Scaleway vs SiteGround

Compare Scaleway and SiteGround on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Google Cloud Platform

Logo: Scaleway

Scaleway

France· Cloud Computing

Needs review

Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.

EU-operated regionsBare metal + Elastic MetalEU GPU for AIKapsule KubernetesISO 27001 (certified)HDS (claimed)
Logo: SiteGround

SiteGround

Bulgaria· Web Hosting and Cloud Computing

Needs review

Shortlist when you want managed WordPress or PHP hosting with an EU or UK contract, a named European Google Cloud region, and Site Tools. Skip when you need EU-owned metal with no US-group cloud. Consider IONOS, OVHcloud, Scaleway, or Hetzner instead in that case.

EU-operated (BG origin, ES/UK contracts)Managed WordPress / PHP hostingGoogle Cloud regions (not EU-only)Site Tools control panelSuperCacherDPA in TOS pack
Scaleway vs SiteGround: Snapshot
FeatureLogo: ScalewayScalewayLogo: SiteGroundSiteGround
Country of originFranceBulgaria
CategoryCloud ComputingWeb Hosting and Cloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersFranceBulgaria
Legal entitySCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 ParisSiteGround Hosting EOOD (BG UIC 204181297). EU: Spain S.L. B-87194171. UK: Hosting Ltd 09348602. US storefront: SG Hosting Inc.
Governing lawFrench law (General Terms of Services)Not listed
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowMedium
Hosting / residencyCustomer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page.Primary hosting: Google Cloud Platform in customer-chosen SiteGround regions (Europe: Madrid, Eemshaven, Frankfurt, Paris, London; plus US and APAC). CDN: SiteGround CDN on the Google Cloud edge network (global, including US). Backups: vendor says geographically separate / offsite on Cloud. No public dated subprocessor register found. Payments, analytics, and third-party AI models are mentioned in privacy/TOS.
Summary

French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe.

Sofia-origin managed web and WordPress hosting on Google Cloud, with Site Tools, SuperCacher, and EU or UK contracting entities depending on storefront.

Tags
At a glance: Scaleway vs SiteGround
At a glanceLogo: ScalewayScalewayLogo: SiteGroundSiteGround
HQParis, France (SCALEWAY SAS)Not listed
Groupiliad Group subsidiaryNot listed
RegionsParis, Amsterdam, Warsaw multi-AZ (+ Milan listed)Not listed
ModelPublic cloud IaaS/PaaS (not self-hosted)Not listed
Commercial modelPay-as-you-go; compute Savings Plans (GPU rules differ)Prepaid subscription (shared StartUp/GrowBig/GoGeek and Cloud). Confirm live site.
Open sourcePlatform proprietary; open standards (K8s, S3 API, Terraform)Not listed
HQ / originNot listedSofia, Bulgaria (founded 2004, privately owned)
EU contractNot listedSiteGround Spain S.L. (CIF B-87194171, Madrid)
UK contractNot listedSiteGround Hosting Ltd (09348602)
BG operating companyNot listedSiteGround Hosting EOOD (UIC 204181297)
US storefrontNot listedSG Hosting Inc. (Delaware)
InfrastructureNot listedGoogle Cloud (customer-chosen region + global CDN)
Control panelNot listedSite Tools (not cPanel)
Open source / self-hostNot listedNo / no
Key capabilities: Scaleway vs SiteGround
Key capabilitiesLogo: ScalewayScalewayLogo: SiteGroundSiteGround
EU-operated regionsYesYes
Bare metal + Elastic MetalYesNot listed
EU GPU for AIYesNot listed
Kapsule KubernetesYesNot listed
ISO 27001 (certified)YesNot listed
HDS (claimed)YesNot listed
Managed WordPress / PHP hostingNot listedYes
Google Cloud regions (not EU-only)Not listedYes
Site Tools control panelNot listedYes
SuperCacherNot listedYes
DPA in TOS packNot listedYes

Scaleway

  • Elastic Metal, Dedibox and Apple Silicon bare metal

    Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.

  • EU-resident GPU instances for AI training and inference

    On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.

  • Kubernetes Kapsule and multi-cloud Kosmos

    Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.

  • Multi-AZ European regions with VPC networking

    Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.

  • Managed storage and databases on open-ish APIs

    S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.

  • API, CLI and Terraform-first operations

    Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.

SiteGround

  • Customer-chosen Google Cloud data center

    You pick a SiteGround location at signup and can relocate later from the Client Area (per site on shared plans, per plan on Cloud). Documented European data-center cities include Madrid, Eemshaven, Frankfurt, Paris, and London. US and APAC locations exist on the same map. The fleet runs on Google Cloud. This is not an EU-only host.

