Compare Contabo Object Storage and IONOS on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Germany· Cloud Computing
Needs review
Shortlist when you want a Ceph S3 bucket next to Contabo VPS or VDS, can use path-style endpoints, and can live without S3 logging. Skip when you need Amazon-complete S3, a first-party custom TLS hostname, company-wide ISO 27001 or SOC 2, or a store with no US parent and no US region. Consider Hetzner Object Storage or OVHcloud Object Storage instead.
Germany· Cloud Computing
Needs review
Shortlist IONOS when you want a German-operated hosting + public cloud stack with EU location choice, managed Kubernetes, S3 storage, and public BSI-oriented cloud certifications for DACH buyers. Skip when you need hyperscaler service breadth, EU-only infrastructure with no US regions or US facility partners in the path, or lowest-cost bare metal—consider OVHcloud, Scaleway, Hetzner, or STACKIT instead depending on that gap.
Highlighted rows differ between the two products.
| Feature | Contabo Object Storage | IONOS |
|---|---|---|
| Country of origin | Germany | Germany |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | Germany |
| Legal entity | Contabo GmbH (Welfenstrasse 22, 81541 Munich; AG Munich HRB 180722; VAT DE267602842) | IONOS SE (HRB 24498, Amtsgericht Montabaur); group listed as IONOS Group SE |
| Governing law | Not listed | German / EU (confirm per contract and national affiliate) |
| US parent / control | US parent or control | No known US parent |
| CLOUD Act exposure (indicative) | High | Medium |
| Hosting / residency | Object storage sold in the EU (eu2.contabostorage.com), United States (usc1.contabostorage.com), and Singapore (sin1.contabostorage.com). Contabo operates its own data centers. No public object-storage subprocessor list. Management API auth is at auth.contabo.com. Official custom-domain docs use Cloudflare as an optional customer-side proxy, not as the S3 data plane. | IONOS-operated and partner facilities in Europe (e.g. Berlin, Frankfurt—including Equinix-operated sites—Paris, Logroño, London, Worcester, Karlsruhe) and the US (Las Vegas, Newark, Lenexa). Object Storage and compute location chosen per resource. Backup Service uses Acronis technology; managed backup path described as DE ISO 27001 centers. Optional Microsoft 365 / Google Workspace resale. |
| Summary | S3-compatible object storage from Munich-based Contabo GmbH, running on Ceph with EU, US, and Singapore endpoints. | German hosting and cloud provider (IONOS SE): domains and SMB web hosting plus IONOS Cloud IaaS/PaaS with EU and US locations, managed Kubernetes, object storage, and DBaaS. |
| Tags |
| At a glance | Contabo Object Storage | IONOS |
|---|---|---|
| HQ | Munich, Germany (Contabo GmbH, HRB 180722) | Montabaur, Germany (IONOS SE) |
| Product | Hosted Ceph S3 object storage | Not listed |
| S3 regions | EU (eu2), United States (usc1), Singapore (sin1) | Not listed |
| Addressing | Path-style; HTTPS only | Not listed |
| Commercial model | Purchased capacity with optional auto-scale; no per-GB egress on Contabo's stated model | Hosting packages + cloud usage (per-minute style) |
| Ownership | KKR majority (2022), Oakley Capital Fund V minority | Not listed |
| Group | Not listed | United Internet / IONOS Group SE (listed) |
| Product lines | Not listed | Domains & hosting + IONOS Cloud IaaS/PaaS |
| Cloud regions | Not listed | DE, FR, ES, UK + US (e.g. LAS, EWR, MCI) |
| Open source | Not listed | No (proprietary platform) |
| Self-host | Not listed | No |
| Key capabilities | Contabo Object Storage | IONOS |
|---|---|---|
| S3-compatible (partial) | Yes | Not listed |
| Ceph backend | Yes | Not listed |
| EU region available | Yes | Not listed |
| German GmbH | Yes | Not listed |
| In-panel DPA | Yes | Not listed |
| German SE (Montabaur) | Not listed | Yes |
| EU + US cloud regions | Not listed | Yes |
| Managed Kubernetes | Not listed | Yes |
| S3 Object Storage | Not listed | Yes |
| BSI C5 Type 1 (claimed) | Not listed | Yes |
| Domains + SMB hosting | Not listed | Yes |
Ceph S3 API with path-style buckets
Contabo states the store is Ceph-based and largely S3 compatible, not fully equivalent to Amazon S3. Logging is not supported. Official tool notes require Contabo S3 URLs, path-style buckets, and access_key/secret_key mapped to aws_access_key_id/aws_secret_access_key.
EU, US, and Singapore S3 endpoints
Documented base URLs are eu2.contabostorage.com (European Union), usc1.contabostorage.com (United States), and sin1.contabostorage.com (Singapore). The management API allows one object-storage purchase per location. All locations on an account share the same S3 credentials.
