Skip to content
Independently verified · Quarterly re-audit
EU VETTED
Category 08 of 22

Cloud & hosting

In short

Cloud and hosting services provide the compute, storage, and network infrastructure on which applications and workloads run. For EU buyers, the key criteria are ownership of the infrastructure provider and hosting region, specifically whether the consolidated group is subject to US CLOUD Act jurisdiction. Leading EU-owned, EU-hosted options on EU Vetted with no CLOUD Act exposure include Hetzner (Germany), Scaleway (France), OVHcloud (France), IONOS (Germany), and Cleura (Sweden).

About this category
About Cloud & hosting

Cloud and hosting covers the infrastructure layer: virtual machines, bare-metal servers, object storage, managed databases, Kubernetes clusters, and the network fabric that connects them. This category includes general-purpose public cloud providers (Hetzner, OVHcloud, Scaleway, IONOS), private cloud and managed hosting specialists (Cleura, Exoscale, STACKIT, Stackscale), and sovereign cloud offerings targeting regulated industries. It does not cover SaaS applications that run on top of this infrastructure.

For EU organisations, the ownership question in this category carries disproportionate weight compared to other software categories, because the cloud infrastructure provider has physical access to everything you run on it. If the infrastructure operator is a US-incorporated company (or has a US parent), the CLOUD Act can compel the consolidated group to produce data it controls regardless of where servers are physically located. This is why AWS Europe, Google Cloud Frankfurt, and Azure Netherlands all remain within CLOUD Act jurisdiction: the operating entity is ultimately controlled by a US parent. EU-owned providers such as Hetzner (Germany), Scaleway (France), OVHcloud (France), IONOS (Germany), and UpCloud (Finland) are not subject to that direct exposure.

The second dimension specific to this category is regulatory certification. For regulated workloads (public sector, healthcare, financial services, critical infrastructure), the relevant certifications are BSI C5 (Germany), SecNumCloud (France), ISO 27001, and the emerging EUCS (European Union Cloud Service) scheme currently under development by ENISA. STACKIT and T Cloud Public (both Germany) hold BSI C5 attestations and are frequently used for German regulated-sector workloads. OVHcloud and Scaleway are among the front-runners for the EUCS Sovereign tier. Each provider's certification status is tracked separately from its ownership signal and CLOUD Act exposure, so the two dimensions can be weighed independently.

Feature comparison

Beyond compliance: how these alternatives compare on the capabilities you actually use day to day.

Feature Cleura Clever Cloud Exoscale Hetzner Infomaniak Public Cloud IONOS OVHcloud Scaleway STACKIT Stackscale T Cloud Public (formerly Open Telekom Cloud) UpCloud Aruba Cloud Contabo Intility Thalassa Cloud
Dedicated / bare-metal No No Yes No Yes Yes Yes No Yes Yes No Yes Yes No No
Object storage (S3) Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes Yes Yes Yes No Yes
Managed Kubernetes Yes No Yes No Yes Yes Yes Yes Yes No Yes Yes Yes No Yes Yes
Managed databases Yes Yes Yes No Yes Yes Yes Yes Yes No Yes Yes Yes No Yes Yes
GPU instances No Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes No No
Hourly billing Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes Yes Yes No No Yes
API / Terraform Yes Yes Yes Yes Yes Yes Yes Yes Yes No Yes Yes Yes Yes No Yes
Countries 2 countries 8 countries 5 countries 4 countries 2 countries 5 countries 9 countries 3 countries 2 countries 3 countries 2 countries 12 countries 6 countries 7 countries 2 countries 1 countries
SWITCHING GUIDES

Switching from US cloud & hosting?

Side-by-side European alternatives (same hosting, ownership and CLOUD Act checks) for the US tools most often replaced in this category.

FAQ

Frequently asked questions

What is the best EU cloud hosting provider?
Hetzner (Germany), Scaleway (France), OVHcloud (France), IONOS (Germany), Cleura (Sweden), STACKIT (Germany), UpCloud (Finland), Aruba Cloud (Italy), Stackscale (Spain), and T Cloud Public (Germany) are all EU-owned and EU-hosted providers that sit outside CLOUD Act jurisdiction. The right choice depends on workload type and team size: Hetzner is the price-performance leader for developers; Scaleway and OVHcloud have the broadest managed services; STACKIT and T Cloud Public target large German enterprises with BSI C5 credentials.
Does cloud hosting fall under the US CLOUD Act?
If the cloud provider is owned or ultimately controlled by a US-incorporated company, the CLOUD Act can compel it to produce data it controls regardless of where that data is physically hosted. AWS, Google Cloud, Azure, and DigitalOcean are all US-owned. EU-owned providers such as Hetzner, OVHcloud, Scaleway, and IONOS are not directly subject to the CLOUD Act. This is an assessment of corporate ownership, not a claim that EU providers are immune from all legal process. They are subject to EU and member-state law instead.
Is there a GDPR-compliant cloud provider?
EU-incorporated cloud providers with EU-only data centres and published DPAs are GDPR-compliant in their role as data processors. Hetzner, OVHcloud, Scaleway, and IONOS all publish detailed DPAs. The term 'GDPR-compliant cloud' is widely used but the compliance burden lies primarily with how the customer architect and operates the workload. The provider's compliance is a necessary but not sufficient condition.
What is BSI C5 or SecNumCloud, and which EU hosting providers have it?
BSI C5 (Cloud Computing Compliance Criteria Catalogue) is a German federal security framework for cloud services, audited by accredited third parties. It is broadly equivalent to ISO 27001 but with additional transparency and sovereignty requirements. STACKIT (Germany) and T Cloud Public (Germany) hold BSI C5 attestations, making them common picks for German public-sector and regulated-industry workloads. SecNumCloud is the French equivalent, developed by ANSSI; OVHcloud and Scaleway hold or are pursuing SecNumCloud qualification, which is a leading indicator for the EUCS Sovereign tier under development.
What is the difference between EU-hosted and EU-owned cloud?
EU-hosted means the physical servers and data centres are in the EU. Data at rest is on European soil. EU-owned means the company controlling the infrastructure is incorporated and headquartered in the EU, with no ultimate US parent. Both matter, for different reasons. EU-hosted without EU-owned means a US company's legal team can potentially be compelled to access data via CLOUD Act. EU-owned with EU-hosted means the legal exposure is to EU and member-state law only. The listings on this page show both dimensions separately.
How does Hetzner compare to AWS and Google Cloud for a typical startup workload?
Hetzner (Germany, EU-owned, EU-hosted, no CLOUD Act exposure) offers significantly lower compute prices than AWS and Google Cloud for equivalent virtual machines, roughly 3–5x cheaper for standard workloads. The trade-off is a narrower managed-services catalogue: Hetzner has excellent bare-metal, VPS, and object storage, but lacks the AI/ML pipeline, serverless, and PaaS breadth of AWS or GCP. For startups whose primary constraint is compute cost and who can adopt managed services from other EU providers (e.g. Scaleway Functions, IONOS databases), Hetzner is typically the price-performance leader in the EU.
Are EU cloud providers suitable for regulated workloads such as healthcare or financial services?
Yes, for most regulated workloads. STACKIT (Germany) and T Cloud Public (Germany) hold BSI C5 attestations and are regularly used for KRITIS-adjacent workloads. OVHcloud and Scaleway are ISO 27001 certified and are in use in financial services across the EU. The specific certification required depends on your regulation and member state: DORA (financial), NIS2, HIPAA (if serving US healthcare), and sectoral frameworks from national regulators. Check each provider's compliance page against your specific framework requirements.