IaaS vs private cloud vs hybrid cloud in Europe: how to choose for classic workloads

IaaS vs private cloud vs hybrid: which fits which workload

For classic workloads such as application servers, databases, ERP and test environments, IaaS fits VMs that need no hosts of their own, a private cloud fits when hosts must serve your organisation alone, and hybrid fits when some systems have to stay on-premise or the move happens in stages. With IaaS you get VMs with set vCPU, RAM and storage on a platform the provider shares between customers, and you run the guest operating systems and applications. A private cloud reserves hosts and storage for your organisation, and its security policies, access and configuration are yours. In a hybrid set-up part of the estate stays on-premise, linked to the hosted part, with replication between the sites.

IaaS describes what you manage, while private, public and hybrid describe who shares the infrastructure, so a hosted private cloud usually delivers IaaS as well. For a private cloud in Europe, the data centre’s location and its operator’s jurisdiction are further questions, covered with the criteria below.

What NIST SP 800-145 means by IaaS, private, public and hybrid cloud

NIST Special Publication 800-145 dates from September 2011 and is still listed as final in October 2026. It defines cloud computing by five essential characteristics, three service models and four deployment models, and NIST intends it for broad comparisons of cloud services, without prescribing how they are deployed or delivered. The characteristics are on-demand self-service, broad network access, resource pooling for several tenants, rapid elasticity and measured service, with usage visible to provider and consumer.

In the IaaS service model you obtain processing, storage and networks and control the operating systems, storage and applications you install, while the provider controls the infrastructure below them; some network settings such as host firewalls may be partly yours. Among the deployment models, a private cloud serves one organisation alone, may be owned and operated by that organisation, a third party or both, and may sit “on or off premises”. A public cloud is open to any customer and runs on the provider’s premises, a community cloud serves several organisations with shared concerns, and a hybrid cloud links two or more distinct cloud infrastructures by technology that lets data and applications move between them.

Hosting offers use the words more loosely. IaaS usually means VMs on a shared platform, closest to NIST’s public model, and private cloud means hosts reserved for one customer. Hybrid also covers an on-premise cluster linked to a hosted platform, although a server room without self-service and metering would not meet NIST’s characteristics.

NIST SP 800-145, The NIST Definition of Cloud Computing (September 2011), sections 1.2 and 2; the last two columns are our reading of common hosting terms.

Private cloud vs public cloud for classic workloads

For VMs that run all month at a similar load, the differences are tenancy, the allocation of capacity and the structure of the invoice. On a public platform your VMs usually share hosts with other tenants. In a private cloud the hosts carry only your VMs, and you decide how many you need, spare capacity for a host failure included. Elasticity helps most with load that swings, such as a web shop during a sales campaign, while a database server with a similar load every day makes little use of it.

NIST’s measured service means that usage is metered; whether the invoice follows the meter or a fixed monthly configuration is the provider’s commercial choice. ENISA’s Cloud Security Guide for SMEs (April 2015) lists unexpected costs among its cloud risks, because pay-as-you-go billing “means costs are not always fixed”. Applications that depend on a public cloud’s proprietary platform services, such as serverless functions, may need parts rewritten before they can move, so this comparison covers systems that already run as VMs.

Guaranteed or overcommitted vCPU and RAM

A host is overcommitted when its VMs have more vCPUs than it has physical cores, or more configured memory than it has RAM, which works while the VMs do not all peak at once. ENISA’s report “Cloud Computing: Benefits, risks and recommendations for information security” (November 2009) describes cloud resources as allocated “according to statistical projections” and lists service unavailability among the consequences of inaccurate modelling or inadequate provisioning. ENISA’s SME guide of 2015 adds that tenants share the same physical infrastructure, so the peaks of other tenants can affect your VMs.

Guaranteed resources are available to your VMs whenever they need them, however busy the other tenants are. On vSphere the setting for a per-VM minimum is a reservation, which Broadcom’s documentation (updated 16 September 2026) calls the “guaranteed minimum allocation” for a virtual machine, and vCenter Server or ESXi powers the VM on only if enough unreserved capacity is left to cover it. On our IaaS, CPU and RAM are guaranteed and not shared with other clients. In a private cloud the ratio of vCPUs to physical cores is your own decision, so test systems can be overcommitted while production databases keep reserved capacity. Ratios and the signs of contention inside a VM are covered in our guide to what dedicated vCPU and RAM mean in an IaaS offer.

Workload criteria: load profile, licences, data class, latency and skills

Steady consumption suits reserved capacity on a fixed configuration, and large steady consumption that fills whole hosts suits a private cloud. Load that swings needs idle headroom on reserved capacity, or a platform that adds capacity on demand.

