Compare Contabo Object Storage and OVHcloud on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Germany· Cloud Computing
Needs review
Shortlist when you want a Ceph S3 bucket next to Contabo VPS or VDS, can use path-style endpoints, and can live without S3 logging. Skip when you need Amazon-complete S3, a first-party custom TLS hostname, company-wide ISO 27001 or SOC 2, or a store with no US parent and no US region. Consider Hetzner Object Storage or OVHcloud Object Storage instead.
France· Cloud Computing
Needs review
Shortlist OVHcloud when you need a European-owned IaaS/bare-metal stack with SecNumCloud/HDS options and multi-continent regions you control per project. Skip when you need hyperscaler platform depth, or when even optional US subsidiaries/regions are a procurement red line—consider Scaleway for leaner French cloud or Hetzner for simpler dedicated/VPS estates.
Highlighted rows differ between the two products.
| Feature | Contabo Object Storage | OVHcloud |
|---|---|---|
| Country of origin | Germany | France |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | France |
| Legal entity | Contabo GmbH (Welfenstrasse 22, 81541 Munich; AG Munich HRB 180722; VAT DE267602842) | OVH SAS / OVH Groupe (Roubaix); regional entities include OVH US LLC for US services |
| Governing law | Not listed | French/EU law for EU contracts; US terms apply for OVH US LLC-contracted services |
| US parent / control | US parent or control | No known US parent |
| CLOUD Act exposure (indicative) | High | Medium |
| Hosting / residency | Object storage sold in the EU (eu2.contabostorage.com), United States (usc1.contabostorage.com), and Singapore (sin1.contabostorage.com). Contabo operates its own data centers. No public object-storage subprocessor list. Management API auth is at auth.contabo.com. Official custom-domain docs use Cloudflare as an optional customer-side proxy, not as the S3 data plane. | Own global infrastructure: EU regions (FR including Paris 3-AZ, DE Limburg, PL Warsaw, UK Erith, IT Milan 3-AZ, many Local Zones); US (Vint Hill VA, Hillsboro OR); Canada (Beauharnois, Toronto); APAC (Singapore, Sydney, Mumbai). Primary hosting is OVH-operated, not AWS/GCP resale. Optional non-EU regions are first-class products. |
| Summary | S3-compatible object storage from Munich-based Contabo GmbH, running on Ceph with EU, US, and Singapore endpoints. | French cloud and infrastructure group (Roubaix): Bare Metal dedicated servers, OpenStack Public Cloud, Hosted Private Cloud (incl. SecNumCloud), and Web Cloud on OVH-operated datacentres across Europe, North America, and Asia-Pacific. |
| Tags |
| At a glance | Contabo Object Storage | OVHcloud |
|---|---|---|
| HQ | Munich, Germany (Contabo GmbH, HRB 180722) | Roubaix, France (OVH SAS / OVH Groupe) |
| Product | Hosted Ceph S3 object storage | Not listed |
| S3 regions | EU (eu2), United States (usc1), Singapore (sin1) | Not listed |
| Addressing | Path-style; HTTPS only | Not listed |
| Commercial model | Purchased capacity with optional auto-scale; no per-GB egress on Contabo's stated model | Hourly/monthly public cloud; dedicated server subscriptions; free public cloud trial credits (vendor) |
| Ownership | KKR majority (2022), Oakley Capital Fund V minority | Not listed |
| Founded | Not listed | 1999 (Octave Klaba) |
| Hosting model | Not listed | Own datacentres and network; multi-region IaaS/bare metal |
| Open source product? | Not listed | No (OpenStack-based public cloud uses open APIs) |
| Notable certs (claimed) | Not listed | ISO 27001 family, SOC 1/2/3, HDS, SecNumCloud (Private Cloud), PCI DSS |
| Key capabilities | Contabo Object Storage | OVHcloud |
|---|---|---|
| S3-compatible (partial) | Yes | Not listed |
| Ceph backend | Yes | Not listed |
| EU region available | Yes | Not listed |
| German GmbH | Yes | Not listed |
| In-panel DPA | Yes | Not listed |
| EU-operated (global regions) | Not listed | Yes |
| Bare Metal + Public Cloud | Not listed | Yes |
| OpenStack Public Cloud | Not listed | Yes |
| SecNumCloud Private Cloud | Not listed | Yes |
| Anti-DDoS included | Not listed | Yes |
| EU / US / CA / APAC | Not listed | Yes |
Ceph S3 API with path-style buckets
Contabo states the store is Ceph-based and largely S3 compatible, not fully equivalent to Amazon S3. Logging is not supported. Official tool notes require Contabo S3 URLs, path-style buckets, and access_key/secret_key mapped to aws_access_key_id/aws_secret_access_key.
EU, US, and Singapore S3 endpoints
Documented base URLs are eu2.contabostorage.com (European Union), usc1.contabostorage.com (United States), and sin1.contabostorage.com (Singapore). The management API allows one object-storage purchase per location. All locations on an account share the same S3 credentials.
