Compare Contabo Object Storage and gridscale on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Germany· Cloud Computing
Needs review
Shortlist when you want a Ceph S3 bucket next to Contabo VPS or VDS, can use path-style endpoints, and can live without S3 logging. Skip when you need Amazon-complete S3, a first-party custom TLS hostname, company-wide ISO 27001 or SOC 2, or a store with no US parent and no US region. Consider Hetzner Object Storage or OVHcloud Object Storage instead.
Germany· Cloud Computing
Needs review
Shortlist when you need a German GmbH cloud with EU/CH/AT location choice, managed Kubernetes/databases, and Hybrid Core white-label HCI. Skip when you need global hyperscaler coverage or pure lowest-cost VMs—consider Hetzner for cost-sensitive compute or AWS/Azure for worldwide breadth; use OVHcloud parent portfolio when scale across more European regions is the priority.
Highlighted rows differ between the two products.
| Feature | Contabo Object Storage | gridscale |
|---|---|---|
| Country of origin | Germany | Germany |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | Germany |
| Legal entity | Contabo GmbH (Welfenstrasse 22, 81541 Munich; AG Munich HRB 180722; VAT DE267602842) | gridscale GmbH, Oskar-Jäger-Straße 173, 50825 Köln (HRB 97235, Amtsgericht Cologne) |
| Governing law | Not listed | German law (GTC; English GTC for information only—German prevails) |
| US parent / control | US parent or control | No known US parent |
| CLOUD Act exposure (indicative) | High | Medium |
| Hosting / residency | Object storage sold in the EU (eu2.contabostorage.com), United States (usc1.contabostorage.com), and Singapore (sin1.contabostorage.com). Contabo operates its own data centers. No public object-storage subprocessor list. Management API auth is at auth.contabo.com. Official custom-domain docs use Cloudflare as an optional customer-side proxy, not as the S3 data plane. | Customer infrastructure marketed on European Tier 3 locations (Frankfurt multi-AZ, Eichenzell, Hannover, Paderborn, Amsterdam, Gais, Lucerne, Vienna); some Hybrid Core sites partner-operated (hosttech, rhöncloud, BAIONITY, windCORES). Privacy policy also lists US-group ancillary processors: Stripe (payments), Google Analytics/GTM, Microsoft Bing Ads, Meta, LinkedIn; Mautic on-prem DE; Recruitee NL. No public claim that primary VM storage runs on AWS/GCP/Azure. |
| Summary | S3-compatible object storage from Munich-based Contabo GmbH, running on Ceph with EU, US, and Singapore endpoints. | Cologne-based German IaaS/PaaS and Hybrid Core HCI cloud (OVHcloud group) with European locations, managed Kubernetes, and white-label private cloud options for DACH teams. |
| Tags |
| At a glance | Contabo Object Storage | gridscale |
|---|---|---|
| HQ | Munich, Germany (Contabo GmbH, HRB 180722) | Cologne, Germany |
| Product | Hosted Ceph S3 object storage | Not listed |
| S3 regions | EU (eu2), United States (usc1), Singapore (sin1) | Not listed |
| Addressing | Path-style; HTTPS only | Not listed |
| Commercial model | Purchased capacity with optional auto-scale; no per-GB egress on Contabo's stated model | B2B; trial then per-minute usage metering |
| Ownership | KKR majority (2022), Oakley Capital Fund V minority | Not listed |
| Legal entity | Not listed | gridscale GmbH (HRB 97235) |
| Parent | Not listed | OVHcloud (100% since Sept 2023) |
| Hosting | Not listed | European Tier 3 sites DE/NL/CH/AT (+ partners) |
| Open source | Not listed | No (API/IaC clients only) |
| Key capabilities | Contabo Object Storage | gridscale |
|---|---|---|
| S3-compatible (partial) | Yes | Not listed |
| Ceph backend | Yes | Not listed |
| EU region available | Yes | Not listed |
| German GmbH | Yes | Not listed |
| In-panel DPA | Yes | Not listed |
| EU-operated (DE entity) | Not listed | Yes |
| Multi-country EU/CH locations | Not listed | Yes |
| Managed Kubernetes | Not listed | Yes |
| Hybrid Core HCI | Not listed | Yes |
| BSI C5 (claimed) | Not listed | Yes |
| OVHcloud group | Not listed | Yes |
Ceph S3 API with path-style buckets
Contabo states the store is Ceph-based and largely S3 compatible, not fully equivalent to Amazon S3. Logging is not supported. Official tool notes require Contabo S3 URLs, path-style buckets, and access_key/secret_key mapped to aws_access_key_id/aws_secret_access_key.
