist are article 2.11 of Cyso's general conditions, in which the customer warrants that the processing is lawful and that Cyso's security measures are appropriate; the Dutch text prevails over the English. The only sub-processor list is the group's on cyso.com, dated 2018, naming Microsoft, Amazon and Google for "Cloud Computing". Whether it covers Cyso Cloud or only the managed-hosting side is not stated. The privacy policy is the group's, last versioned in November 2018.

Data location. "We operate exclusively within Europe from our datacenters in Amsterdam and Frankfurt", and data, replicas and backups stay in the chosen region. The terms say user data "will not be provided to third parties unless Cyso is obligated to do so on the basis of a court order"; there is no transparency report.

Who controls it

You contract with Cyso B.V. (KvK 37133395) in Alkmaar, under Dutch law with Dutch arbitration (general conditions 1.12). Its Impressum names three directors, Paul Bankert, Sven Visser and Tjebbe de Winter. Cyso B.V. belongs to Cyso Group B.V. (KvK 33287475), whose brands are Cyso (managed hosting, since 1997), Cyso Cloud and Hosting.NL, with "nearly 60" staff. Fuga Cloud, founded in 2016 and also part of the Cyso Group, handed its activities to Cyso B.V. on 1 January 2025, with "service provision for existing customers" unchanged; no outside buyer was involved.

The shareholders are not public. GLEIF records Cyso B.V. with no consolidating parent, and we found no annual report, investor or acquirer. Third-party directories say the founders own it, which we could not verify; Cyso calls itself "the oldest independent cloud and managed hosting provider in the Netherlands". No non-European parent or shareholder turned up in GLEIF, the registry mirrors or the press, which is absence of evidence while the register stays closed.

The platform is Cyso's own: OpenStack on KVM with Ceph storage and OVN networking, on its own network, AS25151, in data centres it does not name.

Where the platform is heading. Cyso has tested Apache CloudStack internally since late 2024. A post of 18 March 2026 is titled "From OpenStack to CloudStack: why we are moving away from OpenStack after 10 years". Most of it is about replacing VMware in Cyso's enterprise cloud; it mentions a CloudStack setup "for our public cloud", gives no timeline, and says nothing about existing public cloud customers. Cyso's posts of March 2026 describe the goal as a public cloud "scalable across Europe" with "stretchable self-service VPCs across datacenters with a single control plane". Read it as a stated direction, not an announced migration: if you build on Cyso Cloud today, you build on OpenStack, from a provider that says publicly it is weighing another one. It also plans to "expand to Scandinavian countries and beyond", with no date.

Leaving

Instance egress has no listed charge, with the billing FAQ caveat above; 1 TB out of object storage costs EUR 55.00. The APIs are vanilla OpenStack ("We stick to the vanilla releases"), so code written for Nova, Neutron, Cinder, Octavia and Heat moves to other OpenStack clouds with names changed. Cyso documents leaving as well as arriving: snapshot an instance, openstack image save, upload it elsewhere, and the same for volumes. Buckets move with rclone or the AWS CLI.

Lock-in is low at the API level. EMK is CNCF conformant, but its clusters are Gardener shoots, a spec that does not carry over to EKS or AKS as written. The larger risk is the platform's future, covered above.

We found no Data Act switching clause in the general conditions. On termination Cyso "can charge Customer reasonable termination costs", no data retention period after closure is stated, and backups are the customer's job. Closing an account is a self-service cancellation: "We will not just delete your data, we need a 'real' cancellation from you."

What users report

We found no independent user reports: Hacker News, Reddit and Tweakers turned up nothing beyond three Hacker News comments since 2022 that name Cyso or Fuga Cloud in lists of European providers, so this review rests on Cyso's own documents, its status page, registries and archived price pages.

Who it suits, and who should look elsewhere

Cyso Cloud suits small and mid-sized teams in the Netherlands and Germany that run their own databases on VMs or Kubernetes, want low and predictable compute bills without per-GB instance egress, value a Dutch-owned provider with a NEN 7510 certificate for healthcare work, and are at home with plain OpenStack tooling.

Look elsewhere if you need a managed database, GPUs, serverless or queues; if you need encryption at rest or a key management service by default; if you need zones you can count on to contain a network failure; if your procurement needs a published DPA and sub-processor list; or if you need 24/7 support with response targets without buying managed services from Cyso.

Sources

Checked on 15 and 16 October 2026.

Pricing

• Pricing and billing FAQ
• Platform, free trial and Startup Program
• Archived price pages: fuga.cloud/pricing, 13 July 2024, pricing-network, 12 September 2024, pricing-storage, 24 March 2024, cyso.cloud/pricing, 13 January 2025, 20 August 2025
• AWS and Azure figures: AWS Price List bulk API and Azure Retail Prices API, converted at the ECB rate of 15 October 2026

Terms and SLA

• Service Level Agreement v1.0
• Terms and Conditions AV.v.1/2022
• Legal: acceptable use, abuse, notice and takedown
• Privacy policy

Documentation

• Service endpoints, getting started and change quota
• Object storage, cloud storage FAQ, security FAQ and networking FAQ
• Instances on different compute nodes and Terraform how-to
• Enterprise Managed Kubernetes, high availability and version releases
• Managed Kubernetes and Cloud Databases
• Migrating an instance and a volume between OpenStack providers
• CNCF conformance, v1.35 and v1.34
• Terraform registry, OpenStack provider and FugaCloud on GitHub
• Public roadmap and changelog

Status and incidents

• Status page and incident history API
• Emergency maintenance for CVE-2026-53359, 7 July 2026

Compliance

• Trust Centre
• ISO 27001 certificate 25.002 and NEN 7510 certificate 25.080
• Cyso group sub-processors
• "Cyso achieves SOC 2 Type 2 attestation", 11 March 2026

Company and ownership

• Impressum and About Cyso Cloud
• "Fuga Cloud comes of age and continues as Cyso Cloud", 18 November 2024
• "From OpenStack to CloudStack", 18 March 2026 and "Beyond VMware: Cyso's road to CloudStack", 22 March 2026
• GLEIF record for Cyso B.V. and its parent reporting exception
• PeeringDB, AS25151 facilities
• Registry mirrors: OpenCorporates, Cyso B.V. and Cyso Group B.V.

User reports

• Hacker News comments that name the provider without describing use: 43160958 (February 2025), 44632925 (July 2025), 48340397 (May 2026)