Bucket versioning and Object Lock
Versioning is enabled per bucket via s3api put-bucket-versioning on the regional endpoint. Suspending versioning stops new versions but does not delete old ones. Object Lock can be turned on at bucket creation (example uses GOVERNANCE mode) so objects cannot be overwritten or deleted for a retention period.
Capacity auto-scale via management API
The Contabo API (not the S3 API) orders, upgrades, cancels, and auto-scales purchased space up to a monthly size limit. Usage statistics are exposed there. The open-source cntb CLI (GPL-3.0) wraps the same management API. S3 keys come from the User Management API or the Object Storage panel.
Published client list and hard limits
Documented working tools include cntb, aws cli, rclone, Cyberduck, goofys, s3fs-fuse, s3cmd, WinSCP, Cloudberry Explorer, BucketAnywhere, Virtualmin, Velero, and Plesk. FileZilla Pro is listed as incompatible. Defaults include 5 TB max object size, 100 buckets, 3 million objects (increasable on request), 250 requests per second, and 10 MByte/s default bandwidth.
Bare Metal dedicated servers (in-house hardware)
Physical servers assembled and operated by OVHcloud across ranges such as Advance, Scale, High Grade, and Game—full CPU/RAM/storage without a hypervisor layer. Water cooling and hardware lifecycle are part of the industrial model. Best for performance-sensitive, virtualisation, gaming, or large single-tenant workloads where you administer the OS.
OpenStack Public Cloud and managed PaaS
On-demand compute, multi-class object storage (S3-compatible API), block/file storage, managed databases, Kubernetes/container services, networking, and data/AI platforms. Deploy via Control Panel or OpenStack APIs with 1-AZ or 3-AZ region options (for example Paris and Milan). Suited to cloud-native and hybrid automation without US hyperscaler lock-in.
Hosted Private Cloud with SecNumCloud path
VMware-based Hosted Private Cloud (and related stacks) for dedicated virtualisation estates. Selected Private Cloud offerings hold French ANSSI SecNumCloud qualification, with customer data under European regulation and hosting in French sites (Roubaix, Gravelines, Strasbourg)—relevant for French public sector and sensitive workloads under Cloud at the Center doctrine.
Global multi-region footprint (EU, US, CA, APAC)
Own datacentres and regions spanning Europe (France, Germany, Poland, UK, Italy, many Local Zones), North America (Vint Hill VA, Hillsboro OR, Beauharnois and Toronto in Canada), and Asia-Pacific (Singapore, Sydney, Mumbai and related offerings). Choose residency for latency and law; do not assume EU-only by default.
Anti-DDoS and vRack private networking included
Network-integrated anti-DDoS mitigation is standard across services. vRack provides private L2 networking across eligible OVHcloud locations so bare metal, public, and private cloud can interconnect without public exposure. Public bandwidth is typically unmetered in Europe and North America with fair-use rules; Asia-Pacific often uses lower default bandwidth and monthly traffic caps—verify per SKU.
| Assurance & compliance | Contabo Object Storage | OVHcloud |
|---|---|---|
| Independent security / no-logs audit | Not found Searched About, help, and product docs. No public independent audit PDF for Object Storage. | Not applicable IaaS/hosting provider, not a no-logs VPN product. Security is covered via ISO/SOC programme rather than a public no-logs audit. |
| ISO 27001 | Partial Some Contabo location marketing pages list colocation-facility ISO 27001 (for example Singapore). No company-wide Contabo ISO 27001 certificate found. | Vendor claimed Vendor compliance pages assert ISO/IEC 27001 (with 27017/27018) for cloud services and datacentres; US pages reference Schellman certificate directory. Confirm current scope per product and region. |
| SOC 2 / SOC 3 | Not found No Contabo-issued SOC 2 or SOC 3 report found. Facility-level SOC marks on some non-EU location pages are not treated as a Contabo attestation. | Vendor claimed Vendor asserts SSAE 18 Type 2 SOC 1, SOC 2 (+NIST), and SOC 3 attestations; reports available to prospective customers under vendor process. |
| GDPR / EU data protection | Vendor claimed EU legal entity; DPA available in the Customer Control Panel and listed as covering Object Storage. EU region is optional, not exclusive. | Vendor claimed EU headquartered; GDPR compliance asserted; DPA documents published for relevant subsidiaries. Residency depends on chosen region. |
| US CLOUD Act exposure (indicative) | Partial Contabo GmbH is German, but KKR (US) has been the majority investor since June 2022 and Contabo sells a US object-storage region. Not legal advice. | Partial French group with no known US parent, but operates US datacentres (Vint Hill, Hillsboro) and OVH US LLC. Medium indicative exposure: EU-region workloads on EU contracts differ from US-region workloads. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Customer Control Panel wizard. Object Storage is an explicit covered service. Review the generated PDF. | Vendor claimed Published DPAs form part of terms (e.g. OVH SAS Europe paths; separate US DPA for OVH US LLC). Obtain the DPA matching your contracting entity. |
