Exoscale vs gridscale

Compare Exoscale and gridscale on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Logo: Exoscale

Exoscale

Switzerland· Cloud Computing

Needs review

Shortlist Exoscale when you need multi-country European IaaS (CH/DE/AT/BG/HR zones), managed Kubernetes and open-source DBaaS under a Swiss operator in the A1 Telekom Austria group. Skip when you need hyperscaler global PaaS depth or bare-metal-first catalogs—consider OVHcloud or Scaleway instead, or AWS/Azure/GCP for worldwide regions.

EU/CH zones onlySwiss operator (Akenes SA)Managed Kubernetes (SKS)Managed DBaaSISO 27001/27017/27018 (claimed)Per-second pay-as-you-go
View listingVisit Website
Logo: gridscale

gridscale

Germany· Cloud Computing

Needs review

Shortlist when you need a German GmbH cloud with EU/CH/AT location choice, managed Kubernetes/databases, and Hybrid Core white-label HCI. Skip when you need global hyperscaler coverage or pure lowest-cost VMs—consider Hetzner for cost-sensitive compute or AWS/Azure for worldwide breadth; use OVHcloud parent portfolio when scale across more European regions is the priority.

EU-operated (DE entity)Multi-country EU/CH locationsManaged KubernetesHybrid Core HCIBSI C5 (claimed)OVHcloud group
View listingVisit Website

Highlighted rows differ between the two products.

Exoscale vs gridscale: Snapshot
FeatureLogo: ExoscaleExoscaleLogo: gridscalegridscale
Country of originSwitzerlandGermany
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersSwitzerlandGermany
Legal entityAkenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland (CHE-423.524.322); member of A1 Digital International GmbH & Co KG / A1 Telekom Austria Groupgridscale GmbH, Oskar-Jäger-Straße 173, 50825 Köln (HRB 97235, Amtsgericht Cologne)
Governing lawSwiss law (DPA: canton of Vaud jurisdiction language)German law (GTC; English GTC for information only—German prevails)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)MediumMedium
Hosting / residencyCustomer compute/storage/SKS on Exoscale European zones (CH-GVA-2, CH-DK-2, DE-FRA-1, DE-MUC-1, AT-VIE-1/2, BG-SOF-1, HR-ZAG-1); DBaaS orchestrated by Aiven Oy (Finland) on Exoscale compute. Client ops third parties include AWS (US) data archival, Twilio (US) auth, PayPal (US) payments—privacy policy states customer-uploaded service data is not sent to those ops providers.Customer infrastructure marketed on European Tier 3 locations (Frankfurt multi-AZ, Eichenzell, Hannover, Paderborn, Amsterdam, Gais, Lucerne, Vienna); some Hybrid Core sites partner-operated (hosttech, rhöncloud, BAIONITY, windCORES). Privacy policy also lists US-group ancillary processors: Stripe (payments), Google Analytics/GTM, Microsoft Bing Ads, Meta, LinkedIn; Mautic on-prem DE; Recruitee NL. No public claim that primary VM storage runs on AWS/GCP/Azure.
Summary

European public cloud (IaaS) from Swiss operator Akenes SA (A1 Digital): multi-zone compute, managed Kubernetes (SKS), DBaaS, object and block storage, and GPUs across CH, DE, AT, BG, and HR.

Cologne-based German IaaS/PaaS and Hybrid Core HCI cloud (OVHcloud group) with European locations, managed Kubernetes, and white-label private cloud options for DACH teams.

