European Cloud Providers Compared: A Buyer's Framework

Lists of European cloud providers tend to group vendors by product range: virtual machines here, managed Kubernetes there, GPUs somewhere else. That is a reasonable first filter, but it does not answer the questions procurement, security and audit teams will ask later.

There is also a vocabulary problem. No official definition of "sovereign cloud" exists, so both European and US providers market their services as sovereign [S55]. A useful comparison therefore has to rest on features you can check, not on labels.

1. Jurisdiction: who owns the provider, and which law applies?

Data location alone does not protect data from foreign government access. US law requires providers of electronic communication and remote computing services to preserve and disclose data in their possession, custody or control, regardless of whether that data is located inside or outside the United States [W2]. The rule was introduced in 2018 through the CLOUD Act [W2][S55]. An analysis by the Cloud Legal Project at Queen Mary University of London concludes that data residency (the geographic location) and data sovereignty (exposure to foreign government access) are different things [S55].

The same analysis cautions against the reverse assumption. A European company can also be subject to US jurisdiction, depending on whether it serves US customers, holds assets or staff in the US, and how independent any US subsidiary is. That calls for a case-by-case assessment [S55].

Since 12 September 2025 buyers have a practical tool for this. The EU Data Act requires providers of data processing services to publish on their website the jurisdiction to which the ICT infrastructure of each service is subject, together with a general description of the technical, organisational and contractual measures they use to prevent unlawful international governmental access to non-personal data (Article 28) [W1][W14]. Those disclosures are the first item to check for any shortlisted provider.

2. Location: where do data, backups and support actually sit?

A European provider does not necessarily mean European regions only. IONOS Cloud lists data centres in Frankfurt, Berlin, Paris, London, Worcester and Logroño, and also in Las Vegas, Newark and Lenexa in the United States [W6]. Hetzner offers cloud locations in Falkenstein and Nuremberg (Germany) and Helsinki (Finland), as well as Ashburn and Hillsboro (US) and Singapore. According to Hetzner, it owns its data centre parks only in Germany and Finland and uses colocation space elsewhere [W10].

STACKIT states that it runs seven data centres in Germany and Austria [W7]. T Cloud Public describes a twin-core region in Biere and Magdeburg in Germany, further European regions in the Netherlands and complementary offerings in Switzerland [W11]. OVHcloud lists regions including France and Limburg in Germany [W15].

In practice, the region must be fixed in the contract, and the review should cover backups, logs and support access, not just production data.

3. Evidence: which services does an attestation really cover?

In Germany the key benchmark is the BSI's C5 criteria catalogue, which sets minimum requirements for secure cloud computing. Auditors assess whether the criteria are met at the time of the examination and, depending on the type of engagement, whether they were also met over a period. The BSI explicitly advises customers to request the audit report from the provider and evaluate it as part of their own risk analysis [W3].

Scope is what matters. An attestation covers specific services, not the whole company:

• IONOS received a C5 Type 1 attestation in November 2023 for Compute Engine, Cloud Cubes and S3 Object Storage [W5].
• STACKIT received a C5 Type 2 attestation in August 2024 for its IaaS services Compute Engine, Network & Security, Block Storage and Object Storage [W8]. Its facts page now refers to 21 attested cloud products [W7].
• T Cloud Public states BSI C5:2020 Type II, ISO 27001 and TISAX [W11].
• Hetzner states ISO/IEC 27001:2022 certification without exclusions and a C5 Type 2 attestation for its cloud services [W16].
• OVHcloud holds the French SecNumCloud qualification from ANSSI for selected offerings, such as Managed VMware vSphere (since December 2020) and SNC Cloud Platform (since September 2026) [W9]. It also lists ISO/IEC 27001:2022, 27017, 27018 and 27701 for a set of products that includes Public Cloud Instances [W17].

Type 1 confirms that controls are suitably designed at a point in time, while Type 2 also covers their operating effectiveness over a period [W3][W8]. The BSI has since published C5:2026, which builds on C5:2020 [W4]. For any attestation, ask which version it was issued against and which period it covers.

4. Portfolio and migration effort

For core infrastructure the gaps are smaller than often assumed. A master's thesis from LUT University, which assessed migrating an AWS reference architecture to OVHcloud, Hetzner and Scaleway using provider documentation, found that container orchestration, scalable compute, storage and infrastructure-as-code automation are available at all three [S34].

The limits lie elsewhere. The same study identifies managed services and provider-specific interfaces as the main source of dependency. Many functions that AWS offers as integrated tooling can be rebuilt with open-source tools, but with more setup effort and more operational responsibility [S34]. The assessment is qualitative and based on documentation rather than measurement, but it points in the right direction: the more an application relies on proprietary platform services, the larger the rework.

