gridscale vs Scaleway

Compare gridscale and Scaleway on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Microsoft Azure

gridscale

Germany· Cloud Computing

Needs review

Shortlist when you need a German GmbH cloud with EU/CH/AT location choice, managed Kubernetes/databases, and Hybrid Core white-label HCI. Skip when you need global hyperscaler coverage or pure lowest-cost VMs—consider Hetzner for cost-sensitive compute or AWS/Azure for worldwide breadth; use OVHcloud parent portfolio when scale across more European regions is the priority.

EU-operated (DE entity)Multi-country EU/CH locationsManaged KubernetesHybrid Core HCIBSI C5 (claimed)OVHcloud group

View listing Visit Website

Scaleway

France· Cloud Computing

Needs review

Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.

EU-operated regionsBare metal + Elastic MetalEU GPU for AIKapsule KubernetesISO 27001 (certified)HDS (claimed)

View listing Visit Website

Highlighted rows differ between the two products.

gridscale vs Scaleway: Snapshot
Feature	gridscale	Scaleway
Country of origin	Germany	France
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	France
Legal entity	gridscale GmbH, Oskar-Jäger-Straße 173, 50825 Köln (HRB 97235, Amtsgericht Cologne)	SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris
Governing law	German law (GTC; English GTC for information only—German prevails)	French law (General Terms of Services)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Customer infrastructure marketed on European Tier 3 locations (Frankfurt multi-AZ, Eichenzell, Hannover, Paderborn, Amsterdam, Gais, Lucerne, Vienna); some Hybrid Core sites partner-operated (hosttech, rhöncloud, BAIONITY, windCORES). Privacy policy also lists US-group ancillary processors: Stripe (payments), Google Analytics/GTM, Microsoft Bing Ads, Meta, LinkedIn; Mautic on-prem DE; Recruitee NL. No public claim that primary VM storage runs on AWS/GCP/Azure.	Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page.
Summary	Cologne-based German IaaS/PaaS and Hybrid Core HCI cloud (OVHcloud group) with European locations, managed Kubernetes, and white-label private cloud options for DACH teams.	French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe.
Tags	cloud kubernetes api iaas paas hybrid-cloud hci german-cloud data-sovereignty	cloud kubernetes api infrastructure bare-metal gpu european-cloud gdpr hds terraform

At a glance: gridscale vs Scaleway
At a glance	gridscale	Scaleway
HQ	Cologne, Germany	Paris, France (SCALEWAY SAS)
Legal entity	gridscale GmbH (HRB 97235)	Not listed
Parent	OVHcloud (100% since Sept 2023)	Not listed
Hosting	European Tier 3 sites DE/NL/CH/AT (+ partners)	Not listed
Commercial model	B2B; trial then per-minute usage metering	Pay-as-you-go; compute Savings Plans (GPU rules differ)
Open source	No (API/IaC clients only)	Platform proprietary; open standards (K8s, S3 API, Terraform)
Group	Not listed	iliad Group subsidiary
Regions	Not listed	Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed)
Model	Not listed	Public cloud IaaS/PaaS (not self-hosted)

Key capabilities: gridscale vs Scaleway
Key capabilities	gridscale	Scaleway
EU-operated (DE entity)	Yes	Yes
Multi-country EU/CH locations	Yes	Not listed
Managed Kubernetes	Yes	Yes
Hybrid Core HCI	Yes	Not listed
BSI C5 (claimed)	Yes	Not listed
OVHcloud group	Yes	Not listed
Bare metal + Elastic Metal	Not listed	Yes
EU GPU for AI	Not listed	Yes
ISO 27001 (certified)	Not listed	Yes
HDS (claimed)	Not listed	Yes

gridscale

Panel + API + Terraform provisioning
Deploy VMs with attached storage in seconds via the control panel or automate with the REST API and common IaC clients (Terraform, Packer). Built for teams that want both click-ops and git-ops without a hyperscaler control-plane learning curve.
Managed Kubernetes, databases, and load balancers
PaaS layers cover managed Kubernetes orchestration plus fully managed databases with audit logs and automatic backups, and managed load balancers for traffic distribution—so app teams avoid running the full stack themselves.
S3-compatible object storage and Rocket NVMe storage
Object storage follows S3-style APIs for backups, archives, and unstructured data, with region choice called out for GDPR-oriented placement. Rocket Storage targets high-IOPS NVMe workloads; not every Hybrid Core location exposes object storage—check the data-center matrix.
Per-minute GPU bare-metal for AI/ML
GPU instances are marketed as dedicated bare-metal performance for AI/ML and data science, with CPU, RAM, and storage included and usage billed by the minute rather than only long-term reserved shapes.
Hybrid Core Concierge HCI and white-label cloud
Fully managed hyperconverged packages combine hardware delivery, installation, remote operations, white-label branding/SAML options, and access to the wider gridscale location ecosystem—aimed at enterprises and hosters building private or partner clouds.

Scaleway

Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.

