Exoscale vs Leafcloud Object Storage

Compare Exoscale and Leafcloud Object Storage on capabilities, jurisdiction, assurance, and fit for European buyers.

Exoscale

Switzerland· Cloud Computing

Needs review

Shortlist Exoscale when you need multi-country European IaaS (CH/DE/AT/BG/HR zones), managed Kubernetes and open-source DBaaS under a Swiss operator in the A1 Telekom Austria group. Skip when you need hyperscaler global PaaS depth or bare-metal-first catalogs—consider OVHcloud or Scaleway instead, or AWS/Azure/GCP for worldwide regions.

EU/CH zones onlySwiss operator (Akenes SA)Managed Kubernetes (SKS)Managed DBaaSISO 27001/27017/27018 (claimed)Per-second pay-as-you-go

View listing Visit Website

Leafcloud Object Storage

Netherlands· Cloud Computing

Needs review

Shortlist Leafcloud Object Storage when you want an S3-compatible Ceph bucket in Amsterdam under Leafcloud B.V., with a public ISO 27001 certificate and a downloadable DPA. Skip when you need object versioning, multi-region replication, or AWS-parity S3 features. Consider Cyso Cloud for Dutch OpenStack storage with versioning and a Frankfurt option, or OVHcloud / Scaleway for a wider EU region map.

S3-compatible (leafcloud.store)Amsterdam residencyCeph 3x replicationISO 27001 (public cert)Public DPANo object versioning

View listing Visit Website

Highlighted rows differ between the two products.

Exoscale vs Leafcloud Object Storage: Snapshot
Feature	Exoscale	Leafcloud Object Storage
Country of origin	Switzerland	Netherlands
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Switzerland	Netherlands
Legal entity	Akenes SA, Boulevard de Grancy 19A, 1006 Lausanne, Switzerland (CHE-423.524.322); member of A1 Digital International GmbH & Co KG / A1 Telekom Austria Group	Leafcloud B.V., Amsterdam (KvK 78564417). Site: Science Park 400. DPA/ISO: Overhoeksplein 2.
Governing law	Swiss law (DPA: canton of Vaud jurisdiction language)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Customer compute/storage/SKS on Exoscale European zones (CH-GVA-2, CH-DK-2, DE-FRA-1, DE-MUC-1, AT-VIE-1/2, BG-SOF-1, HR-ZAG-1); DBaaS orchestrated by Aiven Oy (Finland) on Exoscale compute. Client ops third parties include AWS (US) data archival, Twilio (US) auth, PayPal (US) payments—privacy policy states customer-uploaded service data is not sent to those ops providers.	Objects at Amsterdam Core (europe-nl-ams1), Ceph 3x. DPA (Jan 2026): no subprocessors for core compute/storage/networking; no third-country transfers unless customer-instructed. Terms mention EU partner data centres; Core operator unnamed. Privacy allows unnamed account-data suppliers (invoicing, messaging). Site analytics: self-hosted Matomo. Not AWS/GCP/Azure-hosted.
Summary	European public cloud (IaaS) from Swiss operator Akenes SA (A1 Digital): multi-zone compute, managed Kubernetes (SKS), DBaaS, object and block storage, and GPUs across CH, DE, AT, BG, and HR.	Dutch S3-compatible object storage from Leafcloud B.V. Ceph-backed buckets in Amsterdam via leafcloud.store, plus OpenStack Swift, for backups, app data, and public objects.
Tags	gdpr cloud iaas kubernetes dbaas switzerland european-cloud gpu	gdpr object-storage s3-compatible ceph openstack netherlands iso-27001 amsterdam

At a glance: Exoscale vs Leafcloud Object Storage
At a glance	Exoscale	Leafcloud Object Storage
HQ	Lausanne, Switzerland	Not listed
Legal entity	Akenes SA (CHE-423.524.322)	Leafcloud B.V., Amsterdam; KvK 78564417
Group	A1 Digital / A1 Telekom Austria Group	Not listed
Hosting	European zones only (CH, DE, AT, BG, HR)	Not listed
Model	Public cloud IaaS + managed K8s/DBaaS	Not listed
Self-host	No (managed public cloud)	Not listed
S3 endpoint	Not listed	https://leafcloud.store (region europe-nl-ams1, path-style)
Backend	Not listed	Ceph; also OpenStack Swift / Horizon
Residency	Not listed	Amsterdam Core, Netherlands (single region)
Commercial model	Not listed	Pay for stored capacity; B2B invoicing; vendor states no API request fees
Hard limit	Not listed	No object versioning; max object 5 TB

