Contabo
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted This listing EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Munich-based budget VPS / dedicated hosting (Contabo GmbH); KKR + Oakley-owned since 2022; 11 global DCs; VPS from €5.50/month on a 24-month term.
Contabo offers EU hosting in Germany, but a US parent or sub-processor leaves material CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Munich-based German GmbH (Contabo GmbH, HRB 180722 AG München, VAT DE267602842, founded 2003 by Stephan Wolfram and Mario Wilhelm) running 450k+ servers across 11 global locations; in June 2022 KKR (US private equity) together with Oakley Capital (UK) acquired the majority of the company, and the data-centre footprint includes three US locations plus Singapore/Japan/India/Australia alongside the EU regions; the US-PE majority parent means material CLOUD Act exposure at the parent-jurisdiction layer, and ownership is classified as eu_hq_us_funded rather than eu_owned.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded This listing EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: No
-
Public DPA: No
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: No
Jump to
About Contabo
Contabo is a Munich-based German cloud-and-hosting provider operated by Contabo GmbH (Welfenstrasse 22, 81541 Munich; HRB 180722 at Amtsgericht München; VAT DE267602842; managing directors Stephan Wolfram and Mario Wilhelm). Founded in 2003 and positioned in the budget VPS / dedicated-server tier, Contabo reports more than 225,000 customers across 190 countries running on 450,000+ servers in nine global regions and eleven data-centre locations: European Union, United Kingdom, three United States locations, Singapore, Japan, India, and Australia. Pricing is the headline feature: Cloud VPS 4 starts at €5.50 per month for 4 vCores and 8 GB RAM, a rate Contabo's own footnote describes as the effective monthly price on a 24-month subscription, and the product surface covers Cloud VPS, Virtual Dedicated Servers, bare-metal dedicated servers, object storage, domain registration, and managed application hosting for n8n, Nextcloud, GitLab, and similar.
For an EU-sovereignty audit the listing is mixed. The German GmbH legal structure, Munich HQ, Frankfurt-area data centres, and EU footprint look natively European, but in June 2022 a consortium led by KKR, the US private-equity giant (Kohlberg Kravis Roberts, New York), together with Oakley Capital (UK) acquired the majority of Contabo alongside the management team. KKR's US-incorporation gives Contabo material CLOUD Act exposure at the parent-jurisdiction layer regardless of where the EU customer's specific VM runs. Additionally, three of Contabo's eleven data centres are in the United States, which means buyers who don't pin their workloads explicitly to EU regions may end up on US infrastructure. The DPA and security URLs returned 404 at audit; certifications are not advertised on accessible public pages.
Best fit: indie developers, small SaaS builders, gamers, and prosumers who prioritise low VPS price over enterprise compliance. Contabo is one of the cheapest credible European VPS providers globally. Procurement-grade EU buyers needing a strict EU-controlled cloud should prefer Hetzner (DE, family-owned), Scaleway (FR, Iliad), OVHcloud (FR, public Euronext), or STACKIT (DE, Schwarz Group / Lidl), listed above in this category. Contabo serves a complementary, price-led use case rather than a compliance-led one.
Sub-processor map · not disclosed
Frameworks & certifications · none listed
Capability matrix
Table 1Capabilities of Contabo
Integration & access
Compliance & governance
Pricing & tiers
Public documents
-
missingData Processing Addendum (DPA)— missing
-
missingSub-processors list— missing
-
OpenTerms of Servicecontabo.com/en…
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |