Leaseweb vs STACKIT

Compare Leaseweb and STACKIT on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Google Cloud Platform, Microsoft Azure

Leaseweb

Netherlands· Cloud Computing

Needs review

Shortlist when you want a Dutch (or other local Leaseweb) B2B contract for dedicated servers, CloudStack public cloud, colo, or regional object storage, and you will pick the DC yourself. Skip when you need EU-only halls with no US affiliate in the group, a hyperscaler-width managed-platform catalog, or self-serve hobby VPS without KYC. Consider Hetzner or OVHcloud for simpler EU-centric IaaS, or AWS if you need the global managed-service surface.

Dutch sales entityDedicated / bare metalCloudStack KVM public cloudS3-compatible object storageColo + global DCsISO 27001 (claimed)

View listing Visit Website

STACKIT

Germany· Cloud Computing

Needs review

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid

View listing Visit Website

Highlighted rows differ between the two products.

Leaseweb vs STACKIT: Snapshot
Feature	Leaseweb	STACKIT
Country of origin	Netherlands	Germany
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Netherlands	Germany
Legal entity	Leaseweb Netherlands B.V. (KvK 30141839, Amsterdam). Website: Leaseweb Global B.V. (KvK 60593652). Other local sales entities exist.	Schwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)
Governing law	Not listed	Germany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Customer-chosen Leaseweb halls (Amsterdam, Frankfurt, London, plus US, CA, SG, HK, AU). Object storage: nl-01, de-01, uk-01, us-01, ca-01, sg-01. Optional Cloud Connect via Megaport to AWS, Google Cloud, Azure. Public Cloud backup row lists Acronis. NL Feb 2026 terms keep that entity on Dutch DCs unless law, written authorisation, or customer action. Sub-processor list on request.	Vendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.
Summary	Dutch B2B IaaS: dedicated servers, CloudStack public cloud, colocation, and S3-compatible object storage on a global hall list under local sales entities.	German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.
Tags	iaas dedicated-servers bare-metal colocation object-storage cloudstack netherlands gdpr b2b	iaas cloud infrastructure privacy kubernetes sovereign-cloud paas

At a glance: Leaseweb vs STACKIT
At a glance	Leaseweb	STACKIT
HQ	Amsterdam, Netherlands	Not listed
Typical NL contract	Leaseweb Netherlands B.V. (KvK 30141839)	Not listed
Website operator	Leaseweb Global B.V. (KvK 60593652)	Not listed
Founded	1997 (vendor 2022 press)	Not listed
Product type	B2B IaaS (dedicated, cloud, colo, object storage); not self-hosted, not open source	Not listed
Published dedicated DCs	AMS-01/02, FRA-10, LON-01/11, MTL-02, SIN-01, HKG-10, SYD-10, plus nine US halls	Not listed
Object storage regions	nl-01, de-01, uk-01, us-01, ca-01, sg-01	Not listed
Commercial model	B2B contract, monthly or hourly cloud, KYC on first order	Not listed
HQ / legal entity	Not listed	Bad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KG
Parent	Not listed	Schwarz Digits (Schwarz Group — Lidl/Kaufland)
Hosting	Not listed	Group-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure reseller
Model	Not listed	Consumption-based public cloud + quote-based colocation
Open source	Not listed	Uses open-source components; platform itself is managed, not self-hosted
External market	Not listed	Public offering from 2022 (internal roots from 2018)

Key capabilities: Leaseweb vs STACKIT
Key capabilities	Leaseweb	STACKIT
Dutch sales entity	Yes	Not listed
Dedicated / bare metal	Yes	Not listed
CloudStack KVM public cloud	Yes	Not listed
S3-compatible object storage	Yes	Not listed
Colo + global DCs	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
EU-operated	Not listed	Yes
German legal entity	Not listed	Yes
Group-owned DE/AT DCs	Not listed	Yes
BSI C5 Type 2 (claimed)	Not listed	Yes
Managed Kubernetes (SKE)	Not listed	Yes
EU colocation + hybrid	Not listed	Yes

Leaseweb

Dedicated servers with portal, API, and Instant Delivery
Bare metal for databases, analytics, gaming, and e-commerce. The knowledge base lists Windows or Linux images, Volume or Premium transit, interconnects, and Layer 2 private networking. First orders are phone-verified. Instant Delivery SKUs can provision within an hour; custom builds take longer. CPU cannot be upgraded in place.
CloudStack Public Cloud on KVM
Instances run on Leaseweb-owned CloudStack KVM with general-purpose, compute, memory, and GPU-oriented families. Billing is hourly on-demand or monthly. Local NVMe is faster but slower to recover if a hypervisor fails. Central NFS storage is the higher-availability path. Each instance gets one public IPv4. Extra IPv4 is not offered yet.
S3-compatible object storage with named regions
HTTPS/S3 API buckets at nl.object-storage.io, de.object-storage.io, uk.object-storage.io, us.object-storage.io, ca.object-storage.io, and sg.object-storage.io. Leaseweb says objects are stored in three availability zones. The default S3 region name us-east-1 is a compatibility alias, not a geography. Keys are created in the Customer Portal.
Colocation with remote hands
Bring your own servers into Leaseweb halls. Shared 1U to 5U is only in AMS-01 and FR-01. Private racks and cages are for larger or more isolated deployments. Remote hands are 24/7 and included by default, with higher packages available. Colo knowledge base counts six European halls (Netherlands, Germany, UK), seven in Asia-Pacific and Oceania, and twelve in the US and Canada.
Private network and Cloud Connect to hyperscalers
Layer 2 private networking can join dedicated servers, Public Cloud, VMware products, and colo in the same DC (and some metro pairs). Cloud Connect uses Megaport SDN plus a Leaseweb router to reach AWS, Google Cloud, and Azure from selected halls (including AMS-01/02, FRA, London, WDC-02, Singapore, Montreal, Sydney). Redundant paths are Active-Standby. Delivery is quoted in business days via sales.
Customer Portal, REST API, and Terraform
Operators power-cycle, reinstall, rescue, manage IPs, attach private networks, and watch traffic graphs without a ticket for routine work. developer.leaseweb.com documents the REST API, GitHub integrations, a Terraform provider for Leaseweb Cloud, and S3 compatibility. This is not a self-hosted control plane you run yourself.

STACKIT

Compute Engine VMs and GPUs in group-owned EU regions
Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.
STACKIT Kubernetes Engine (SKE)
Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.
Managed databases, messaging, and observability
Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.
Confidential computing and key/secrets control
Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.
EU colocation with hybrid path to public cloud
Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.
Object, block, file, backup, and archiving storage
S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

Assurance & compliance: Leaseweb vs STACKIT
Assurance & compliance	Leaseweb	STACKIT
Independent security / no-logs audit	Not found IaaS provider, not a no-logs VPN. No public independent audit of logging practices found beyond the named ISO/SOC/PCI reports.	Vendor claimed Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit.
ISO 27001	Vendor claimed Vendor: ISO 27001:2022 via EY CertifyPoint for Leaseweb Global B.V., Netherlands B.V., USA, Deutschland, UK, Singapore, Canada, Network B.V. Services listed: corporate infrastructure, bare metal, VPS, private/hybrid cloud, colo, web hosting, domains. Certificate download promised on the marketing security page (SPA). Independent register entry not retrieved in this pass.	Vendor claimed Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components.
SOC 2 / SOC 3	Partial SOC 2 published for Leaseweb Canada, Inc. colocation (Security and Availability, UHY Forbes Andersen). Several entities have SOC 1 Type II (EY / ISAE 3402) covering cloud, dedicated, colo, and web hosting.	Vendor claimed Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request.
GDPR / EU data protection	Vendor claimed NL entity; Clause 8 cites GDPR and the Dutch UAVG. Transfers outside the EEA only with safeguards. Global catalog still includes non-EU regions.	Vendor claimed EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud.
US CLOUD Act exposure (indicative)	Partial Dutch group, no known US parent, but the catalog includes US halls, Leaseweb USA, Inc., us-01 object storage, and optional Cloud Connect to AWS/GCP/Azure. NL Clause 8.3 can keep a Netherlands contract on Dutch DCs if you do not choose otherwise. Assessment row, not a vendor claim. Not legal advice.	Partial German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice.
Data processing agreement (B2B)	Vendor claimed Privacy page (search snippet) and NL/DE sales terms: processor language in Clause 8; standalone DPA on request in older DE terms. Sub-processor list on request (NL 8.4).	Not found No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement.
EU AI Act	Not applicable IaaS compute, storage, colo, and network. Public Cloud lists small-scale GPU/inference instance types, but the offering is not an AI system product.	Not applicable Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems.
PCI DSS	Partial Vendor: PCI DSS 4.0 scoped to physical security at named DCs (AMS-01, FRA-01, LON-01, SIN-01, WDC-02, MTL-01/02/03). Services are not meant to process card data by default.	Not listed
NEN 7510	Vendor claimed Vendor: EY statement for Leaseweb Netherlands B.V. at AMS-01 (physical security, IS policy, risk, resilience, incidents, service deployment). Not inherited by the customer.	Not listed
CISPE IaaS Code of Conduct	Vendor claimed Historical CISPE member listing and lobbyfacts affiliation. Current CISPE public register was not confirmed to contain a live Leaseweb service declaration in this pass.	Not listed
BSI C5 Type 2	Not listed	Vendor claimed C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product.
TISAX Level 3	Not listed	Vendor claimed Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page).