  • SuperCacher (NGINX, Dynamic Cache, Memcached)

    SiteGround's own caching stack: NGINX Direct Delivery for static files, Dynamic Cache in RAM for generated pages, and Memcached for database and API objects. All clients manage it in Site Tools > Speed > Caching. It is a host-level accelerator, not a substitute for application-level cache plugins when you need custom rules.

  • Site Tools instead of cPanel

    The company replaced cPanel with its in-house Site Tools panel for DNS, email, PHP, SSL, Git, backups, and caching. Useful if you want a single vendor UI. Poor fit if your runbooks assume WHM/cPanel, standard cPanel plugin hooks, or reseller WHM.

  • WordPress staging on mid-tier and Cloud plans

    A one-click staging copy, edit, and push-to-live flow is documented for GrowBig, GoGeek, and Cloud. The company says it takes an automatic backup before a staging push. StartUp is not listed as including this tool. Pair with the SiteGround Security plugin if you want the vendor's WP hardening pack.

  • Daily backups with self-serve restore

    Site Tools > Security > Backups lists automatic daily copies: up to 30 on shared plans, up to 7 on Cloud. Restores can be full or files/database only. Academy copy says shared backups are stored in a geographically separate location. Premium Backup is a paid add-on. Destination cloud for those copies is not published as a separate provider list.

  • Server-level WAF and AI anti-bot

    The company describes a custom WAF with rules written by its security team for common CMS exploits, plus an AI anti-bot layer that it says blocks large volumes of brute-force traffic before it hits customer sites. These are vendor-operated controls, not a customer-auditable WAF appliance you can export rules from.

Assurance & compliance: Scaleway vs SiteGround
Assurance & complianceLogo: ScalewayScalewayLogo: SiteGroundSiteGround
Independent security / no-logs audit
Not applicable

IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim.

Not found

No public independent security or no-logs audit PDF found. Vendor describes in-house WAF and AI anti-bot.

ISO 27001
Verified

ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy.

Not found

No current SiteGround ISO 27001 certificate found. 2021 staff comment: not certified; rely on Google Cloud certifications.

SOC 2 / SOC 3
Not found

Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1).

Not found

No SiteGround SOC 2/3 report found. Historical support replies pointed customers at Google Cloud documentation.

HDS (French health data hosting)
Vendor claimed

Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture.

Not listed
CSA STAR Level 1
Vendor claimed

Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ).

Not listed
ANSSI SecNumCloud
Partial

Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed.

Not listed
GDPR / EU data protection
Vendor claimed

EU controller/processor with published privacy policy and DPA; French entity. Not legal advice.

Vendor claimed

EU/UK entities and public DPA in the TOS pack. Controller depends on storefront (Spain SL vs UK Ltd vs US Inc).

US CLOUD Act exposure (indicative)
Partial

French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim.

Partial

European HQ and contracting for EU/UK, no known US parent, but primary infrastructure is Google Cloud (US-group) with optional US regions and a global GCP CDN. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs.

Vendor claimed

DPA is incorporated in the TOS pack for EU/UK storefronts.

EU AI Act
Not applicable

Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim.

Not found

Product includes Coderick AI and AI Studio. No public AI Act classification or compliance statement found. TOS says third-party providers may use Inputs/Outputs to improve models.

Considerations & known limitations: Scaleway vs SiteGround
Considerations & known limitationsLogo: ScalewayScalewayLogo: SiteGroundSiteGround
SecNumCloud not yet obtained
Medium

ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan.

Not listed
Smaller service catalogue than US hyperscalers
Medium

Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate.

Not listed
Account-plane processors and possible non-EU transfers
Low

Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs.

Not listed
Shared responsibility for guest security
Medium

Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes.

Not listed
Dedibox vs Elastic Metal product split
Low

Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort.

Not listed
Google Cloud as primary infrastructureNot listed
Medium

Since 2020 SiteGround has run hosting on Google Cloud. A European region does not remove US-group cloud exposure. Badging this product as EU-only infrastructure would be wrong.

Contracting entity depends on storefrontNot listed
Medium

The same brand signs as Spain S.L., UK Ltd, or Delaware Inc. depending on scid/region. US privacy.htm names SG Hosting Inc. as controller. Procurement must capture the entity on the order, not the brand name.

Vendor can relocate data centersNot listed
Medium

TOS 4.2 allows SiteGround to move accounts between data centers or jurisdictions for quality, continuity, or security. Non-emergency jurisdiction changes have a 10-day objection window. Emergency moves may happen without prior notice.

No public SiteGround ISO/SOC certificateNot listed
Medium

Assurance for many RFPs will be Google Cloud's reports plus SiteGround's DPA and internal WAF, not a SiteGround ISO 27001 or SOC 2 badge.

Third-party AI may retain Inputs and OutputsNot listed
Medium

TOS 4.6.3: third-party AI providers may store and use Inputs and Outputs to provision and improve models. SiteGround advises against putting confidential or personal data in prompts.

