IONOS
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German publicly-listed cloud (IONOS Group SE, Frankfurt + Berlin DCs), first DE provider with both BSI C5 + IT-Grundschutz, Gaia-X member.
IONOS is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
IONOS Group SE (German parent, publicly listed on Frankfurt Stock Exchange, originally the 1&1 / United Internet group) operates IONOS Cloud from Frankfurt and Berlin data centres and is the first German cloud provider to hold both BSI C5 attestation and BSI IT-Grundschutz certification (the latter underpins its ISO/IEC 27001), plus active Gaia-X membership and a January 2026 cooperation with BSI for federal sovereign cloud; for EU customers contracting with the German entity, EU-owned and EU-hosted with no CLOUD Act exposure.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 0 none disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About IONOS
IONOS is the cloud and hosting arm of IONOS Group SE, a publicly-listed German company (Frankfurt Stock Exchange) descended from the 1&1 Internet / United Internet group, founded in 1988. The company operates from Karlsruhe and is one of the larger European hosting players, with millions of domains under management and a full product surface across web hosting, managed servers, cloud compute, cloud object storage (S3-compatible), Cloud Cubes, managed Kubernetes, and email. The cloud workload story is split between IONOS Inc. (Philadelphia, USA) for US customers and IONOS Group SE / IONOS SE (Germany) for EU customers. Buyers contracting through ionos.de / EU pricing pages contract with the German entity, which is what places EU-region workloads under German jurisdiction with no CLOUD Act exposure.
Compliance posture is among the strongest in the directory. IONOS Cloud was the first German cloud provider to demonstrate both the German government's BSI C5 attestation (Cloud Computing Compliance Criteria Catalogue) for Compute Engine, Cloud Cubes, and S3 Object Storage (received November 2023) and the BSI IT-Grundschutz certification, the underlying baseline for the ISO/IEC 27001 attestation IONOS Cloud holds for its Frankfurt and Berlin data centres and co-located capacity. The company is an active Gaia-X member (the European data-sovereignty initiative), is available to the German public sector through the govdigital sovereign-cloud framework, and announced a January 2026 cooperation agreement with the BSI focused on building a sovereign-cloud platform for the federal administration and post-quantum protection.
Pricing for IONOS Cloud Compute starts at €5.04 per 30 days for the smallest Basic Cube instance, billed by the minute with no commitment. The product surface, sales-locale, and EUR pricing on ionos.de make it a natural fit for German and broader-EU SMBs and public-sector buyers. Best fit: German public-sector procurement (govdigital path), regulated industries that need BSI C5 + IT-Grundschutz dual coverage, and any EU buyer wanting a Frankfurt-rooted hyperscaler-alternative with a public-listed German parent and a documented BSI cooperation roadmap. Note: customers who specifically use US-region services or sign up via ionos.com US pricing contract with IONOS Inc. (Philadelphia) and are subject to international data transfers under the IONOS Inc. privacy policy.
Sub-processor map · none disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of IONOS
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |