Hetzner Object Storage vs Scaleway

Compare Hetzner Object Storage and Scaleway on capabilities, jurisdiction, assurance, and fit for European buyers.

Logo: Hetzner Object Storage

Hetzner Object Storage

Germany· Cloud Computing

Needs review

Shortlist when you want S3-compatible buckets in Falkenstein, Nuremberg, or Helsinki under Hetzner Online GmbH, especially if you already run Hetzner compute. Skip when you need AWS-parity features, flash tiers, a CDN, or default KMS at-rest encryption. Prefer Amazon S3 for full feature depth; prefer Scaleway or OVHcloud if you want another European S3 SKU without a Hetzner compute relationship.

S3-compatible APIEU-only locationsSingle-DC residencyObject lock + versioningSSE-C (opt-in)ISO 27001 (company)
View listingVisit Website
Logo: Scaleway

Scaleway

France· Cloud Computing

Needs review

Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.

EU-operated regionsBare metal + Elastic MetalEU GPU for AIKapsule KubernetesISO 27001 (certified)HDS (claimed)
View listingVisit Website

Highlighted rows differ between the two products.

Hetzner Object Storage vs Scaleway: Snapshot
FeatureLogo: Hetzner Object StorageHetzner Object StorageLogo: ScalewayScaleway
Country of originGermanyFrance
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersGermanyFrance
Legal entityHetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris
Governing lawNot listedFrench law (General Terms of Services)
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowLow
Hosting / residencyObject Storage only in Falkenstein, Nuremberg (company-operated DE parks) and Helsinki (Hetzner Finland Oy for building rental and technical support). Entire bucket stays in the selected single data center on Hetzner Ceph. No US or Singapore object-storage region. Group still has Hetzner US LLC, Hetzner Singapore Pte. Ltd., and US/SG colocation partners for other Cloud server products. Customer master data stays in the EU per Hetzner docs.Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page.
Summary

German S3-compatible object storage from Hetzner Online GmbH: buckets in Falkenstein, Nuremberg, and Helsinki with location-specific endpoints.

French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe.

Tags
gdprobject-storages3hetznergermanycephbackupeu-residencyiso-27001
gdprcloudinfrastructurebare-metalkubernetesgpueuropean-cloudhdsapiterraform
At a glance: Hetzner Object Storage vs Scaleway
At a glanceLogo: Hetzner Object StorageHetzner Object StorageLogo: ScalewayScaleway
HQGunzenhausen, GermanyParis, France (SCALEWAY SAS)
Legal entityHetzner Online GmbH (HRB 6089 Ansbach)Not listed
LocationsFSN1 Falkenstein, NBG1 Nuremberg, HEL1 HelsinkiNot listed
APIS3-compatible, AWS Signature Version 4Not listed
Storage backendCeph on HDD (standard tier only)Not listed
EncryptionNo default at-rest; optional SSE-CNot listed
Commercial modelHourly base fee with included storage and egress quota, then pay-as-you-goPay-as-you-go; compute Savings Plans (GPU rules differ)
GroupNot listediliad Group subsidiary
RegionsNot listedParis, Amsterdam, Warsaw multi-AZ (+ Milan listed)
ModelNot listedPublic cloud IaaS/PaaS (not self-hosted)
Open sourceNot listedPlatform proprietary; open standards (K8s, S3 API, Terraform)
Key capabilities: Hetzner Object Storage vs Scaleway
Key capabilitiesLogo: Hetzner Object StorageHetzner Object StorageLogo: ScalewayScaleway
S3-compatible APIYesNot listed
EU-only locationsYesNot listed
Single-DC residencyYesNot listed
Object lock + versioningYesNot listed
SSE-C (opt-in)YesNot listed
ISO 27001 (company)YesYes
EU-operated regionsNot listedYes
Bare metal + Elastic MetalNot listedYes
EU GPU for AINot listedYes
Kapsule KubernetesNot listedYes
HDS (claimed)Not listedYes

Hetzner Object Storage

  • S3 API with FSN1, NBG1, and HEL1 endpoints

    Amazon S3 compatible API using AWS Signature Version 4. Location endpoints are fsn1.your-objectstorage.com, nbg1.your-objectstorage.com, and hel1.your-objectstorage.com. AWS CLI and common SDKs work when pointed at the Hetzner endpoint. Console covers bucket create and credentials; almost all object operations go through the S3 API.

  • Single-location EU bucket residency on Ceph

    A bucket is stored entirely in the location you pick (Falkenstein, Nuremberg, or Helsinki), in one data center. Docs describe a Ceph cluster with erasure coding that can keep data intact if up to three storage servers fail. There is no US or Singapore object-storage region and no built-in cross-location replication.

  • Object lock, versioning, and lifecycle expiry

    Object Lock can be enabled at bucket create (legal hold and retention). Versioning and lifecycle rules are documented, including NoncurrentDays expiry. Pre-signed URLs give time-limited access. Object lock cannot be turned on later for a bucket created without it.

  • SSE-C encryption (no default at-rest, no SSE-KMS)

    There is no default data-at-rest encryption. Optional SSE-C encrypts object bytes with a customer-provided key that Hetzner says it discards after use. Metadata is not encrypted. Losing the key means losing access. SSE-C object copy is listed as unsupported.

  • Project-wide keys, documented S3 gaps, and hard limits

    By default each key pair can read and write every bucket in the same project unless you add bucket policies or split projects. Account limits include 100 buckets, 100 TB and 50 million objects per bucket, 5 TB max object, 5 GB per single PUT, 750 requests per second per bucket, and 10 Gbit/s per bucket. Notifications, website hosting, inventory, replication, and custom domains are not supported.

Scaleway

  • Elastic Metal, Dedibox and Apple Silicon bare metal

    Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.

  • EU-resident GPU instances for AI training and inference

    On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.

  • Kubernetes Kapsule and multi-cloud Kosmos

    Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.

  • Multi-AZ European regions with VPC networking

    Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.

  • Managed storage and databases on open-ish APIs

    S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.

  • API, CLI and Terraform-first operations

    Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.

Assurance & compliance: Hetzner Object Storage vs Scaleway
Assurance & complianceLogo: Hetzner Object StorageHetzner Object StorageLogo: ScalewayScaleway
Independent security / no-logs audit
Not applicable

IaaS object store, not a no-logs VPN. Company publishes ISO 27001, BSI C5 Type 2, and annual TOM review instead.

Not applicable

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

ISO 27001
Verified

Public ISO/IEC 27001:2022 certificate (SOCOTEC) for the ISMS covering Nuremberg, Falkenstein, and Helsinki parks. Confirm attested scope includes this SKU with your auditor.

Verified

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

SOC 2 / SOC 3
Not found

Hetzner states it focuses on ISO 27001 rather than SOC 2.

Not found

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

GDPR / EU data protection
Vendor claimed

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data stored in buckets.

Vendor claimed

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

US CLOUD Act exposure (indicative)
Partial

EU entity, no known US parent, Object Storage has no US region and no US-group storage backend. Group still includes Hetzner US LLC for other products. Not legal advice.

Partial

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Data processing agreement (B2B)
Vendor claimed

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Vendor claimed

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

EU AI Act
Not applicable

Object storage infrastructure, not an AI system product.

Not applicable

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

BSI C5 (cloud)
Verified

Vendor publishes a BSI C5 Type 2 attestation PDF for cloud services. Confirm whether Object Storage is inside the attested cloud-service scope.

Not listed
HDS (French health data hosting)Not listed
Vendor claimed

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

CSA STAR Level 1Not listed
Vendor claimed

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

ANSSI SecNumCloudNot listed
Partial

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Considerations & known limitations: Hetzner Object Storage vs Scaleway
Considerations & known limitationsLogo: Hetzner Object StorageHetzner Object StorageLogo: ScalewayScaleway
Partial S3 compatibility
Medium

Supported-actions list omits website hosting, notifications, inventory, replication, custom domains, SSE-KMS, and more. CopyObject may fail even in one location. Apps that assume full AWS S3 will break.

Not listed
HDD tier, not a CDN
Medium

Standard HDD only, no archive or flash classes. Hetzner says it is a poor fit for high-frequency small objects, low-latency apps, and large-scale public HTTP. Plan a CDN or different storage for those cases.

Not listed
No default at-rest encryption
Medium

Objects are not encrypted at rest unless you use SSE-C and keep the key. Lost keys are unrecoverable. SSE-C copy is unsupported.

Not listed
Single data center, no built-in replication
Medium

A bucket lives in one DC. There is no first-party cross-location replication. You must build DR yourself if one park outage is unacceptable.

Not listed
Shared-cluster load and 503s
Medium

Vendor docs describe cluster growth, bucket migrations, and temporary concurrency or upload limits (including 503 in Nuremberg under load). Shared tenancy can affect latency.

Not listed
Group US and Singapore entities
Low

This SKU is EU-only, but Hetzner Online GmbH has US and Singapore subsidiaries for other Cloud locations. Zero-US-footprint procurement may still reject the vendor.

Not listed
SecNumCloud not yet obtainedNot listed
Medium

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Smaller service catalogue than US hyperscalersNot listed
Medium

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Account-plane processors and possible non-EU transfersNot listed
Low

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Shared responsibility for guest securityNot listed
Medium

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Dedibox vs Elastic Metal product splitNot listed
Low

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.

Fit

Hetzner Object Storage

Best fit when

  • Teams already on Hetzner Cloud or dedicated servers that want an S3 endpoint under the same German contract
  • Backups, archives, dumps, and warm or cold blobs that fit write-once, read-many access
  • Workloads that can pin a bucket to Falkenstein, Nuremberg, or Helsinki and accept a single data center
  • Backup tools and apps that speak generic S3 (AWS CLI, rclone, MinIO client, Synology Hyper Backup)
  • Buyers who need object lock, versioning, or lifecycle expiry without US object-storage regions

Poor fit when

  • Apps that need Amazon S3 feature parity (events, website hosting, inventory, KMS, replication, storage classes)
  • CDN-style public delivery or high-frequency tiny-object / low-latency database use
  • Policies that require default provider-managed at-rest encryption (SSE-S3 or SSE-KMS)
  • Orgs that forbid any US subsidiary at group level even when this SKU stays in the EU
  • Buyers who need more than 100 buckets or first-party cross-location DR

Consider instead when

  • When: You need the full Amazon S3 feature set, storage classes, KMS, events, or global regions

    Consider: Amazon S3

    Accept US-group jurisdiction in exchange for catalog depth.

  • When: You want another European S3-compatible cloud without a Hetzner compute relationship

    Consider: Scaleway or OVHcloud

    Compare their object-storage regions, S3 gaps, and contract entities separately.

  • When: You are evaluating Hetzner VMs, bare metal, or the company as a whole

    Consider: Hetzner

    The company page covers IaaS and parks; this page is the bucket SKU only.

  • When: You want a smaller EU cloud with S3-oriented positioning

    Consider: Cyso Cloud

    Verify current regions and S3 compatibility on that product page.

Scaleway

Best fit when

  • Teams that need compute, storage, networking and managed Kubernetes in documented EU multi-AZ regions under a French legal entity
  • AI/ML workloads that require NVIDIA GPUs with European data residency rather than US-region training defaults
  • Workloads that benefit from single-tenant bare metal (Elastic Metal or Dedibox) alongside cloud APIs
  • Healthtech or French-market buyers that need HDS-oriented hosting signals plus a published B2B DPA
  • Platform engineers standardising on Terraform/API-driven provisioning with S3-compatible storage and managed Postgres/MySQL

Poor fit when

  • Organisations that require a finished ANSSI SecNumCloud qualification on day one (process is ongoing, not completed on public pages)
  • Architectures that must run primary production in US or APAC regions on the same cloud account
  • Buyers that need the full hyperscaler catalogue (global edge, proprietary PaaS density, enterprise marketplace breadth)
  • Teams expecting a self-hosted “install Scaleway on your own DC” product rather than a managed cloud
  • Procurement processes that accept only SOC 2 Type II as the primary assurance artefact (not surfaced as a public Trust Center badge here)

Consider instead when

  • When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator

    Consider: OVHcloud

    Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.

  • When: You want simpler EU VPS/dedicated economics with a smaller product surface

    Consider: UpCloud, Exoscale, or Cyso Cloud

    Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.

  • When: You need maximum global managed-service depth and partner ecosystem

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Accept US-parent CLOUD Act exposure and design residency/controls explicitly.

  • When: German SMB hosting plus EU cloud under a DE-centric brand is the priority

    Consider: IONOS

    Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.

Open questions for due diligence

Hetzner Object Storage

  • Does your auditor accept Hetzner's park-level ISO 27001 and cloud C5 Type 2 for this object-storage SKU without a SKU-specific statement of applicability?
  • Can your application live with the documented S3 gaps (no events, website, KMS, replication, custom domain)?
  • Is a single data center per bucket acceptable, or do you need first-party multi-site replication?
  • Will you operate SSE-C key management yourself, or do you require provider-managed at-rest encryption?
  • Does group presence of Hetzner US LLC block you even if buckets stay in DE/FI?

Scaleway

  • What is the exact HDS certificate scope (services, regions, shared responsibility) for our architecture?
  • What is the current ANSSI SecNumCloud milestone and target date for the SKUs we would buy?
  • Which named subprocessors (including any non-EU) process account, billing, support or security telemetry data?
  • For multi-region DR, which products are GA in each AZ (including Milan) at contract time?
  • Are independent SOC 2 / C5 or other reports available under NDA if our assurance programme requires them?