Considerations & known limitations: Leaseweb vs STACKIT
Considerations & known limitations	Leaseweb	STACKIT
Global catalog includes US halls and a US affiliate	Medium Even with a Dutch contractor and NL Clause 8.3, the product menu includes US dedicated halls, us-01 object storage, and Leaseweb USA, Inc. Buyers with a residency ban must lock region and entity in the order, not rely on the brand name.	Not listed
No public IaaS subprocessor register	Medium NL terms authorise EEA affiliates and other third parties as sub-processors, with the actual list on request. Known optional paths: Megaport plus AWS/GCP/Azure (Cloud Connect) and Acronis (Public Cloud backup row). Website marketing also uses US SaaS (outside the IaaS path).	Not listed
Certification scope is entity- and service-specific	Low ISO is claimed for listed IaaS services, not automatically for every SKU. SOC 2 is Canada colo. PCI is physical security only. Customers are not certified by association.	Not listed
Public Cloud / VPS IPv4 and Elastic Compute end of sale	Low Docs: one public IPv4 on Public Cloud and VPS, extras not yet available. Elastic Compute is end of sale. Dedicated CPU cannot be upgraded without a new server.	Not listed
Narrower service map than US hyperscalers	Not listed	Medium STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.
C5 Type 2 is product-scoped	Not listed	Medium Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.
Limited public subprocessor inventory	Not listed	Low Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.
Retail-group operator concentration	Not listed	Low Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.

Fit

Leaseweb

Best fit when

Teams that want a KvK-identifiable Dutch contractor (Leaseweb Netherlands B.V.) for IaaS, not a US parent
Operators placing dedicated servers or colo in named halls (Amsterdam, Frankfurt, London, plus optional non-EU cities)
Workloads that need CloudStack KVM or S3-compatible buckets with an explicit nl-01 / de-01 / uk-01 endpoint
Hybrid designs that keep origin on Leaseweb metal and optionally Cloud-Connect to AWS, Google Cloud, or Azure
Buyers who will use the Customer Portal, REST API, or Terraform rather than a fully managed PaaS

Poor fit when

Organisations that forbid any US group company, US datacentre option, or US-region object storage in the same vendor catalog
Teams that need extra public IPv4 on Public Cloud or VPS (docs: one IPv4, extras not yet available)
Buyers looking for a self-hosted control plane or an open-source product they operate themselves
People who actually wanted Leaseweb Multi-CDN rather than compute and colo
Hobby or consumer hosting: NL terms state B2B only, with KYC on first order

Consider instead when

When: You want a larger managed-cloud catalog (IAM, managed databases, serverless) and accept a US parent
Consider: Amazon Web Services (AWS) or Google Cloud Platform
Different jurisdiction and product surface. Leaseweb stays IaaS-classic.
When: You want European IaaS with a simpler EU-centric hall list and strong self-serve dedicated servers
Consider: Hetzner or OVHcloud
Still diligence their own non-EU options. Neither is a Leaseweb contract.
When: You want French public cloud with object storage and more developer-cloud SKUs
Consider: Scaleway
Different product mix. Confirm current regions on Scaleway's site.
When: You mainly need a German-group host with a broad SMB catalog
Consider: IONOS
Different ownership and SKU mix than Leaseweb's local-entity IaaS model.
When: You actually needed global content delivery, not origin compute
Consider: Leaseweb CDN
Same group, different data path (partner CDNs and a Washington D.C. shield).

STACKIT

Best fit when

Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
Teams that must self-host the full cloud control plane rather than consume a managed public cloud
Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
Use cases requiring non-European data residency as a primary requirement

Consider instead when

When: You need a wider multi-country European region map and a large independent cloud portfolio
Consider: OVHcloud or Scaleway
Different ownership and product cultures; still not US hyperscaler breadth
When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth
Consider: IONOS (or similar DE hosts)
Often simpler packaging for commodity compute
When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis
When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale
Consider: Exoscale
Smaller portfolio; different jurisdiction story

Open questions for due diligence

Leaseweb

For the SKUs we will buy, what is the current ISO 27001 statement of applicability (and is object storage in scope)?
Will Leaseweb issue the current sub-processor list for this order, including Acronis and Megaport if used?
Can the contract freeze region to named EU halls and forbid US-affiliate access except as Clause 8.3 allows?
What is the current Instant Delivery dedicated inventory in AMS/FRA versus US halls?
Is there a live CISPE public-register declaration for these IaaS services?

STACKIT

Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
What are exit, data export, and termination assistance terms for large object stores and managed databases?
For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?