STACKIT vs TransIP

Compare STACKIT and TransIP on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Google Cloud Platform, Microsoft Azure

Logo: STACKIT

STACKIT

Germany· Cloud Computing

Needs review

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid
View listingVisit Website
Logo: TransIP

TransIP

Netherlands· Cloud Computing

Needs review

Shortlist TransIP when you want a Dutch BV contract for domains plus NL-hosted VPS, managed Kubernetes, OpenStack, or S3/SWIFT object storage. Skip when you need hyperscaler global regions or first-party managed databases; consider Hetzner, OVHcloud, or Scaleway instead.

EU-operated (NL BV)Netherlands residency (claimed)KVM VPS + APIManaged KubernetesOpenStack public cloudISO 27001 (claimed)
View listingVisit Website

Highlighted rows differ between the two products.

STACKIT vs TransIP: Snapshot
FeatureLogo: STACKITSTACKITLogo: TransIPTransIP
Country of originGermanyNetherlands
CategoryCloud ComputingCloud Computing
Open sourceNoNo
Self-hostedNoNo
HeadquartersGermanyNetherlands
Legal entitySchwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)TransIP B.V., Vondellaan 47, 2332 AA Leiden (KvK 24345899, VAT NL812334966B01). ISO certificates published as team.blue NL B.V. Part of European team.blue group (Belgian group HQ).
Governing lawGermany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)Not listed
US parent / controlNo known US parentNo known US parent
CLOUD Act exposure (indicative)LowMedium
EU-hosted statusNot listedPartial
Hosting / residencyVendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.Primary VPS/Kubernetes/object workloads marketed on TransIP-operated Netherlands infrastructure (AMS0/RTM0; object store 3x NL replication). OpenStack across multiple NL datacentres; KB also names Equinix AMS3 and EUNetworks as OpenStack facility providers. Ancillary: Google Analytics and reCAPTCHA (website, consent), PayPal/iDEAL/card payments. No AWS/GCP/Azure listed as primary IaaS fabric.
Summary

German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.

Dutch domain registrar and cloud host: KVM VPS, managed Kubernetes, OpenStack public cloud, and S3/SWIFT object storage on Netherlands infrastructure.

Tags
kubernetescloudinfrastructureprivacysovereign-cloudiaaspaas
kubernetesvpsopenstackobject-storagedomainsnetherlandsgdpriso-27001
At a glance: STACKIT vs TransIP
At a glanceLogo: STACKITSTACKITLogo: TransIPTransIP
HQ / legal entityBad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KGNot listed
ParentSchwarz Digits (Schwarz Group — Lidl/Kaufland)Not listed
HostingGroup-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure resellerNot listed
ModelConsumption-based public cloud + quote-based colocationNot listed
Open sourceUses open-source components; platform itself is managed, not self-hostedNot listed
External marketPublic offering from 2022 (internal roots from 2018)Not listed
HQNot listedLeiden, Netherlands
Legal entityNot listedTransIP B.V. (KvK 24345899); certs under team.blue NL B.V.
GroupNot listedteam.blue (European hosting group, Belgian group HQ)
Primary regionsNot listedNetherlands (AMS0, RTM0; OpenStack multi-DC)
Commercial modelNot listedVPS packages + add-ons; pay-as-you-go Kubernetes/OpenStack/object storage
RegionsNot listedNetherlands: AMS0 (Amsterdam), RTM0 (Alblasserdam); OpenStack across multiple NL DCs (incl. Equinix AMS3 / EUNetworks named for some paths)
Compliance certs in regionNot listedISO 27001:2022, ISO 9001:2015, NEN 7510:2017 (vendor PDF certificates)
Key capabilities: STACKIT vs TransIP
Key capabilitiesLogo: STACKITSTACKITLogo: TransIPTransIP
EU-operatedYesYes
German legal entityYesNot listed
Group-owned DE/AT DCsYesNot listed
BSI C5 Type 2 (claimed)YesNot listed
Managed Kubernetes (SKE)YesNot listed
EU colocation + hybridYesNot listed
Netherlands residency (claimed)Not listedYes
KVM VPS + APINot listedYes
Managed KubernetesNot listedYes
OpenStack public cloudNot listedYes
ISO 27001 (claimed)Not listedYes

STACKIT

  • Compute Engine VMs and GPUs in group-owned EU regions

    Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.