Assurance & compliance: gridscale vs Scaleway
Assurance & compliance	gridscale	Scaleway
Independent security / no-logs audit	Not applicable IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required.	Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.
ISO 27001	Vendor claimed Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification.	Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.
ISO 27017 (cloud security)	Vendor claimed Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates.	Not listed
ISO 27018 (cloud PII)	Vendor claimed Claimed on compliance/about materials; request current scope.	Not listed
SOC 2 / SOC 3	Not found No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard).	Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).
ISAE 3402 SOC 1 Type 2	Vendor claimed About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report.	Not listed
BSI C5	Vendor claimed Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation.	Not listed
GDPR / EU data protection	Vendor claimed German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing.	Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.
US CLOUD Act exposure (indicative)	Partial EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice.	Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.
Data processing agreement (B2B)	Vendor claimed GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone.	Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.
EU AI Act	Not applicable Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model.	Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.
Trusted Cloud (DE)	Vendor claimed Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de.	Not listed
HDS (French health data hosting)	Not listed	Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.
CSA STAR Level 1	Not listed	Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).
ANSSI SecNumCloud	Not listed	Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Considerations & known limitations: gridscale vs Scaleway
Considerations & known limitations	gridscale	Scaleway
Parent-group integration after OVHcloud acquisition	Medium 100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation.	Not listed
Partner-operated Hybrid Core locations	Medium Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording.	Not listed
US-group ancillary processors (account/marketing)	Medium Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only.	Not listed
Certifications need current attestation packs	Low BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone.	Not listed
Narrower global footprint than hyperscalers	Low Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services).	Not listed
SecNumCloud not yet obtained	Not listed	Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.
Smaller service catalogue than US hyperscalers	Not listed	Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.
Account-plane processors and possible non-EU transfers	Not listed	Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.
Shared responsibility for guest security	Not listed	Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.
Dedibox vs Elastic Metal product split	Not listed	Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.

Fit

gridscale

Best fit when

DACH mid-market teams wanting German contracting plus managed PaaS (Kubernetes, databases, load balancers)
MSPs and hosters needing white-label branding, multi-tenant accounts, and optional Hybrid Core hardware
Workloads that must pick DE/NL/CH/AT regions with Tier 3 marketing claims and green-energy positioning
AI/ML or data-science jobs that need GPU bare-metal with per-minute metering
Buyers who value panel + API/Terraform over hyperscaler IAM sprawl

Poor fit when

Global multi-region applications that need hyperscaler edge, marketplace services, or non-European regions
Teams optimising only for lowest bare VM or dedicated-server unit cost (evaluate Hetzner first)
Buyers requiring public SOC 2 Type II specifically rather than ISAE 3402 SOC 1 Type 2 / BSI C5 packs
Organisations that forbid any US-group ancillary processors (Stripe/Google marketing tools appear in the privacy recipient list)

Consider instead when

When: You need the broader European hyperscale portfolio and more regions under one group brand
Consider: OVHcloud
OVHcloud is the parent group; gridscale stays the HCI/panel-focused product line
When: Cost-sensitive VMs or dedicated servers dominate and you do not need Hybrid Core white-label
Consider: Hetzner
Hetzner typically wins raw price/performance for simple compute
When: France-centric developer cloud with different location and product skew
Consider: Scaleway
Compare ARM options and FR footprint versus gridscale DACH Hybrid Core
When: Swiss-rooted EU cloud positioning is the primary evaluation criterion
Consider: Exoscale
Still compare DE/CH site maps and managed service depth side by side
When: You need worldwide regions, marketplace depth, or US-public-sector cloud programmes
Consider: Amazon Web Services (AWS) or Microsoft Azure
Trade EU-entity simplicity for hyperscaler breadth and US ownership path

Scaleway

Best fit when

Teams that need compute, storage, networking and managed Kubernetes in documented EU multi-AZ regions under a French legal entity
AI/ML workloads that require NVIDIA GPUs with European data residency rather than US-region training defaults
Workloads that benefit from single-tenant bare metal (Elastic Metal or Dedibox) alongside cloud APIs
Healthtech or French-market buyers that need HDS-oriented hosting signals plus a published B2B DPA
Platform engineers standardising on Terraform/API-driven provisioning with S3-compatible storage and managed Postgres/MySQL

Poor fit when

Organisations that require a finished ANSSI SecNumCloud qualification on day one (process is ongoing, not completed on public pages)
Architectures that must run primary production in US or APAC regions on the same cloud account
Buyers that need the full hyperscaler catalogue (global edge, proprietary PaaS density, enterprise marketplace breadth)
Teams expecting a self-hosted “install Scaleway on your own DC” product rather than a managed cloud
Procurement processes that accept only SOC 2 Type II as the primary assurance artefact (not surfaced as a public Trust Center badge here)

Consider instead when

When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.

Open questions for due diligence

gridscale

Will gridscale execute your template AV/DPA and attach a location-specific subprocessor list for the regions you enable?
What is the current scope and report date for BSI C5 and ISAE 3402 SOC 1 Type 2 covering the services you will buy?
Which privacy-policy third parties process production account/identity data versus website marketing only?
How are OVHcloud group affiliates involved in support, billing, or platform operations for gridscale customers post-acquisition?
For Hybrid Core partner sites, who is the data-center operator of record and what audit rights apply?

Scaleway

What is the exact HDS certificate scope (services, regions, shared responsibility) for our architecture?
What is the current ANSSI SecNumCloud milestone and target date for the SKUs we would buy?
Which named subprocessors (including any non-EU) process account, billing, support or security telemetry data?
For multi-region DR, which products are GA in each AZ (including Milan) at contract time?
Are independent SOC 2 / C5 or other reports available under NDA if our assurance programme requires them?