EU, US, and Singapore S3 endpoints
Documented base URLs are eu2.contabostorage.com (European Union), usc1.contabostorage.com (United States), and sin1.contabostorage.com (Singapore). The management API allows one object-storage purchase per location. All locations on an account share the same S3 credentials.
Bucket versioning and Object Lock
Versioning is enabled per bucket via s3api put-bucket-versioning on the regional endpoint. Suspending versioning stops new versions but does not delete old ones. Object Lock can be turned on at bucket creation (example uses GOVERNANCE mode) so objects cannot be overwritten or deleted for a retention period.
Capacity auto-scale via management API
The Contabo API (not the S3 API) orders, upgrades, cancels, and auto-scales purchased space up to a monthly size limit. Usage statistics are exposed there. The open-source cntb CLI (GPL-3.0) wraps the same management API. S3 keys come from the User Management API or the Object Storage panel.
Published client list and hard limits
Documented working tools include cntb, aws cli, rclone, Cyberduck, goofys, s3fs-fuse, s3cmd, WinSCP, Cloudberry Explorer, BucketAnywhere, Virtualmin, Velero, and Plesk. FileZilla Pro is listed as incompatible. Defaults include 5 TB max object size, 100 buckets, 3 million objects (increasable on request), 250 requests per second, and 10 MByte/s default bandwidth.
Panel + API + Terraform provisioning
Deploy VMs with attached storage in seconds via the control panel or automate with the REST API and common IaC clients (Terraform, Packer). Built for teams that want both click-ops and git-ops without a hyperscaler control-plane learning curve.
Managed Kubernetes, databases, and load balancers
PaaS layers cover managed Kubernetes orchestration plus fully managed databases with audit logs and automatic backups, and managed load balancers for traffic distribution—so app teams avoid running the full stack themselves.
S3-compatible object storage and Rocket NVMe storage
Object storage follows S3-style APIs for backups, archives, and unstructured data, with region choice called out for GDPR-oriented placement. Rocket Storage targets high-IOPS NVMe workloads; not every Hybrid Core location exposes object storage—check the data-center matrix.
Per-minute GPU bare-metal for AI/ML
GPU instances are marketed as dedicated bare-metal performance for AI/ML and data science, with CPU, RAM, and storage included and usage billed by the minute rather than only long-term reserved shapes.
Hybrid Core Concierge HCI and white-label cloud
Fully managed hyperconverged packages combine hardware delivery, installation, remote operations, white-label branding/SAML options, and access to the wider gridscale location ecosystem—aimed at enterprises and hosters building private or partner clouds.