Tags
cloudiaaskubernetesdbaasgdprswitzerlandeuropean-cloudgpu
cloudiaaskubernetespaashybrid-cloudhcigerman-clouddata-sovereigntyapi
At a glance: Exoscale vs gridscale
At a glanceLogo: ExoscaleExoscaleLogo: gridscalegridscale
HQLausanne, SwitzerlandCologne, Germany
Legal entityAkenes SA (CHE-423.524.322)gridscale GmbH (HRB 97235)
GroupA1 Digital / A1 Telekom Austria GroupNot listed
HostingEuropean zones only (CH, DE, AT, BG, HR)European Tier 3 sites DE/NL/CH/AT (+ partners)
ModelPublic cloud IaaS + managed K8s/DBaaSNot listed
Self-hostNo (managed public cloud)Not listed
ParentNot listedOVHcloud (100% since Sept 2023)
Commercial modelNot listedB2B; trial then per-minute usage metering
Open sourceNot listedNo (API/IaC clients only)
Key capabilities: Exoscale vs gridscale
Key capabilitiesLogo: ExoscaleExoscaleLogo: gridscalegridscale
EU/CH zones onlyYesNot listed
Swiss operator (Akenes SA)YesNot listed
Managed Kubernetes (SKS)YesNot listed
Managed DBaaSYesNot listed
ISO 27001/27017/27018 (claimed)YesNot listed
Per-second pay-as-you-goYesNot listed
EU-operated (DE entity)Not listedYes
Multi-country EU/CH locationsNot listedYes
Managed KubernetesNot listedYes
Hybrid Core HCINot listedYes
BSI C5 (claimed)Not listedYes
OVHcloud groupNot listedYes

Exoscale

  • Multi-zone European KVM compute

    Launch KVM instances in published zones across Switzerland, Germany, Austria, Bulgaria, and Croatia. Families cover standard, CPU-, memory-, and storage-optimized profiles plus NVIDIA GPU shapes; anti-affinity groups, instance pools, snapshots, custom templates, security groups, and live migration support production patterns. Billed per second with powered-off storage semantics as documented.

  • SKS managed Kubernetes (CNCF certified)

    Scalable Kubernetes Service deploys a managed control plane quickly (vendor claims under about a minute to two minutes). Starter is free without SLA; Pro adds HA control plane, etcd backups, and SLA language. Node pools use Exoscale instance types including GPUs; NLB, CSI storage, autoscaling/Karpenter (Pro), and vanilla CNCF-conformance positioning keep the stack portable.

  • Managed DBaaS on Exoscale compute (Aiven orchestration)

    Managed PostgreSQL, MySQL, Kafka, OpenSearch, Valkey, Grafana, and related engines run as DBaaS with automated backups, plan scaling, and high-availability options. Orchestration subprocessor is Aiven Oy (Finland); database instances run on Exoscale infrastructure in the zone you choose—confirm geo-replication and plan limits in docs before multi-region designs.

  • S3-compatible object storage and block volumes

    Simple Object Storage provides S3-compatible APIs for backups, media, and app assets integrated with Exoscale IAM and zones. Block storage attaches persistent NVMe-class volumes to instances and Kubernetes via CSI for stateful workloads without tying data solely to local disks.

  • IAM, private networks, and automation APIs

    Fine-grained IAM on API keys, private networks, and network load balancers support multi-tier designs. Portal, CLI, API, and Terraform-friendly workflows match common European DevOps practice without requiring a proprietary control language.

gridscale

  • Panel + API + Terraform provisioning

    Deploy VMs with attached storage in seconds via the control panel or automate with the REST API and common IaC clients (Terraform, Packer). Built for teams that want both click-ops and git-ops without a hyperscaler control-plane learning curve.

  • Managed Kubernetes, databases, and load balancers

    PaaS layers cover managed Kubernetes orchestration plus fully managed databases with audit logs and automatic backups, and managed load balancers for traffic distribution—so app teams avoid running the full stack themselves.

  • S3-compatible object storage and Rocket NVMe storage

    Object storage follows S3-style APIs for backups, archives, and unstructured data, with region choice called out for GDPR-oriented placement. Rocket Storage targets high-IOPS NVMe workloads; not every Hybrid Core location exposes object storage—check the data-center matrix.

  • Per-minute GPU bare-metal for AI/ML

    GPU instances are marketed as dedicated bare-metal performance for AI/ML and data science, with CPU, RAM, and storage included and usage billed by the minute rather than only long-term reserved shapes.

  • Hybrid Core Concierge HCI and white-label cloud

    Fully managed hyperconverged packages combine hardware delivery, installation, remote operations, white-label branding/SAML options, and access to the wider gridscale location ecosystem—aimed at enterprises and hosters building private or partner clouds.

Assurance & compliance: Exoscale vs gridscale
Assurance & complianceLogo: ExoscaleExoscaleLogo: gridscalegridscale
Independent security / control audit
Partial

Vendor states regular independent audits and publishes multi-framework certs via Compliance Center; not a VPN-style no-logs audit. Download current reports under account/NDA for verification.

Not applicable

IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required.

ISO 27001
Vendor claimed

Vendor asserts ISO/IEC 27001:2022 ISMS certification since 2018; certificates via Compliance Center.

Vendor claimed

Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification.

ISO 27017 (cloud security)
Vendor claimed

Listed on compliance site as certified cloud security controls.

Vendor claimed

Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates.

ISO 27018 (cloud PII)
Vendor claimed

Listed on compliance site for personal data protection in public cloud.

Vendor claimed

Claimed on compliance/about materials; request current scope.

SOC 2 / SOC 3
Vendor claimed

SOC 2 listed on compliance marketing; obtain report via Compliance Center / NDA.

Not found

No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard).

BSI C5
Vendor claimed

BSI C5 listed among national/international standards on compliance page.

Not listed
HDS (French health data hosting)
Vendor claimed

HDS listed on compliance page; confirm scope and zones for health workloads.

Not listed
CSA STAR
Vendor claimed

CSA STAR listed on compliance page.

Not listed
GDPR / EU data protection
Vendor claimed

Swiss entity; GDPR + Swiss FADP claims; EU zones; public DPA. Not legal advice.

Vendor claimed

German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing.

US CLOUD Act exposure (indicative)
Partial

Swiss operator, no known US parent, European workload zones, and no third-party processor for compute/storage/SKS customer data. Medium residual path via US ops providers (AWS archival, Twilio auth, PayPal) listed for client data. DBaaS uses Aiven (Finland). Not legal advice.

Partial

EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

Public DPA for Akenes SA as processor; Swiss law; Aiven listed for DBaaS.

Vendor claimed

GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone.

EU AI Act
Not applicable

Primary product is IaaS/managed infrastructure; customer AI workloads remain customer-controlled. Concrete AI offerings may need separate review if used as an AI system.

Not applicable

Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model.

ISAE 3402 SOC 1 Type 2Not listed
Vendor claimed

About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report.

BSI C5Not listed
Vendor claimed

Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation.

Trusted Cloud (DE)Not listed
Vendor claimed

Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de.

Considerations & known limitations: Exoscale vs gridscale
Considerations & known limitationsLogo: ExoscaleExoscaleLogo: gridscalegridscale
US third parties on client/ops path
Medium

Privacy policy lists AWS (US) data archival, Twilio (US) authentication, and PayPal (US) among client operations providers. Vendor states customer-uploaded service data is not transferred to these providers, but account/ops data paths still matter for CLOUD Act and transfer diligence.

Not listed
DBaaS subprocessor (Aiven)
Low

Managed databases depend on Aiven Oy (Finland) for orchestration while instances run on Exoscale. Confirm contractual chain, access model, and zone placement for sensitive data.

Not listed
Cert evidence mostly in customer portal / NDA
Low

ISO/SOC/C5/HDS claims are strong marketing signals, but full certificates and SOC reports typically require Compliance Center access or NDA—not fully public PDFs for all frameworks.

Not listed
Narrower PaaS than hyperscalers
Medium

Expect solid IaaS, SKS, DBaaS, storage, and GPU—not the global proprietary service catalog of AWS/Azure/GCP. Validate feature gaps early for serverless, global edge, and specialized managed services.

Not listed
Zone catalog evolves
Low

Public materials discuss further European expansion (e.g. Spain via A1 Digital messaging). Treat the live datacenters page as source of truth for residency commitments.

Not listed
Parent-group integration after OVHcloud acquisitionNot listed
Medium

100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation.

Partner-operated Hybrid Core locationsNot listed
Medium

Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording.

US-group ancillary processors (account/marketing)Not listed
Medium

Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only.

Certifications need current attestation packsNot listed
Low

BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone.

Narrower global footprint than hyperscalersNot listed
Low

Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services).

