Compare Contabo Object Storage and STACKIT on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: DigitalOcean
Germany· Cloud Computing
Needs review
Shortlist when you want a Ceph S3 bucket next to Contabo VPS or VDS, can use path-style endpoints, and can live without S3 logging. Skip when you need Amazon-complete S3, a first-party custom TLS hostname, company-wide ISO 27001 or SOC 2, or a store with no US parent and no US region. Consider Hetzner Object Storage or OVHcloud Object Storage instead.
Germany· Cloud Computing
Needs review
Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.
Highlighted rows differ between the two products.
| Feature | Contabo Object Storage | STACKIT |
|---|---|---|
| Country of origin | Germany | Germany |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | Germany | Germany |
| Legal entity | Contabo GmbH (Welfenstrasse 22, 81541 Munich; AG Munich HRB 180722; VAT DE267602842) | Schwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm) |
| Governing law | Not listed | Germany (imprint also notes ICT infrastructure jurisdiction Germany and Austria) |
| US parent / control | US parent or control | No known US parent |
| CLOUD Act exposure (indicative) | High | Low |
| Hosting / residency | Object storage sold in the EU (eu2.contabostorage.com), United States (usc1.contabostorage.com), and Singapore (sin1.contabostorage.com). Contabo operates its own data centers. No public object-storage subprocessor list. Management API auth is at auth.contabo.com. Official custom-domain docs use Cloudflare as an optional customer-side proxy, not as the S3 data plane. | Vendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV. |
| Summary | S3-compatible object storage from Munich-based Contabo GmbH, running on Ceph with EU, US, and Singapore endpoints. | German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria. |
| Tags |
| At a glance | Contabo Object Storage | STACKIT |
|---|---|---|
| HQ | Munich, Germany (Contabo GmbH, HRB 180722) | Not listed |
| Product | Hosted Ceph S3 object storage | Not listed |
| S3 regions | EU (eu2), United States (usc1), Singapore (sin1) | Not listed |
| Addressing | Path-style; HTTPS only | Not listed |
| Commercial model | Purchased capacity with optional auto-scale; no per-GB egress on Contabo's stated model | Not listed |
| Ownership | KKR majority (2022), Oakley Capital Fund V minority | Not listed |
| HQ / legal entity | Not listed | Bad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KG |
| Parent | Not listed | Schwarz Digits (Schwarz Group — Lidl/Kaufland) |
| Hosting | Not listed | Group-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure reseller |
| Model | Not listed | Consumption-based public cloud + quote-based colocation |
| Open source | Not listed | Uses open-source components; platform itself is managed, not self-hosted |
| External market | Not listed | Public offering from 2022 (internal roots from 2018) |
| Key capabilities | Contabo Object Storage | STACKIT |
|---|---|---|
| S3-compatible (partial) | Yes | Not listed |
| Ceph backend | Yes | Not listed |
| EU region available | Yes | Not listed |
| German GmbH | Yes | Not listed |
| In-panel DPA | Yes | Not listed |
| EU-operated | Not listed | Yes |
| German legal entity | Not listed | Yes |
| Group-owned DE/AT DCs | Not listed | Yes |
| BSI C5 Type 2 (claimed) | Not listed | Yes |
| Managed Kubernetes (SKE) | Not listed | Yes |
| EU colocation + hybrid | Not listed | Yes |
Ceph S3 API with path-style buckets
Contabo states the store is Ceph-based and largely S3 compatible, not fully equivalent to Amazon S3. Logging is not supported. Official tool notes require Contabo S3 URLs, path-style buckets, and access_key/secret_key mapped to aws_access_key_id/aws_secret_access_key.
EU, US, and Singapore S3 endpoints
Documented base URLs are eu2.contabostorage.com (European Union), usc1.contabostorage.com (United States), and sin1.contabostorage.com (Singapore). The management API allows one object-storage purchase per location. All locations on an account share the same S3 credentials.
Bucket versioning and Object Lock
Versioning is enabled per bucket via s3api put-bucket-versioning on the regional endpoint. Suspending versioning stops new versions but does not delete old ones. Object Lock can be turned on at bucket creation (example uses GOVERNANCE mode) so objects cannot be overwritten or deleted for a retention period.
Capacity auto-scale via management API
The Contabo API (not the S3 API) orders, upgrades, cancels, and auto-scales purchased space up to a monthly size limit. Usage statistics are exposed there. The open-source cntb CLI (GPL-3.0) wraps the same management API. S3 keys come from the User Management API or the Object Storage panel.
Published client list and hard limits
Documented working tools include cntb, aws cli, rclone, Cyberduck, goofys, s3fs-fuse, s3cmd, WinSCP, Cloudberry Explorer, BucketAnywhere, Virtualmin, Velero, and Plesk. FileZilla Pro is listed as incompatible. Defaults include 5 TB max object size, 100 buckets, 3 million objects (increasable on request), 250 requests per second, and 10 MByte/s default bandwidth.