| EU AI Act | Not applicable Object storage IaaS, not an AI system. | Not applicable Core product is IaaS/bare metal/hosting; AI/ML platforms are optional infrastructure offerings, not a single AI system product under typical procurement framing. |
| ANSSI SecNumCloud | Not listed | Vendor claimed Hosted Private Cloud (VMware on OVHcloud and related) holds SecNumCloud qualification; hosted in French sites (Roubaix, Gravelines, Strasbourg). Not all products are SecNumCloud-qualified. |
| HDS (French health data hosting) | Not listed | Vendor claimed Vendor lists HDS certification for healthcare data hosting options; confirm which products and locations are in scope. |
| PCI DSS | Not listed | Vendor claimed Vendor asserts PCI DSS Level 1 certification for payment data hosting—confirm applicability to your architecture. |
| Considerations & known limitations | Contabo Object Storage | OVHcloud |
|---|---|---|
| US private-equity majority owner | High Oakley Capital announced in June 2022 that KKR would be majority investor, with Oakley Fund V retaining a minority stake. Treat CLOUD Act exposure as high at the ownership layer even when objects sit on eu2.contabostorage.com. | Not listed |
| Optional United States object region | Medium usc1.contabostorage.com is a first-party SKU. Shared credentials across locations make it easy to point a client at the US endpoint by mistake. Pin the EU URL if residency is a hard requirement. | Not listed |
| Partial S3 compatibility | Medium Contabo states the Ceph API is not fully compatible with AWS S3. Logging is unsupported. Path-style addressing is required. FileZilla Pro does not work. Test SDK features before migrating production. | Not listed |
| Default request and bandwidth caps | Medium Published defaults include 250 API requests per second, 10 MByte/s bandwidth, 100 buckets, and 3 million objects. Auto-scale increases purchased terabytes, not those caps. | Not listed |
| No public company-wide audit | Medium No independent Object Storage audit, Contabo-issued ISO 27001, or SOC 2 report was found. Facility ISO/SOC marks on some location pages are not a substitute. | Not listed |
| No first-party custom TLS hostname | Low HTTPS-only S3 endpoints reject a simple CNAME. Public websites need a customer-operated reverse proxy. Public-to-private ACL changes may remain cached for up to one hour. | Not listed |
| US regions and US subsidiary | Not listed | Medium US East/West datacentres and OVH US LLC mean CLOUD Act and US process risk apply to US-placed data and some contracts. EU-only deployment reduces this but buyers must enforce region and contracting path. |
| 2021 Strasbourg datacentre fire (resilience history) | Not listed | Medium A major fire at SBG caused widespread customer outages. Treat multi-AZ/multi-region backup design as mandatory for critical data; do not rely on single-site assumptions. |
| Certification scope is product- and region-specific | Not listed | Medium ISO, SOC, HDS, SecNumCloud, and PCI claims do not automatically cover every SKU and location. Procurement should request the exact report for the services ordered. |
| APAC bandwidth and traffic rules differ | Not listed | Low Vendor documents unmetered traffic exceptions for Asia-Pacific (lower default bandwidth and monthly volume caps vs Europe/North America). Model egress and bandwidth options for APAC workloads. |
| Broad catalogue complexity | Not listed | Low Bare Metal, Public Cloud, Private Cloud, and Web Cloud under one brand can confuse account structure, IAM, and billing. Define landing-zone standards early. |
When: You want a German hoster's object store with an EU-concentrated footprint and no US majority PE owner
Consider: Hetzner Object Storage
Contabo's own comparison places Hetzner object storage in European data centers and notes a thinner APAC story.
When: You need a broader EU compliance portfolio (ISO 27001, SecNumCloud) more than a simple capacity bill
Consider: OVHcloud Object Storage
Billing and product surface are more complex than Contabo's single-account IaaS stack.
When: You need managed Kubernetes or managed Postgres next to S3, not just raw buckets
Consider: Scaleway Object Storage
France-first footprint. Contabo does not sell first-party managed databases or Kubernetes.
When: You need Amazon-complete S3 (logging, IAM, global regions) and will accept a US cloud
Consider: Amazon S3
Use Contabo only after you have tested the Ceph compatibility gaps against your SDK.
When: You want a leaner French public cloud with a strong developer product surface and less enterprise sovereign packaging
Consider: Scaleway
Often simpler for cloud-native teams; confirm region and compliance fit.
When: You primarily need price-performance VPS or dedicated servers with a smaller catalogue
Consider: Hetzner
Strong for lean estates; different sovereign/cert posture and global region set.
When: You need maximum managed-service breadth, global account tooling, and partner marketplace density
Consider: Amazon Web Services (AWS), Microsoft Azure, or Google Cloud Platform
Hyperscalers win platform depth; accept US ownership and CLOUD Act parent exposure.
When: You want German SMB hosting plus cloud IaaS with EU and some non-EU options
Consider: IONOS
Different product mix and compliance packaging than OVHcloud's bare-metal industrial model.