Compare Contabo Object Storage and Scaleway on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Germany· Cloud Computing
Needs review
Shortlist when you want a Ceph S3 bucket next to Contabo VPS or VDS, can use path-style endpoints, and can live without S3 logging. Skip when you need Amazon-complete S3, a first-party custom TLS hostname, company-wide ISO 27001 or SOC 2, or a store with no US parent and no US region. Consider Hetzner Object Storage or OVHcloud Object Storage instead.
France· Cloud Computing
Needs review
Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.
Highlighted rows differ between the two products.
| Feature | Contabo Object Storage | Scaleway |
|---|---|---|
| Country of origin | Germany | France |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | France |
| Legal entity | Contabo GmbH (Welfenstrasse 22, 81541 Munich; AG Munich HRB 180722; VAT DE267602842) | SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris |
| Governing law | Not listed | French law (General Terms of Services) |
| US parent / control | US parent or control | No known US parent |
| CLOUD Act exposure (indicative) | High | Low |
| Hosting / residency | Object storage sold in the EU (eu2.contabostorage.com), United States (usc1.contabostorage.com), and Singapore (sin1.contabostorage.com). Contabo operates its own data centers. No public object-storage subprocessor list. Management API auth is at auth.contabo.com. Official custom-domain docs use Cloudflare as an optional customer-side proxy, not as the S3 data plane. | Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page. |
| Summary | S3-compatible object storage from Munich-based Contabo GmbH, running on Ceph with EU, US, and Singapore endpoints. | French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe. |
| Tags |
| At a glance | Contabo Object Storage | Scaleway |
|---|---|---|
| HQ | Munich, Germany (Contabo GmbH, HRB 180722) | Paris, France (SCALEWAY SAS) |
| Product | Hosted Ceph S3 object storage | Not listed |
| S3 regions | EU (eu2), United States (usc1), Singapore (sin1) | Not listed |
| Addressing | Path-style; HTTPS only | Not listed |
| Commercial model | Purchased capacity with optional auto-scale; no per-GB egress on Contabo's stated model | Pay-as-you-go; compute Savings Plans (GPU rules differ) |
| Ownership | KKR majority (2022), Oakley Capital Fund V minority | Not listed |
| Group | Not listed | iliad Group subsidiary |
| Regions | Not listed | Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed) |
| Model | Not listed | Public cloud IaaS/PaaS (not self-hosted) |
| Open source | Not listed | Platform proprietary; open standards (K8s, S3 API, Terraform) |
| Key capabilities | Contabo Object Storage | Scaleway |
|---|---|---|
| S3-compatible (partial) | Yes | Not listed |
| Ceph backend | Yes | Not listed |
| EU region available | Yes | Not listed |
| German GmbH | Yes | Not listed |
| In-panel DPA | Yes | Not listed |
| EU-operated regions | Not listed | Yes |
| Bare metal + Elastic Metal | Not listed | Yes |
| EU GPU for AI | Not listed | Yes |
| Kapsule Kubernetes | Not listed | Yes |
| ISO 27001 (certified) | Not listed | Yes |
| HDS (claimed) | Not listed | Yes |
Ceph S3 API with path-style buckets
Contabo states the store is Ceph-based and largely S3 compatible, not fully equivalent to Amazon S3. Logging is not supported. Official tool notes require Contabo S3 URLs, path-style buckets, and access_key/secret_key mapped to aws_access_key_id/aws_secret_access_key.
EU, US, and Singapore S3 endpoints
Documented base URLs are eu2.contabostorage.com (European Union), usc1.contabostorage.com (United States), and sin1.contabostorage.com (Singapore). The management API allows one object-storage purchase per location. All locations on an account share the same S3 credentials.
Bucket versioning and Object Lock
Versioning is enabled per bucket via s3api put-bucket-versioning on the regional endpoint. Suspending versioning stops new versions but does not delete old ones. Object Lock can be turned on at bucket creation (example uses GOVERNANCE mode) so objects cannot be overwritten or deleted for a retention period.
Capacity auto-scale via management API
The Contabo API (not the S3 API) orders, upgrades, cancels, and auto-scales purchased space up to a monthly size limit. Usage statistics are exposed there. The open-source cntb CLI (GPL-3.0) wraps the same management API. S3 keys come from the User Management API or the Object Storage panel.
Published client list and hard limits
Documented working tools include cntb, aws cli, rclone, Cyberduck, goofys, s3fs-fuse, s3cmd, WinSCP, Cloudberry Explorer, BucketAnywhere, Virtualmin, Velero, and Plesk. FileZilla Pro is listed as incompatible. Defaults include 5 TB max object size, 100 buckets, 3 million objects (increasable on request), 250 requests per second, and 10 MByte/s default bandwidth.
Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.
| Assurance & compliance | Contabo Object Storage | Scaleway |
|---|---|---|
| Independent security / no-logs audit | Not found Searched About, help, and product docs. No public independent audit PDF for Object Storage. | Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim. |
| ISO 27001 | Partial Some Contabo location marketing pages list colocation-facility ISO 27001 (for example Singapore). No company-wide Contabo ISO 27001 certificate found. | Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy. |
| SOC 2 / SOC 3 | Not found No Contabo-issued SOC 2 or SOC 3 report found. Facility-level SOC marks on some non-EU location pages are not treated as a Contabo attestation. | Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1). |
| GDPR / EU data protection | Vendor claimed EU legal entity; DPA available in the Customer Control Panel and listed as covering Object Storage. EU region is optional, not exclusive. | Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice. |
| US CLOUD Act exposure (indicative) | Partial Contabo GmbH is German, but KKR (US) has been the majority investor since June 2022 and Contabo sells a US object-storage region. Not legal advice. | Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim. |
| Data processing agreement (B2B) | Vendor claimed Customer Control Panel wizard. Object Storage is an explicit covered service. Review the generated PDF. | Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs. |
| EU AI Act | Not applicable Object storage IaaS, not an AI system. | Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim. |
| HDS (French health data hosting) | Not listed | Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture. |
| CSA STAR Level 1 | Not listed | Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ). |
| ANSSI SecNumCloud | Not listed | Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed. |
| Considerations & known limitations | Contabo Object Storage | Scaleway |
|---|---|---|
| US private-equity majority owner | High Oakley Capital announced in June 2022 that KKR would be majority investor, with Oakley Fund V retaining a minority stake. Treat CLOUD Act exposure as high at the ownership layer even when objects sit on eu2.contabostorage.com. | Not listed |
| Optional United States object region | Medium usc1.contabostorage.com is a first-party SKU. Shared credentials across locations make it easy to point a client at the US endpoint by mistake. Pin the EU URL if residency is a hard requirement. | Not listed |
| Partial S3 compatibility | Medium Contabo states the Ceph API is not fully compatible with AWS S3. Logging is unsupported. Path-style addressing is required. FileZilla Pro does not work. Test SDK features before migrating production. | Not listed |
| Default request and bandwidth caps | Medium Published defaults include 250 API requests per second, 10 MByte/s bandwidth, 100 buckets, and 3 million objects. Auto-scale increases purchased terabytes, not those caps. | Not listed |
| No public company-wide audit | Medium No independent Object Storage audit, Contabo-issued ISO 27001, or SOC 2 report was found. Facility ISO/SOC marks on some location pages are not a substitute. | Not listed |
| No first-party custom TLS hostname | Low HTTPS-only S3 endpoints reject a simple CNAME. Public websites need a customer-operated reverse proxy. Public-to-private ACL changes may remain cached for up to one hour. | Not listed |
| SecNumCloud not yet obtained | Not listed | Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan. |
| Smaller service catalogue than US hyperscalers | Not listed | Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate. |
| Account-plane processors and possible non-EU transfers | Not listed | Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs. |
| Shared responsibility for guest security | Not listed | Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes. |
| Dedibox vs Elastic Metal product split | Not listed | Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort. |
When: You want a German hoster's object store with an EU-concentrated footprint and no US majority PE owner
Consider: Hetzner Object Storage
Contabo's own comparison places Hetzner object storage in European data centers and notes a thinner APAC story.
When: You need a broader EU compliance portfolio (ISO 27001, SecNumCloud) more than a simple capacity bill
Consider: OVHcloud Object Storage
Billing and product surface are more complex than Contabo's single-account IaaS stack.
When: You need managed Kubernetes or managed Postgres next to S3, not just raw buckets
Consider: Scaleway Object Storage
France-first footprint. Contabo does not sell first-party managed databases or Kubernetes.
When: You need Amazon-complete S3 (logging, IAM, global regions) and will accept a US cloud
Consider: Amazon S3
Use Contabo only after you have tested the Ceph compatibility gaps against your SDK.
When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.