  • STACKIT Kubernetes Engine (SKE)

    Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.

  • Managed databases, messaging, and observability

    Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.

  • Confidential computing and key/secrets control

    Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.

  • EU colocation with hybrid path to public cloud

    Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.

  • Object, block, file, backup, and archiving storage

    S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

TransIP

  • KVM VPS on AMS0/RTM0 with NVMe triple copies

    Root VPS on TransIP's KVM platform with package tiers, optional dedicated vCPU and IOPS add-ons, private networking, HA-IP, and load balancers. Storage is described as distributed NVMe with three copies; free in-zone backups every four hours, with optional weekly and offsite backups.

  • Managed Kubernetes with free control plane

    Control-panel Kubernetes where TransIP runs the control plane; customers add shared or dedicated worker node pools, attach NVMe or Big Storage volumes, and use HA-IP load balancing. Data is marketed as stored in the Netherlands with minute-based pay-as-you-go nodes.

  • OpenStack Public Cloud (API + Horizon)

    Programmable OpenStack with Octavia load balancing, Barbican secret management, Cinder volume backups, and Terraform-friendly automation. First project is offered with a free trial window; infrastructure is described as multi-datacentre with triple rack-level copies.

  • S3 and SWIFT Object Store in the Netherlands

    Object storage with S3 and OpenStack SWIFT APIs, Keystone/S3 token management, and triple replication across Dutch availability zones. Usable standalone or beside VPS/OpenStack; billed on used storage and egress rather than reserved blocks.

  • Domains, DNS, and REST API in one panel

    Domain registration and DNS alongside infrastructure, with a documented REST API (api.transip.nl) for domains, VPS, Kubernetes, and OpenStack projects. Fits teams that want registrar plus compute under one Dutch operator.

Assurance & compliance: STACKIT vs TransIP
Assurance & complianceLogo: STACKITSTACKITLogo: TransIPTransIP
Independent security attestation (BSI C5 / audits)
Vendor claimed

Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit.

Not applicable

IaaS/hosting provider, not a no-logs VPN. Assurance is via ISMS certifications and responsible disclosure (Intigriti), not a public no-logs audit.

ISO 27001
Vendor claimed

Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components.

Vendor claimed

Vendor publishes ISO 27001:2022 PDF (team-blue-nl-bv naming). Independent registry re-check not completed in this draft.

SOC 2 / SOC 3 (ISAE 3000)
Vendor claimed

Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request.

Not found

No clear TransIP product-level SOC 2/3 claim found on primary legal/security pages reviewed.

BSI C5 Type 2
Vendor claimed

C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product.

Not listed
GDPR / EU data protection
Vendor claimed

EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud.

Vendor claimed

Dutch controller/processor entity; privacy policy and control-panel DPA. Residency depends on selected product/zone.

US CLOUD Act exposure (indicative)
Partial

German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice.

Partial

EuropeanStack assessment: Dutch entity / no known US parent / NL-first hosting, but privacy names Google Analytics, reCAPTCHA, and PayPal, and OpenStack KB names Equinix colo. Not a vendor safety claim. Not legal advice.

Data processing agreement (B2B)
Not found

No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement.

Vendor claimed

Processor agreement available to view/accept in the control panel per knowledge base.

TISAX Level 3
Vendor claimed

Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page).

Not listed
EU AI Act
Not applicable

Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems.

Not applicable

Infrastructure hosting/registrar; not marketed as an AI system provider. Optional third-party AI assistant images on VPS are customer-chosen workloads.

NEN 7510 (Dutch healthcare information security)Not listed
Vendor claimed

Vendor publishes NEN 7510:2017 certificate PDF; accounts processing medical data can be marked for extra handling per cert page.

Considerations & known limitations: STACKIT vs TransIP
Considerations & known limitationsLogo: STACKITSTACKITLogo: TransIPTransIP
Narrower service map than US hyperscalers
Medium

STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.

Not listed
C5 Type 2 is product-scoped
Medium

Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.

Not listed
Limited public subprocessor inventory
Low

Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.

Not listed
Retail-group operator concentration
Low

Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.

Not listed
team.blue group entity complexityNot listed
Low

Brand is TransIP B.V.; certificates use team.blue NL B.V. Procurement should map the exact contracting entity, DPA signatory, and cert scope to the services purchased.

US SaaS on website/payments pathNot listed
Medium

Privacy policy discloses Google Analytics, reCAPTCHA, and PayPal. These are not described as the VPS storage backend, but they affect overall vendor diligence and CLOUD Act style questionnaires.

Equinix-named OpenStack facilitiesNot listed
Low

OpenStack facility list includes Equinix AMS3 (US-parent colo operator). Workloads remain in Amsterdam physically; treat as partial EU-hosted diligence, not AWS-region hosting.

Narrower managed-platform depth than hyperscalersNot listed
Medium

No broad multi-continent region map or hyperscaler-class managed database suite on the pages reviewed. Teams needing those should plan self-managed stacks or another cloud.

No standalone public subprocessor register foundNot listed
Medium

Diligence relies on privacy policy, product pages, and DPA rather than a dedicated exhaustive subprocessor HTML table. Request an up-to-date schedule under NDA if required.

Fit

STACKIT

Best fit when

  • Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
  • Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
  • Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
  • Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
  • Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

  • Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
  • Teams that must self-host the full cloud control plane rather than consume a managed public cloud
  • Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
  • Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
  • Use cases requiring non-European data residency as a primary requirement

Consider instead when

  • When: You need a wider multi-country European region map and a large independent cloud portfolio

    Consider: OVHcloud or Scaleway

    Different ownership and product cultures; still not US hyperscaler breadth

  • When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth

    Consider: IONOS (or similar DE hosts)

    Often simpler packaging for commodity compute

  • When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis

  • When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale

    Consider: Exoscale

    Smaller portfolio; different jurisdiction story

TransIP

Best fit when

  • Teams that need domains, DNS, and root VPS under one Dutch operator
  • Workloads that must stay in the Netherlands with AMS0/RTM0 style zone choice
  • Builders who want managed Kubernetes without running their own control plane
  • OpenStack users who want Horizon/API automation and EU-stored projects
  • Backup/media pipelines that need S3 or SWIFT endpoints with Dutch triple replication

Poor fit when

  • Architectures that require many non-EU regions as first-class products
  • Buyers who need a broad first-party managed database catalogue
  • Procurement that requires a published exhaustive customer-workload subprocessor register before scoring
  • Teams seeking a fully open-source TransIP control plane (the company operates OpenStack/K8s but is not an OSS vendor)

Consider instead when

  • When: You need large bare-metal choice and owned DE/FI parks with optional extra-EU cloud

    Consider: Hetzner

    Deeper server auction and multi-park footprint; different registrar story.

  • When: You need multi-country EU cloud plus SecNumCloud-style private cloud paths

    Consider: OVHcloud

    Broader region map and product depth; French group contracting.

  • When: You want more EU region pins or managed data services with selectable residency

    Consider: Scaleway or UpCloud

    Compare region lists and managed DB/Kubernetes packaging directly.

  • When: You specifically want another Dutch IaaS peer for side-by-side diligence

    Consider: Leaseweb or Cyso Cloud

    Similar NL diligence questions; different panel and product mix.

Open questions for due diligence

STACKIT

  • Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
  • Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
  • What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
  • What are exit, data export, and termination assistance terms for large object stores and managed databases?
  • For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?

TransIP

  • Which legal entity signs the order form and DPA for your SKU mix (TransIP B.V. vs team.blue NL B.V.)?
  • Can TransIP provide a current customer-workload subprocessor list covering backups, support tooling, and OpenStack facility operators?
  • What is the exact ISO/NEN certificate scope relative to VPS vs Kubernetes vs OpenStack vs Object Store?
  • Are offsite VPS backups always confined to Dutch availability zones under contract, including disaster scenarios?