Compute Engine VMs and GPUs in group-owned EU regions
Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.
STACKIT Kubernetes Engine (SKE)
Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.
Managed databases, messaging, and observability
Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.
Confidential computing and key/secrets control
Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.
EU colocation with hybrid path to public cloud
Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.
Object, block, file, backup, and archiving storage
S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.
| Assurance & compliance | Contabo Object Storage | STACKIT |
|---|---|---|
| Independent security / no-logs audit | Not found Searched About, help, and product docs. No public independent audit PDF for Object Storage. | Vendor claimed Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit. |
| ISO 27001 | Partial Some Contabo location marketing pages list colocation-facility ISO 27001 (for example Singapore). No company-wide Contabo ISO 27001 certificate found. | Vendor claimed Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components. |
| SOC 2 / SOC 3 | Not found No Contabo-issued SOC 2 or SOC 3 report found. Facility-level SOC marks on some non-EU location pages are not treated as a Contabo attestation. | Vendor claimed Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request. |
| GDPR / EU data protection | Vendor claimed EU legal entity; DPA available in the Customer Control Panel and listed as covering Object Storage. EU region is optional, not exclusive. | Vendor claimed EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud. |
| US CLOUD Act exposure (indicative) | Partial Contabo GmbH is German, but KKR (US) has been the majority investor since June 2022 and Contabo sells a US object-storage region. Not legal advice. | Partial German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice. |
| Data processing agreement (B2B) | Vendor claimed Customer Control Panel wizard. Object Storage is an explicit covered service. Review the generated PDF. | Not found No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement. |
| EU AI Act | Not applicable Object storage IaaS, not an AI system. | Not applicable Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems. |
| BSI C5 Type 2 | Not listed | Vendor claimed C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product. |
| TISAX Level 3 | Not listed | Vendor claimed Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page). |
| Considerations & known limitations | Contabo Object Storage | STACKIT |
|---|---|---|
| US private-equity majority owner | High Oakley Capital announced in June 2022 that KKR would be majority investor, with Oakley Fund V retaining a minority stake. Treat CLOUD Act exposure as high at the ownership layer even when objects sit on eu2.contabostorage.com. | Not listed |
| Optional United States object region | Medium usc1.contabostorage.com is a first-party SKU. Shared credentials across locations make it easy to point a client at the US endpoint by mistake. Pin the EU URL if residency is a hard requirement. | Not listed |
| Partial S3 compatibility | Medium Contabo states the Ceph API is not fully compatible with AWS S3. Logging is unsupported. Path-style addressing is required. FileZilla Pro does not work. Test SDK features before migrating production. | Not listed |
| Default request and bandwidth caps | Medium Published defaults include 250 API requests per second, 10 MByte/s bandwidth, 100 buckets, and 3 million objects. Auto-scale increases purchased terabytes, not those caps. | Not listed |
| No public company-wide audit | Medium No independent Object Storage audit, Contabo-issued ISO 27001, or SOC 2 report was found. Facility ISO/SOC marks on some location pages are not a substitute. | Not listed |
| No first-party custom TLS hostname | Low HTTPS-only S3 endpoints reject a simple CNAME. Public websites need a customer-operated reverse proxy. Public-to-private ACL changes may remain cached for up to one hour. | Not listed |
| Narrower service map than US hyperscalers | Not listed | Medium STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign. |
| C5 Type 2 is product-scoped | Not listed | Medium Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits. |
| Limited public subprocessor inventory | Not listed | Low Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data. |
| Retail-group operator concentration | Not listed | Low Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly. |
When: You want a German hoster's object store with an EU-concentrated footprint and no US majority PE owner
Consider: Hetzner Object Storage
Contabo's own comparison places Hetzner object storage in European data centers and notes a thinner APAC story.
When: You need a broader EU compliance portfolio (ISO 27001, SecNumCloud) more than a simple capacity bill
Consider: OVHcloud Object Storage
Billing and product surface are more complex than Contabo's single-account IaaS stack.
When: You need managed Kubernetes or managed Postgres next to S3, not just raw buckets
Consider: Scaleway Object Storage
France-first footprint. Contabo does not sell first-party managed databases or Kubernetes.
When: You need Amazon-complete S3 (logging, IAM, global regions) and will accept a US cloud
Consider: Amazon S3
Use Contabo only after you have tested the Ceph compatibility gaps against your SDK.
When: You need a wider multi-country European region map and a large independent cloud portfolio
Consider: OVHcloud or Scaleway
Different ownership and product cultures; still not US hyperscaler breadth
When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth
Consider: IONOS (or similar DE hosts)
Often simpler packaging for commodity compute
When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis
When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale
Consider: Exoscale
Smaller portfolio; different jurisdiction story