Some software is licensed per physical core or socket, and the vendor’s rules decide which servers count. The Oracle Partitioning Policy, which Oracle calls educational and not a contract, gives the policies in effect as of 14 February 2022 and lists VMware among its examples of soft partitioning, a technique it does not accept for determining or limiting the licences a server or cluster of servers needs. A shared platform does not let you name or limit the hosts a VM runs on, while a dedicated private cloud has a fixed, known set. In a hosted vSphere service the VMware licence itself is usually the provider’s, as our article on hosted vSphere and the VMware licences you own explains.

Client contracts, sector rules and your own policy for personal data can require that data and backups stay in the EU. The jurisdiction of the operator is a separate question, covered in our article on the CLOUD Act and EU data residency, and systems whose data must not leave your premises stay on-premise.

Latency affects two paths, from users to the servers and between systems that stay on site and those that move. An application that sends 200 sequential database queries to build one screen spends 2 seconds on the network at a 10 ms round trip (our arithmetic), so an application server and its database belong on the same side of the link.

NIST SP 800-145 (September 2011); Oracle Partitioning Policy (policies in effect as of 14 February 2022); our EU Cloud page for who each option fits; the assessment per option is our reading.

Which of the three fits is worked out on the first call, from your workloads and data requirements. Send us your VM list with the data class of each system and any licences counted per host or core.

Hybrid cloud for mid-size companies: patterns and prerequisites

A hybrid set-up is either a stage on the way or a lasting split. In a staged migration, systems move in waves while replication keeps the copy at the destination current until each cutover; our guide to migrating VMs to a hosted VMware platform compares the methods, their downtime and re-IP. In a lasting split, systems tied to the site by latency, attached hardware, licences or data class stay on-premise and the rest runs hosted. Both are easier with the same hypervisor on both sides, since VMs and their replicas then move without conversion.

The link carries the replication and all traffic between systems on different sides, so size it for both. Run directory services and DNS at both sites, for example with a domain controller on each side, so that logins and name resolution keep working when the link fails, and keep one backup policy with restore tests on each side.

Exit and portability: what leaves the platform with you

Before signing, list what has to leave the platform at the end and in which format: VM disks and configuration, backups, templates, network and firewall settings, and the IP addresses your partners know. Between two vSphere platforms the VMs keep their virtual disks and configuration, provided the destination supports their virtual hardware version. Between VMware and KVM each guest has to be converted; virt-v2v from the libguestfs project converts guests from other hypervisors to run on KVM and can make them bootable there and install virtio drivers. A KVM private cloud for a VMware estate therefore means converting and testing every guest, and a later move back means another conversion.

Backups help with an exit only if you can restore them elsewhere, so ask in which format they are kept and whether you can take a copy. ENISA’s SME guide counts vendor lock-in among its cloud risks where data formats and interfaces are not standard, and advises migration or exit plans as part of business continuity. Since 12 September 2025 the EU Data Act has required cloud contracts to set notice, transitional and data retrieval periods, and from 12 January 2027 it allows no switching charges, as our guide to Data Act cloud switching sets out.

How to decide, system by system

Work from the inventory and decide per system:

1. Export the VM list with vCPU, RAM and storage per VM, and CPU and memory use over at least one month, peaks included.
2. Mark each system’s data class and any location requirement from law, contracts or your own policy.
3. Note software licensed per physical core, socket or host, and hardware attached to servers, such as USB licence dongles.
4. Map the dependencies and keep systems that exchange many requests on the same side of the link.
5. Put standard VMs on IaaS, systems with host-bound licences, strict security policies or large steady consumption on a private cloud, and leave site-bound systems on-premise.
6. Read the exit terms, then test a representative system on the target platform before you plan the migration waves.

We move systems step by step, in agreed maintenance windows with a rollback plan, and provide test access to the platform before migration. Describe the systems you would move first in the form below, and those that must stay on-premise.

What we do

Under our EU Cloud service we offer all three options, with the hosted part in Tier-3 data centres in the EU: IaaS with guaranteed vCPU, RAM and storage on the VMware vSphere platform, a self-service portal, snapshots and Veeam backup; a private cloud on VMware or KVM, dedicated to your organisation; and hybrid set-ups with replication between your site and the data centre. The data centres are Baltneta’s, in Lithuania, with ISO 27001 and PCI DSS, and you receive a transparent monthly invoice in euros under one contract with Eurokommerz. Our engineering partner Vixen.UNO handles migration and support. The first call is free of charge, the price of the technical assessment is fixed before work begins, and our security and compliance page lists the documents we sign.

FAQ