Bucket versioning and Object Lock
Versioning is enabled per bucket via s3api put-bucket-versioning on the regional endpoint. Suspending versioning stops new versions but does not delete old ones. Object Lock can be turned on at bucket creation (example uses GOVERNANCE mode) so objects cannot be overwritten or deleted for a retention period.
Capacity auto-scale via management API
The Contabo API (not the S3 API) orders, upgrades, cancels, and auto-scales purchased space up to a monthly size limit. Usage statistics are exposed there. The open-source cntb CLI (GPL-3.0) wraps the same management API. S3 keys come from the User Management API or the Object Storage panel.
Published client list and hard limits
Documented working tools include cntb, aws cli, rclone, Cyberduck, goofys, s3fs-fuse, s3cmd, WinSCP, Cloudberry Explorer, BucketAnywhere, Virtualmin, Velero, and Plesk. FileZilla Pro is listed as incompatible. Defaults include 5 TB max object size, 100 buckets, 3 million objects (increasable on request), 250 requests per second, and 10 MByte/s default bandwidth.
Virtual Data Center Designer and IaaS compute
Build isolated virtual data centers in the browser or via Cloud API: dedicated-core servers, vCPU servers, and Cubes with attached NVMe. Live vertical scaling is supported on many Linux images for cores, RAM, NICs, and volumes without a full rebuild. Locations span DE (Berlin, Frankfurt, Karlsruhe), FR, ES, UK, and US.
Managed Kubernetes without a separate control-plane fee
Automated cluster and node-pool setup with geo-redundant control plane, admin API access, and optional node auto-scaling. IONOS documents the managed control plane as free of charge; you pay for the underlying compute, storage, and network only—useful for staging and production clusters on the same contract.
S3-compatible Object Storage across EU and US endpoints
Contract-included Object Storage with S3 API compatibility, versioning, object lock, SSE-S3/SSE-C, and lifecycle rules. Documented endpoints include Frankfurt, Berlin, Logroño, and Lenexa (US). German object-storage locations are listed with BSI IT-Grundschutz compliance notes in the service catalog.
Managed databases, GPU VMs, and Berlin-hosted AI Model Hub
DBaaS for PostgreSQL, MongoDB, MariaDB, and in-memory DB; Cloud GPU VMs (NVIDIA H200 templates) in Frankfurt; AI Model Hub with OpenAI-compatible APIs, RAG/vector support, and vendor-stated processing exclusively in Germany (Berlin). Fits teams that want European inference without standing up their own GPU estate.
Domains, web hosting, and personal consultant for SMBs
Classic IONOS portfolio: domain registration, shared/VPS/dedicated hosting, site builders, and optional Microsoft 365 or Google Workspace. Differentiator for non-cloud buyers is a dedicated personal consultant plus 24/7 support channels—not pure ticket-only self-serve hosting.
| Assurance & compliance | Contabo Object Storage | IONOS |
|---|---|---|
| Independent security / no-logs audit | Not found Searched About, help, and product docs. No public independent audit PDF for Object Storage. | Partial BSI C5 Type 1 (2023 announcement) and IT-Grundschutz ISMS claims after external audit; not a public no-logs VPN-style audit. Request current reports and scope. |
| ISO 27001 | Partial Some Contabo location marketing pages list colocation-facility ISO 27001 (for example Singapore). No company-wide Contabo ISO 27001 certificate found. | Vendor claimed Vendor FAQ/about materials state ISO 27001 for data centers / security posture; facility partner cert PDFs also referenced on location pages. Independent cert registry entry not re-verified here. |
| SOC 2 / SOC 3 | Not found No Contabo-issued SOC 2 or SOC 3 report found. Facility-level SOC marks on some non-EU location pages are not treated as a Contabo attestation. | Not found SOC/SSAE-style attestations appear for some facility operators (e.g. Equinix listings). No clear IONOS product-level SOC 2 claim found on primary pages reviewed. |
| GDPR / EU data protection | Vendor claimed EU legal entity; DPA available in the Customer Control Panel and listed as covering Object Storage. EU region is optional, not exclusive. | Vendor claimed German controller/processor entities; EU location options; vendor GDPR statements. Residency still depends on selected regions and subprocessors. |
| US CLOUD Act exposure (indicative) | Partial Contabo GmbH is German, but KKR (US) has been the majority investor since June 2022 and Contabo sells a US object-storage region. Not legal advice. | Partial German SE / no known US parent, but US subsidiaries, US host regions (LAS/EWR/MCI), Equinix facility partnership, optional Microsoft/Google products, Acronis-powered backup. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Customer Control Panel wizard. Object Storage is an explicit covered service. Review the generated PDF. | Vendor claimed Hosting DPA via account privacy flows; IONOS Cloud AVV via account manager / contract docs. Confirm entity and service annex. |
| EU AI Act | Not applicable Object storage IaaS, not an AI system. | Partial Relevant mainly to AI Model Hub (docs discuss governance/compliance). Core hosting/IaaS is not AI-product-centric; treat AI Act as service-specific diligence. |
| BSI C5 (Cloud Computing Compliance Criteria Catalogue) | Not listed | Vendor claimed Company IR announcement 7 Nov 2023: C5 Type 1 for Compute Engine, Cloud Cubes, S3 Object Storage after external audit. Type 1 = design at a point in time; confirm current validity and product scope. |
| Considerations & known limitations | Contabo Object Storage | IONOS |
|---|---|---|
| US private-equity majority owner | High Oakley Capital announced in June 2022 that KKR would be majority investor, with Oakley Fund V retaining a minority stake. Treat CLOUD Act exposure as high at the ownership layer even when objects sit on eu2.contabostorage.com. | Not listed |
| Optional United States object region | Medium usc1.contabostorage.com is a first-party SKU. Shared credentials across locations make it easy to point a client at the US endpoint by mistake. Pin the EU URL if residency is a hard requirement. | Not listed |
| Partial S3 compatibility | Medium Contabo states the Ceph API is not fully compatible with AWS S3. Logging is unsupported. Path-style addressing is required. FileZilla Pro does not work. Test SDK features before migrating production. | Not listed |
| Default request and bandwidth caps | Medium Published defaults include 250 API requests per second, 10 MByte/s bandwidth, 100 buckets, and 3 million objects. Auto-scale increases purchased terabytes, not those caps. | Not listed |
| No public company-wide audit | Medium No independent Object Storage audit, Contabo-issued ISO 27001, or SOC 2 report was found. Facility ISO/SOC marks on some location pages are not a substitute. | Not listed |
| No first-party custom TLS hostname | Low HTTPS-only S3 endpoints reject a simple CNAME. Public websites need a customer-operated reverse proxy. Public-to-private ACL changes may remain cached for up to one hour. | Not listed |
| US regions, US entities, and facility partners | Not listed | Medium Selecting US locations places data in the US. Even EU-only deployments sit in a group that has US subsidiaries and uses partners such as Equinix for some EU facilities—material for CLOUD Act / transfer reviews. |
| No clear public subprocessor catalogue | Not listed | Medium Unlike many pure SaaS vendors, a single customer-facing subprocessor list was not found. Buyers must extract partners from location pages, DPA annexes, and product docs (Equinix, Acronis, Microsoft, Google, etc.). |
| C5 Type 1 scope and freshness | Not listed | Low Public C5 claim is Type 1 for specific products (Compute Engine, Cubes, Object Storage) as of the 2023 announcement. Not a blanket certificate for every IONOS product; request up-to-date reports. |
| Narrower managed ecosystem than hyperscalers | Not listed | Low Strong IaaS and selected PaaS, but not a full AWS/Azure service catalogue. Multi-region global apps and niche managed services may force multi-cloud or a different primary vendor. |
| Hosting brand vs cloud platform complexity | Not listed | Low SMB hosting contracts, reseller office suites, and enterprise cloud AVVs are different commercial and compliance surfaces—do not assume one DPA covers every SKU. |
When: You want a German hoster's object store with an EU-concentrated footprint and no US majority PE owner
Consider: Hetzner Object Storage
Contabo's own comparison places Hetzner object storage in European data centers and notes a thinner APAC story.
When: You need a broader EU compliance portfolio (ISO 27001, SecNumCloud) more than a simple capacity bill
Consider: OVHcloud Object Storage
Billing and product surface are more complex than Contabo's single-account IaaS stack.
When: You need managed Kubernetes or managed Postgres next to S3, not just raw buckets
Consider: Scaleway Object Storage
France-first footprint. Contabo does not sell first-party managed databases or Kubernetes.
When: You need Amazon-complete S3 (logging, IAM, global regions) and will accept a US cloud
Consider: Amazon S3
Use Contabo only after you have tested the Ceph compatibility gaps against your SDK.
When: You want French-operated cloud with strong developer packaging and EU focus without a mass-market hosting brand
Consider: Scaleway
Different product mix; compare region map and managed services side by side.
When: You prioritize large European hosting/cloud scale and multi-country DC ownership narratives
Consider: OVHcloud
Both are EU groups with non-trivial international footprints—read residency options carefully.
When: You mainly need cost-efficient dedicated servers or simple cloud in DE/FI with minimal PaaS
Consider: Hetzner
Thinner managed layer; different support and SMB hosting model.
When: You are already in Schwarz Group ecosystems or need STACKIT-specific public-cloud positioning
Consider: STACKIT
Narrower commercial brand than IONOS hosting+cloud combo.