Fit

Exoscale

Best fit when

  • Teams that must pin VMs, Kubernetes, and object storage to named European zones (including Swiss options)
  • SaaS and product orgs wanting SKS plus managed PostgreSQL/MySQL/Kafka/OpenSearch without running the control planes
  • Buyers who need a published DPA, zone list, and multi-framework compliance pack from a non-US legal entity
  • Workloads that fit IaaS plus managed open-source data services rather than proprietary global PaaS catalogs
  • Organizations evaluating A1 Digital / A1 Telekom Austria group cloud as a European alternative to AWS/Azure/GCP

Poor fit when

  • Products that depend on dozens of proprietary hyperscaler services or multi-continent active-active regions
  • Buyers who require zero US-group SaaS anywhere on the account path (privacy lists AWS archival, Twilio, PayPal for ops)
  • Teams seeking a fully self-hosted OpenStack/Kubernetes distribution rather than a managed public cloud
  • Bare-metal-heavy designs better served by large European bare-metal catalogs (e.g. OVHcloud)

Consider instead when

  • When: You need extensive bare-metal or a different pan-EU hosting footprint

    Consider: OVHcloud

    Often stronger metal catalog and broader hosting packaging; different sovereignty and product mix.

  • When: You want a developer-centric alternative with a different regional product mix

    Consider: Scaleway

    Common EU shortlist peer; compare zones, K8s, and storage packaging side by side.

  • When: You need global regions and deep proprietary PaaS/AI catalogs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade European-operator simplicity for worldwide service breadth and US CLOUD Act parent risk.

gridscale

Best fit when

  • DACH mid-market teams wanting German contracting plus managed PaaS (Kubernetes, databases, load balancers)
  • MSPs and hosters needing white-label branding, multi-tenant accounts, and optional Hybrid Core hardware
  • Workloads that must pick DE/NL/CH/AT regions with Tier 3 marketing claims and green-energy positioning
  • AI/ML or data-science jobs that need GPU bare-metal with per-minute metering
  • Buyers who value panel + API/Terraform over hyperscaler IAM sprawl

Poor fit when

  • Global multi-region applications that need hyperscaler edge, marketplace services, or non-European regions
  • Teams optimising only for lowest bare VM or dedicated-server unit cost (evaluate Hetzner first)
  • Buyers requiring public SOC 2 Type II specifically rather than ISAE 3402 SOC 1 Type 2 / BSI C5 packs
  • Organisations that forbid any US-group ancillary processors (Stripe/Google marketing tools appear in the privacy recipient list)

Consider instead when

  • When: You need the broader European hyperscale portfolio and more regions under one group brand

    Consider: OVHcloud

    OVHcloud is the parent group; gridscale stays the HCI/panel-focused product line

  • When: Cost-sensitive VMs or dedicated servers dominate and you do not need Hybrid Core white-label

    Consider: Hetzner

    Hetzner typically wins raw price/performance for simple compute

  • When: France-centric developer cloud with different location and product skew

    Consider: Scaleway

    Compare ARM options and FR footprint versus gridscale DACH Hybrid Core

  • When: Swiss-rooted EU cloud positioning is the primary evaluation criterion

    Consider: Exoscale

    Still compare DE/CH site maps and managed service depth side by side

  • When: You need worldwide regions, marketplace depth, or US-public-sector cloud programmes

    Consider: Amazon Web Services (AWS) or Microsoft Azure

    Trade EU-entity simplicity for hyperscaler breadth and US ownership path

Open questions for due diligence

Exoscale

  • Download current ISO/SOC/C5/HDS certificates from the Compliance Center and verify auditor, scope, and expiry for your zones.
  • Confirm whether your use case can accept AWS/Twilio/PayPal on the account/ops path even if workload data stays on European Exoscale zones.
  • For DBaaS, document Aiven access boundaries, encryption, backup locations, and multi-zone replication behavior in writing.
  • If Spanish or other new zones are required, get contractual residency language rather than relying on roadmap announcements.
  • Clarify support plan SLAs and enterprise contracting terms beyond self-serve pay-as-you-go.

gridscale

  • Will gridscale execute your template AV/DPA and attach a location-specific subprocessor list for the regions you enable?
  • What is the current scope and report date for BSI C5 and ISAE 3402 SOC 1 Type 2 covering the services you will buy?
  • Which privacy-policy third parties process production account/identity data versus website marketing only?
  • How are OVHcloud group affiliates involved in support, billing, or platform operations for gridscale customers post-acquisition?
  • For Hybrid Core partner sites, who is the data-center operator of record and what audit rights apply?