| Assurance & compliance | Contabo Object Storage | gridscale |
|---|---|---|
| Independent security / no-logs audit | Not found Searched About, help, and product docs. No public independent audit PDF for Object Storage. | Not applicable IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required. |
| ISO 27001 | Partial Some Contabo location marketing pages list colocation-facility ISO 27001 (for example Singapore). No company-wide Contabo ISO 27001 certificate found. | Vendor claimed Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification. |
| SOC 2 / SOC 3 | Not found No Contabo-issued SOC 2 or SOC 3 report found. Facility-level SOC marks on some non-EU location pages are not treated as a Contabo attestation. | Not found No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard). |
| GDPR / EU data protection | Vendor claimed EU legal entity; DPA available in the Customer Control Panel and listed as covering Object Storage. EU region is optional, not exclusive. | Vendor claimed German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing. |
| US CLOUD Act exposure (indicative) | Partial Contabo GmbH is German, but KKR (US) has been the majority investor since June 2022 and Contabo sells a US object-storage region. Not legal advice. | Partial EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Customer Control Panel wizard. Object Storage is an explicit covered service. Review the generated PDF. | Vendor claimed GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone. |
| EU AI Act | Not applicable Object storage IaaS, not an AI system. | Not applicable Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model. |
| ISO 27017 (cloud security) | Not listed | Vendor claimed Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates. |
| ISO 27018 (cloud PII) | Not listed | Vendor claimed Claimed on compliance/about materials; request current scope. |
| ISAE 3402 SOC 1 Type 2 | Not listed | Vendor claimed About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report. |
| BSI C5 | Not listed | Vendor claimed Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation. |
| Trusted Cloud (DE) | Not listed | Vendor claimed Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de. |
| Considerations & known limitations | Contabo Object Storage | gridscale |
|---|---|---|
| US private-equity majority owner | High Oakley Capital announced in June 2022 that KKR would be majority investor, with Oakley Fund V retaining a minority stake. Treat CLOUD Act exposure as high at the ownership layer even when objects sit on eu2.contabostorage.com. | Not listed |
| Optional United States object region | Medium usc1.contabostorage.com is a first-party SKU. Shared credentials across locations make it easy to point a client at the US endpoint by mistake. Pin the EU URL if residency is a hard requirement. | Not listed |
| Partial S3 compatibility | Medium Contabo states the Ceph API is not fully compatible with AWS S3. Logging is unsupported. Path-style addressing is required. FileZilla Pro does not work. Test SDK features before migrating production. | Not listed |
| Default request and bandwidth caps | Medium Published defaults include 250 API requests per second, 10 MByte/s bandwidth, 100 buckets, and 3 million objects. Auto-scale increases purchased terabytes, not those caps. | Not listed |
| No public company-wide audit | Medium No independent Object Storage audit, Contabo-issued ISO 27001, or SOC 2 report was found. Facility ISO/SOC marks on some location pages are not a substitute. | Not listed |
| No first-party custom TLS hostname | Low HTTPS-only S3 endpoints reject a simple CNAME. Public websites need a customer-operated reverse proxy. Public-to-private ACL changes may remain cached for up to one hour. | Not listed |
| Parent-group integration after OVHcloud acquisition | Not listed | Medium 100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation. |
| Partner-operated Hybrid Core locations | Not listed | Medium Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording. |
| US-group ancillary processors (account/marketing) | Not listed | Medium Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only. |
| Certifications need current attestation packs | Not listed | Low BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone. |
| Narrower global footprint than hyperscalers | Not listed | Low Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services). |
When: You want a German hoster's object store with an EU-concentrated footprint and no US majority PE owner
Consider: Hetzner Object Storage
Contabo's own comparison places Hetzner object storage in European data centers and notes a thinner APAC story.
When: You need a broader EU compliance portfolio (ISO 27001, SecNumCloud) more than a simple capacity bill
Consider: OVHcloud Object Storage
Billing and product surface are more complex than Contabo's single-account IaaS stack.
When: You need managed Kubernetes or managed Postgres next to S3, not just raw buckets
Consider: Scaleway Object Storage
France-first footprint. Contabo does not sell first-party managed databases or Kubernetes.
When: You need Amazon-complete S3 (logging, IAM, global regions) and will accept a US cloud
Consider: Amazon S3
Use Contabo only after you have tested the Ceph compatibility gaps against your SDK.
When: You need the broader European hyperscale portfolio and more regions under one group brand
Consider: OVHcloud
OVHcloud is the parent group; gridscale stays the HCI/panel-focused product line
When: Cost-sensitive VMs or dedicated servers dominate and you do not need Hybrid Core white-label
Consider: Hetzner
Hetzner typically wins raw price/performance for simple compute
When: France-centric developer cloud with different location and product skew
Consider: Scaleway
Compare ARM options and FR footprint versus gridscale DACH Hybrid Core
When: Swiss-rooted EU cloud positioning is the primary evaluation criterion
Consider: Exoscale
Still compare DE/CH site maps and managed service depth side by side
When: You need worldwide regions, marketplace depth, or US-public-sector cloud programmes
Consider: Amazon Web Services (AWS) or Microsoft Azure
Trade EU-entity simplicity for hyperscaler breadth and US ownership path