5. Cost and exit

The list price of a virtual machine is rarely the deciding number. Data transfer and switching costs matter more. Hetzner, for example, bills traffic between network zones, such as between Europe and the US, like normal internet traffic [W10]. If you mix locations, model those data flows in advance.

On exit, the EU Data Act has changed the picture:

• Contracts must allow customers, on request, to switch to another provider or to on-premises infrastructure, with a transitional period of no more than 30 calendar days (Article 25) [W1].
• From 12 January 2027, providers may not charge switching fees. Until then, only reduced charges are allowed, capped at the costs directly linked to the switch (Article 29) [W1].
• For pure infrastructure services, providers must take all reasonable measures to help the customer achieve functional equivalence at the destination (Article 30) [W1].

The regulation entered into force on 11 January 2024 and has applied since 12 September 2025 [W14]. Exit clauses belong in every contract review, including with European providers. For background, see our article on the end of cloud switching fees.

The table summarises the providers' public statements as of 15 October 2026. It is not a ranking and does not replace a review of the documents.

Provider	Legal entity (provider statement)	Locations (provider statement)	Evidence (examples, check scope)	What to check
IONOS Cloud	IONOS SE, Montabaur [W13]	Germany, other EU countries, UK, US [W6]	C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage (2023) [W5]	Fix the region in the contract; assess any US nexus case by case
STACKIT	Schwarz Digits Cloud GmbH & Co. KG, part of Schwarz Group [W7]	Germany and Austria [W7]	C5 Type 2, 21 attested products per provider [W7][W8]	Request the report; match product scope
OVHcloud	OVH SAS, Roubaix, subsidiary of OVH Groupe SA [W18]	Including France and Germany (Limburg) [W15]	SecNumCloud for selected offerings; ISO/IEC 27001 incl. Public Cloud Instances [W9][W17]	Qualification and certificate apply per product
Hetzner	Hetzner Online GmbH, Gunzenhausen [W12]	Germany, Finland, US, Singapore [W10]	ISO/IEC 27001:2022; C5 Type 2 for cloud services [W16]	Choice of location; traffic between zones
T Cloud Public	Part of Deutsche Telekom's T Cloud [W11]	Germany (Biere/Magdeburg), Netherlands, offerings in Switzerland [W11]	BSI C5:2020 Type II, ISO 27001, TISAX [W11]	Match region and service scope

Other European providers such as Scaleway, UpCloud or Exoscale may also fit, depending on requirements. They were not reviewed against primary sources for this article.

Some providers make their own sovereignty claims. STACKIT, for instance, states that its infrastructure runs exclusively in European data centres without being subject to the US CLOUD Act [W7]. Treat such statements as provider claims and cross-check them against the Article 28 disclosures and the contract.

A European provider reduces certain risks but does not replace an assessment. Sovereignty covers more than jurisdiction: operational control, key management, subcontractors, portability and audit evidence all matter. Our article Cloud Sovereignty: Beyond Data Residency works through those dimensions.

Many organisations will not move everything either. The QMUL analysis describes enterprises combining hyperscale services for less sensitive workloads with European or private environments for sensitive data, while noting that hybrid and multi-cloud set-ups add complexity [S55]. Provider choice then becomes a per-workload decision rather than a company-wide one. The trade-offs of concentrating on one provider are covered in Concentration Risk, Lock-In, and Exit.

Location, attestation and legal-entity details come from the providers and can change. Attestation reports were not read in full; their scope is reported as published. The migration findings come from a single qualitative study that reviewed documentation and did not run load tests [S34]. Prices were deliberately left out because they change often and are rarely comparable across architectures.

This article provides technical and operational analysis, not legal advice. Applicability depends on the organisation, service, contract, jurisdiction and facts.

1. Classify workloads by protection needs, data type and reliance on platform services. 2. Retrieve each candidate's Article 28 Data Act disclosure on infrastructure jurisdiction. 3. Request the C5 report or equivalent evidence and match its scope to the services you plan to use. 4. Fix the region, backup location and support access in the contract. 5. Model data flows between regions and providers before mixing locations. 6. Review exit clauses under Articles 25 and 29 of the Data Act and document an exit plan.

In the end, the provider's origin matters less than the fit between workload, cost and requirements. That is the question Atomity answers: we compare where your workloads run best on cost, compliance and sovereignty criteria, across AWS, Azure and Google Cloud as well as IONOS, STACKIT, OVHcloud, Hetzner and Open Telekom Cloud. To see which providers fit your workloads, start with a free cloud cost check.