Key capabilities: Exoscale vs Leafcloud Object Storage
Key capabilities	Exoscale	Leafcloud Object Storage
EU/CH zones only	Yes	Not listed
Swiss operator (Akenes SA)	Yes	Not listed
Managed Kubernetes (SKS)	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Per-second pay-as-you-go	Yes	Not listed
S3-compatible (leafcloud.store)	Not listed	Yes
Amsterdam residency	Not listed	Yes
Ceph 3x replication	Not listed	Yes
ISO 27001 (public cert)	Not listed	Yes
Public DPA	Not listed	Yes
No object versioning	Not listed	Yes

Exoscale

Multi-zone European KVM compute
Launch KVM instances in published zones across Switzerland, Germany, Austria, Bulgaria, and Croatia. Families cover standard, CPU-, memory-, and storage-optimized profiles plus NVIDIA GPU shapes; anti-affinity groups, instance pools, snapshots, custom templates, security groups, and live migration support production patterns. Billed per second with powered-off storage semantics as documented.
SKS managed Kubernetes (CNCF certified)
Scalable Kubernetes Service deploys a managed control plane quickly (vendor claims under about a minute to two minutes). Starter is free without SLA; Pro adds HA control plane, etcd backups, and SLA language. Node pools use Exoscale instance types including GPUs; NLB, CSI storage, autoscaling/Karpenter (Pro), and vanilla CNCF-conformance positioning keep the stack portable.
Managed DBaaS on Exoscale compute (Aiven orchestration)
Managed PostgreSQL, MySQL, Kafka, OpenSearch, Valkey, Grafana, and related engines run as DBaaS with automated backups, plan scaling, and high-availability options. Orchestration subprocessor is Aiven Oy (Finland); database instances run on Exoscale infrastructure in the zone you choose—confirm geo-replication and plan limits in docs before multi-region designs.
S3-compatible object storage and block volumes
Simple Object Storage provides S3-compatible APIs for backups, media, and app assets integrated with Exoscale IAM and zones. Block storage attaches persistent NVMe-class volumes to instances and Kubernetes via CSI for stateful workloads without tying data solely to local disks.
IAM, private networks, and automation APIs
Fine-grained IAM on API keys, private networks, and network load balancers support multi-tier designs. Portal, CLI, API, and Terraform-friendly workflows match common European DevOps practice without requiring a proprietary control language.

Leafcloud Object Storage

S3 API at leafcloud.store (europe-nl-ams1)
Path-style S3 endpoint https://leafcloud.store, region europe-nl-ams1. Works with AWS CLI, boto3, rclone, Cyberduck, MinIO mc, and other S3 SDKs. Documented features include public or private containers, bucket policies and ACLs, multipart uploads, and presigned URLs. Max object size is 5 TB via multipart. Authentication uses OpenStack EC2 credentials (openstack ec2 credentials create), not the dashboard password.
OpenStack Swift and Horizon dashboard
The same store is reachable as OpenStack object storage (Swift). Create and browse containers at create.leaf.cloud under Object Store. Native CLI uses project-scoped OpenStack auth (openstack container create / object create). Container names must be unique across all Leafcloud users. Docs say there is a limit on how many containers you can create (the exact quota is not published).
Ceph cluster with 3x replication in Amsterdam
The product page describes a Ceph backend (Apache 2.0 software) with triple replication across separate physical nodes in Amsterdam. Persistent objects sit at the Core facility. Compute Leaf sites are a different path and are not where object data is stored, according to the security pages. This is a single-region store, not a multi-region S3 deployment.
SSE-C plus TLS in transit
Official docs show S3 server-side encryption with customer-provided keys (SSE-C, AES256). Leafcloud uses the key on each request and does not store it. Lose the key and you cannot read the object. The product table also lists encryption at rest and TLS in transit as supported. DPA language is TLS 1.2+. LUKS-by-default messaging on the security pages refers to block volumes, not this object API.
Terraform state, Velero, and Nextcloud recipes
Leafcloud publishes working recipes for Terraform’s S3 backend (path-style, skip checksum/region checks, endpoint leafcloud.store), Velero Kubernetes backups (s3ForcePathStyle plus s3Url), and Nextcloud primary objectstore pointing at leafcloud.store:443. Useful if you already run those tools. Object versioning is not available, so state and backup designs must version keys themselves or copy out.

Assurance & compliance: Exoscale vs Leafcloud Object Storage
Assurance & compliance	Exoscale	Leafcloud Object Storage
Independent security / control audit	Partial Vendor states regular independent audits and publishes multi-framework certs via Compliance Center; not a VPN-style no-logs audit. Download current reports under account/NDA for verification.	Not found No public independent no-logs or object-store-specific audit PDF found. SOC 2 Type II is a separate row and is under NDA.
ISO 27001	Vendor claimed Vendor asserts ISO/IEC 27001:2022 ISMS certification since 2018; certificates via Compliance Center.	Verified Public ProCertify certificate 10112025.1 for LeafCloud B.V.: ISO/IEC 27001:2022 + Amd1:2024. Scope: information security for cloud services, infrastructure, and supporting processes. Valid 10 Nov 2025 to 10 Nov 2028. SoA v3.1 dated 5 Aug 2025. Read from the vendor-hosted PDF; not re-checked on an external accreditation database.
ISO 27017 (cloud security)	Vendor claimed Listed on compliance site as certified cloud security controls.	Not listed
ISO 27018 (cloud PII)	Vendor claimed Listed on compliance site for personal data protection in public cloud.	Not listed
SOC 2 / SOC 3	Vendor claimed SOC 2 listed on compliance marketing; obtain report via Compliance Center / NDA.	On request / NDA Vendor and DPA claim SOC 2 Type II (security, availability, confidentiality). Compliance page: request access by email. Report not reviewed for this draft.
BSI C5	Vendor claimed BSI C5 listed among national/international standards on compliance page.	Not listed
HDS (French health data hosting)	Vendor claimed HDS listed on compliance page; confirm scope and zones for health workloads.	Not listed
CSA STAR	Vendor claimed CSA STAR listed on compliance page.	Not listed
GDPR / EU data protection	Vendor claimed Swiss entity; GDPR + Swiss FADP claims; EU zones; public DPA. Not legal advice.	Vendor claimed Dutch B.V.; public DPA under Dutch law; vendor states Amsterdam-only processing and no third-country transfers unless instructed. Confirm roles (controller/processor) for your workload.
US CLOUD Act exposure (indicative)	Partial Swiss operator, no known US parent, European workload zones, and no third-party processor for compute/storage/SKS customer data. Medium residual path via US ops providers (AWS archival, Twilio auth, PayPal) listed for client data. DBaaS uses Aiven (Finland). Not legal advice.	Partial EuropeanStack assessment: EU entity, no known US parent, DPA says no core subprocessors and NL-only processing. Partial because ownership was not independently verified and terms/privacy still allow partner data centres plus unnamed account-data suppliers. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Public DPA for Akenes SA as processor; Swiss law; Aiven listed for DBaaS.	Vendor claimed Standard DPA dated January 2026 is public and states it applies automatically (no signature). Custom DPA on request. Governing law: Netherlands; courts of Amsterdam.
EU AI Act	Not applicable Primary product is IaaS/managed infrastructure; customer AI workloads remain customer-controlled. Concrete AI offerings may need separate review if used as an AI system.	Not applicable Object storage / IaaS SKU, not an AI system product.
HAVEN+ (Dutch public sector)	Not listed	Not found Security FAQ: HAVEN+ certification is in progress, not achieved. Do not treat as certified.

Considerations & known limitations: Exoscale vs Leafcloud Object Storage
Considerations & known limitations	Exoscale	Leafcloud Object Storage
US third parties on client/ops path	Medium Privacy policy lists AWS (US) data archival, Twilio (US) authentication, and PayPal (US) among client operations providers. Vendor states customer-uploaded service data is not transferred to these providers, but account/ops data paths still matter for CLOUD Act and transfer diligence.	Not listed
DBaaS subprocessor (Aiven)	Low Managed databases depend on Aiven Oy (Finland) for orchestration while instances run on Exoscale. Confirm contractual chain, access model, and zone placement for sensitive data.	Not listed
Cert evidence mostly in customer portal / NDA	Low ISO/SOC/C5/HDS claims are strong marketing signals, but full certificates and SOC reports typically require Compliance Center access or NDA—not fully public PDFs for all frameworks.	Not listed
Narrower PaaS than hyperscalers	Medium Expect solid IaaS, SKS, DBaaS, storage, and GPU—not the global proprietary service catalog of AWS/Azure/GCP. Validate feature gaps early for serverless, global edge, and specialized managed services.	Not listed
Zone catalog evolves	Low Public materials discuss further European expansion (e.g. Spain via A1 Digital messaging). Treat the live datacenters page as source of truth for residency commitments.	Not listed
Object versioning disabled	Not listed	High The product table states versioning is not enabled. Overwrites and deletes are not recoverable via S3 versions. Unsafe as a sole Terraform-state or backup target unless you version keys yourself or replicate out.
Amsterdam-only region	Not listed	Medium One S3 region (europe-nl-ams1). No documented cross-region replication. Multi-country DR or non-NL residency needs another provider.
Baseline SLA is a non-binding target	Not listed	Medium Terms target more than 99.9% monthly availability without credits on the baseline SLA. Customers must keep their own backups. Premium SLA only if agreed in writing.
Core facility operator not named	Not listed	Medium DPA says no core subprocessors. Terms mention partner data centres. Public pages do not name the Tier III Core operator. Request that name in contracting.
Incomplete S3 feature parity	Not listed	Low Custom domains are support-gated. Static hosting is basic. Do not assume lifecycle, object lock, or inventory APIs without a proof of concept.

Fit

Exoscale

Best fit when

Teams that must pin VMs, Kubernetes, and object storage to named European zones (including Swiss options)
SaaS and product orgs wanting SKS plus managed PostgreSQL/MySQL/Kafka/OpenSearch without running the control planes
Buyers who need a published DPA, zone list, and multi-framework compliance pack from a non-US legal entity
Workloads that fit IaaS plus managed open-source data services rather than proprietary global PaaS catalogs
Organizations evaluating A1 Digital / A1 Telekom Austria group cloud as a European alternative to AWS/Azure/GCP

Poor fit when

Products that depend on dozens of proprietary hyperscaler services or multi-continent active-active regions
Buyers who require zero US-group SaaS anywhere on the account path (privacy lists AWS archival, Twilio, PayPal for ops)
Teams seeking a fully self-hosted OpenStack/Kubernetes distribution rather than a managed public cloud
Bare-metal-heavy designs better served by large European bare-metal catalogs (e.g. OVHcloud)

Consider instead when

When: You need extensive bare-metal or a different pan-EU hosting footprint
Consider: OVHcloud
Often stronger metal catalog and broader hosting packaging; different sovereignty and product mix.
When: You want a developer-centric alternative with a different regional product mix
Consider: Scaleway
Common EU shortlist peer; compare zones, K8s, and storage packaging side by side.
When: You need global regions and deep proprietary PaaS/AI catalogs
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade European-operator simplicity for worldwide service breadth and US CLOUD Act parent risk.

Leafcloud Object Storage

Best fit when

Teams that need an S3-compatible endpoint and OpenStack Swift in one Dutch account
Amsterdam-only residency designs that can live without bucket versioning
Velero, Terraform state, or Nextcloud setups that already use path-style S3 clients
Buyers who want a public ISO 27001 PDF and a standard DPA before a sales call
Organisations that may later add Leafcloud VMs or GPUs in the same jurisdiction

Poor fit when

Workloads that require S3 versioning, object lock, or cross-region replication
Multi-region or in-country-outside-NL residency (this store is Amsterdam only)
Procurement that needs a named Core colocation operator and a full ancillary subprocessor register on day one
Consumer or free-tier only use (terms position Leafcloud as B2B)
Designs that assume AWS IAM, KMS, or inventory/analytics feature parity

Consider instead when

When: You need Dutch or German OpenStack object storage with versioning and more than one EU region
Consider: Cyso Cloud
Cyso documents AMS and FRA and lists versioning, lifecycle, and object lock on object storage.
When: You need many European locations and a larger IaaS catalogue than a single Amsterdam Ceph cluster
Consider: OVHcloud or Scaleway
Broader region maps; different APIs, SLAs, and ownership stories.
When: German locations and a large self-serve European hosting catalogue matter more than OpenStack Swift
Consider: Hetzner
Compare object storage vs Storage Box features and residency independently.
When: Swiss multi-zone IaaS with S3-compatible storage is the sovereignty filter
Consider: Exoscale
Different legal seat (Switzerland) and product mix.
When: You depend on versioning, replication, IAM, and KMS that only the hyperscaler S3 estate provides
Consider: Amazon S3 (or Google Cloud Storage)
Trade EU ownership for feature depth. Apply your own CLOUD Act analysis.

Open questions for due diligence

Exoscale

Download current ISO/SOC/C5/HDS certificates from the Compliance Center and verify auditor, scope, and expiry for your zones.
Confirm whether your use case can accept AWS/Twilio/PayPal on the account/ops path even if workload data stays on European Exoscale zones.
For DBaaS, document Aiven access boundaries, encryption, backup locations, and multi-zone replication behavior in writing.
If Spanish or other new zones are required, get contractual residency language rather than relying on roadmap announcements.
Clarify support plan SLAs and enterprise contracting terms beyond self-serve pay-as-you-go.

Leafcloud Object Storage

What is the current registered office on the KvK extract (Science Park 400 vs Overhoeksplein 2)?
Who operates the Amsterdam Core / partner data centre, and is that party listed as a subprocessor for physical hosting?
Can Leafcloud provide a dated list of ancillary processors (billing, support, email) used for account data?
Is there a committed date or paid option to enable Ceph/S3 versioning?
What contractual availability, durability, and deletion timelines apply to object storage under a Premium SLA versus the baseline terms (14-day vs 90-day deletion language differs between T&Cs and DPA)?