← Back to Directory
Logo: STACKIT

STACKIT

German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.

cloudinfrastructureprivacykubernetessovereign-cloudiaaspaas
Visit WebsiteAsk an EU migration specialistFeedback & corrections

STACKIT is the public cloud and colocation brand of Schwarz Digits Cloud GmbH & Co. KG, the cloud unit inside Schwarz Digits, the IT division of Germany's Schwarz Group (Lidl and Kaufland). The platform was built from 2018 for the group's own retail-scale workloads and opened to external customers in 2022.

It exists as a German sovereign cloud for organisations that want IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.

The concrete differentiator is that Schwarz Group operational heritage plus a managed stack (Compute Engine, SKE Kubernetes, Flex databases, confidential computing options) aimed at public-sector and regulated German buyers.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

Key capabilities

Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.

Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.

Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.

Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.

Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.

S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

At a glance

HQ / legal entity
Bad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KG
Parent
Schwarz Digits (Schwarz Group — Lidl/Kaufland)
Hosting
Group-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure reseller
Model
Consumption-based public cloud + quote-based colocation
Open source
Uses open-source components; platform itself is managed, not self-hosted
External market
Public offering from 2022 (internal roots from 2018)

Best fit when

  • Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
  • Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
  • Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
  • Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
  • Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

  • Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
  • Teams that must self-host the full cloud control plane rather than consume a managed public cloud
  • Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
  • Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
  • Use cases requiring non-European data residency as a primary requirement

Consider instead when

  • When: You need a wider multi-country European region map and a large independent cloud portfolio

    Consider: OVHcloud or Scaleway

    Different ownership and product cultures; still not US hyperscaler breadth

  • When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth

    Consider: IONOS (or similar DE hosts)

    Often simpler packaging for commodity compute

  • When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs

    Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform

    Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis

  • When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale

    Consider: Exoscale

    Smaller portfolio; different jurisdiction story

Jurisdiction & ownership

Legal entity
Schwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)
Governing law
Germany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)
US parent / control
No known US parent
CLOUD Act exposure (indicative)
Low
Hosting / residency
Vendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.

No known US corporate parent; ownership is Schwarz Digits / Schwarz Group (German retail). CLOUD Act exposure scored low based on EU entity + claimed own-EU infrastructure without named US-group cloud hosts. This is indicative only, not legal advice—validate subprocessors, support access, and optional marketplace components.

  • Independent security attestation (BSI C5 / audits)Vendor claimed
  • ISO 27001Vendor claimed
  • SOC 2 / SOC 3 (ISAE 3000)Vendor claimed
  • BSI C5 Type 2Vendor claimed
  • +5

Considerations & known limitations

  • MediumNarrower service map than US hyperscalers

    STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.

  • MediumC5 Type 2 is product-scoped

    Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.

  • LowLimited public subprocessor inventory

    Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.

  • LowRetail-group operator concentration

    Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.

Open questions for due diligence

  • Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
  • Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
  • What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
  • What are exit, data export, and termination assistance terms for large object stores and managed databases?
  • For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?
Request vendor DPA / enterprise contact
Ask an EU migration specialist
Visit WebsiteCompare similar toolsView alternativesFeedback & corrections

Frequently Asked Questions

STACKIT states that the cloud is hosted in group-owned data centers in Germany and Austria and that services are operated in its own facilities (not as a thin layer on AWS/Azure/GCP). Public materials highlight Neckarsulm (DC01), Ellhofen (DC08), and Ostermiething (DC10); docs and product releases refer to regions such as EU01 (Germany) and EU02 (Austria). The homepage also claims additional European data centers in operation or under construction—confirm the exact region list and residency controls for your project in the portal and contract.

On the certificates page, STACKIT claims ISO/IEC 27001 (with ISO 27017/27018), ISO 20000, ISO 50001, BSI C5 Type 2, ISAE 3000 (SOC 2), ISAE 3402, and TISAX Level 3 (ENX portal). C5 Type 2 is product-scoped—listed items include Compute Engine (incl. GPU), Windows/RHEL images, server backup/update management, block/object/backup/file storage, and archiving. Managed Kubernetes, databases, and other PaaS items may sit outside that table—request the current attestation scope and audit reports (contacts such as iso@digits.schwarz are published for certificate requests).

STACKIT is a managed public cloud and colocation service, not a product you install on your own hardware. Marketing emphasizes open-source building blocks and open standards to reduce lock-in, and docs expose APIs, CLI, and Terraform—but the control plane and data centers remain operator-run. If you need full self-host of the platform itself, evaluate open-source stacks (e.g. upstream Kubernetes + Ceph) or other EU providers’ dedicated/private offers instead.

Core IaaS/PaaS is consumption-based through the STACKIT Cloud Portal after creating a user, customer account, and project (MFA is part of the getting-started path). Enterprise packaging, colocation, and large migrations are sales-assisted. EuropeanStack does not publish euro unit rates—use the official STACKIT calculator and contract exhibits. Ask early for DPA/AVV, SLA, exit/export terms, and support language/hours.

Prefer OVHcloud or Scaleway when you need a wider multi-country European region map or different open-source/product cultures. Prefer IONOS (or similar DE hosts) when the workload is mainly simple VMs/web hosting without STACKIT’s full PaaS and colocation story. Prefer STACKIT when Schwarz Group ownership, DE/AT dual regions on group-owned sites, BSI C5 Type 2 on core IaaS, managed SKE, and hybrid colocation in the same campus are the decision drivers. Still run a PoC—portfolio gaps vs hyperscalers apply to all European mid-market clouds.

Yes, in both directions. Stability: STACKIT stresses independence from external investors and long-running retail IT operations (KRITIS-oriented internal use for Lidl/Kaufland). Concentration: you are buying from the IT arm of a large private retail group, not a public cloud pure-play—review contractual exit, roadmap transparency, and how sibling brands (security, AI, workspace) are optional vs required. Ownership is German (Schwarz Digits / Schwarz Group); there is no known U.S. parent of the cloud entity.