No standalone public subprocessor registerNot listed
Low

Google Cloud is named. A dated annex listing backup, email, support, analytics, and payment subprocessors was not found as a standalone page.

Fit

Scaleway

Best fit when

  • Teams that need compute, storage, networking and managed Kubernetes in documented EU multi-AZ regions under a French legal entity
  • AI/ML workloads that require NVIDIA GPUs with European data residency rather than US-region training defaults
  • Workloads that benefit from single-tenant bare metal (Elastic Metal or Dedibox) alongside cloud APIs
  • Healthtech or French-market buyers that need HDS-oriented hosting signals plus a published B2B DPA
  • Platform engineers standardising on Terraform/API-driven provisioning with S3-compatible storage and managed Postgres/MySQL

Poor fit when

  • Organisations that require a finished ANSSI SecNumCloud qualification on day one (process is ongoing, not completed on public pages)
  • Architectures that must run primary production in US or APAC regions on the same cloud account
  • Buyers that need the full hyperscaler catalogue (global edge, proprietary PaaS density, enterprise marketplace breadth)
  • Teams expecting a self-hosted “install Scaleway on your own DC” product rather than a managed cloud
  • Procurement processes that accept only SOC 2 Type II as the primary assurance artefact (not surfaced as a public Trust Center badge here)

Consider instead when

  • When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator

    Consider: OVHcloud

    Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.

  • When: You want simpler EU VPS/dedicated economics with a smaller product surface

    Consider: UpCloud, Exoscale, or Cyso Cloud

    Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.

  • When: You need maximum global managed-service depth and partner ecosystem

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Accept US-parent CLOUD Act exposure and design residency/controls explicitly.

  • When: German SMB hosting plus EU cloud under a DE-centric brand is the priority

    Consider: IONOS

    Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.

SiteGround

Best fit when

  • Agencies and SMBs that want managed WordPress or PHP hosting with 24/7 vendor support and Site Tools instead of raw VMs
  • EU buyers who will contract with SiteGround Spain S.L. and pin production to Madrid, Eemshaven, Frankfurt, or Paris
  • UK buyers who will contract with SiteGround Hosting Ltd and can use the London Google Cloud location
  • Teams that want SuperCacher, daily self-serve restores, and (on GrowBig/GoGeek/Cloud) one-click staging
  • Workloads that already accept Google Cloud as infrastructure and need a managed layer on top

Poor fit when

  • Organisations that ban US-group clouds (AWS/GCP/Azure) regardless of region
  • Buyers who need a public ISO 27001 or SOC 2 certificate in SiteGround's own name
  • Teams whose automation depends on cPanel/WHM rather than Site Tools
  • IaaS, Kubernetes, or root-server use cases better served by IONOS Cloud, OVHcloud, Scaleway, or Hetzner
  • StartUp-plan sites that require staging (documented on GrowBig, GoGeek, and Cloud only)

Consider instead when

  • When: You need EU-owned infrastructure with no Google Cloud or other US-group IaaS underneath

    Consider: IONOS, OVHcloud, Scaleway, or Hetzner

    Those peers are closer to metal or EU public cloud. SiteGround is a managed host on GCP.

  • When: You want a European-origin shared host comparison rather than IaaS

    Consider: Hostinger (catalog incumbent) or Swissnode

    Different panels and footprints. Confirm each operator's contracting entity and hoster.

  • When: You need a current ISO 27001 or SOC 2 report from the hosting brand itself

    Consider: IONOS or another certified EU host after checking their live trust center

    SiteGround staff said in 2021 they were not ISO certified. Relying on GCP certs is not the same as a SiteGround cert.

Open questions for due diligence

Scaleway

  • What is the exact HDS certificate scope (services, regions, shared responsibility) for our architecture?
  • What is the current ANSSI SecNumCloud milestone and target date for the SKUs we would buy?
  • Which named subprocessors (including any non-EU) process account, billing, support or security telemetry data?
  • For multi-region DR, which products are GA in each AZ (including Milan) at contract time?
  • Are independent SOC 2 / C5 or other reports available under NDA if our assurance programme requires them?

SiteGround

  • Which exact legal entity and TOS scid will this order use (Spain S.L., UK Ltd, or US Inc.)?
  • Will SiteGround contractually lock the production region (for example Eemshaven or Madrid) and notify before any jurisdiction change?
  • Can they provide a current subprocessor list covering backups, email, support, analytics, payments, and AI vendors?
  • Is there a current ISO 27001, SOC 2, or other audit letter in SiteGround's name, or only Google Cloud shared-responsibility materials?
  • For AI Studio / Coderick: which model vendors are used, is training on customer Input disabled under a B2B addendum, and is there an AI Act position?