There is no single best European managed Kubernetes. The right choice depends on three things about your team: who operates the cluster at 3 a.m., what your auditors or customers will ask for, and how much engineering time you can trade for a lower bill. Once you know which of the four situations below you are in, the shortlist usually drops to two or three providers.
enum wrote this guide and is one of the options. Where another provider fits better, we say so, and we list enum’s own limits in each section. Provider facts were checked on each provider’s own pages on 2026-10-09; check them again before you sign.
What actually differs between European managed Kubernetes offers
IONOS, OVHcloud, Scaleway, Exoscale and STACKIT are listed in the CNCF Kubernetes conformance program. enum runs upstream Kubernetes and is not listed there. On Hetzner, it depends on the distribution you install. Manifests, Helm charts and GitOps setups that use only upstream APIs move between them. The differences are elsewhere:
- Who operates the control plane, and with what SLA. Several providers have a free tier with no SLA and a paid tier with one.
- Jurisdiction of the company and its group. Security questionnaires ask which company operates the platform and whether any part of its group is American. Check the whole group: Hetzner runs its US locations through Hetzner US LLC, and IONOS Cloud in the US is sold by IONOS Cloud USA Inc. Ask which entity you contract with and whether any group company is a US person.
- Attestations you can hand to an auditor. BSI C5, ISO 27001, HDS and SecNumCloud each cover a defined scope, often not every product.
- Footprint. One region, several regions, or multiple availability zones per region.
- How much you still run yourself. Upgrades, storage, ingress and on-call.
Quick answer: which situation are you in?
| Your situation | What matters most | Options that usually fit | Usually not the right fit |
|---|---|---|---|
| Small SaaS team, no platform engineer | Control plane and upgrades run for you, an SLA, someone who answers | enum, Exoscale SKS Pro, Scaleway Kapsule (dedicated control plane), STACKIT SKE | Self-managed Kubernetes on Hetzner |
| Regulated fintech or health team facing a security review | Provider jurisdiction, attestations already in place, exit path | STACKIT SKE, Exoscale SKS (C5 Type 2 and ISO 27001 today), T Cloud Public CCE (C5 Type 2, no SLA for CCE), Scaleway (HDS for French health data), enum (where jurisdiction is the main question and no provider ISO 27001 or C5 report is required yet) | Free tiers without an SLA |
| Cost-driven team with Kubernetes skills | Price per vCPU, egress, willingness to run things yourself | Hetzner with self-managed Kubernetes, free control planes at IONOS, OVHcloud, Scaleway, Exoscale | enum, if price per vCPU is the only criterion |
| Public-sector or public-sector-adjacent buyer | C5 attestation or SecNumCloud qualification named in the tender, operator jurisdiction | STACKIT SKE, Exoscale, T Cloud Public, OVHcloud, or IONOS where C5 Type 1 is enough, depending on what the tender names; S3NS where SecNumCloud is required for Kubernetes | Providers without the named attestation or qualification, including enum today |
Small SaaS team without a platform engineer
Five to thirty engineers, a product in production, and infrastructure landing on whoever knows Kubernetes best. The risk is not the bill. It is one person becoming the on-call platform team.
What matters: a highly available control plane run by the provider, automatic patch upgrades, storage and load balancers that work with the cluster out of the box, a published SLA, and support that answers technical questions without a ticket ladder. Ask every provider on your list who responds at night, and to what.
Options that fit:
- Exoscale SKS Pro has a highly available control plane and a 99.95% SLA, in all eight Exoscale zones across Germany, Austria, Switzerland, Bulgaria and Croatia, with a Madrid zone announced. The free Starter tier has no SLA, so production teams should budget for Pro.
- Scaleway Kapsule has a free mutualized control plane without an SLA. The dedicated control planes are billed per hour in three sizes, come with a 99.5% SLA, and have a 30-day minimum commitment. Kapsule runs in Paris, Amsterdam, Warsaw and Milan.
- STACKIT SKE has a managed, highly available control plane with automatic Kubernetes and OS updates, for a cluster management fee billed per cluster-hour.
- enum Kubernetes Engine includes a highly available control plane per cluster at no charge, with a 99.9% figure for the control plane API, upstream Kubernetes, and block storage, object storage and load balancers on the same platform in Frankfurt. Nodes start at €0.06 per hour.
What enum does not have today:
- One region and one availability zone (fra-a in Frankfurt). The control plane is spread across failure domains inside that site, not across zones.
- Cluster creation is on request until self-service cluster creation ships in Q4 2026.
- No node autoscaling. You size node pools for your peak.
- Load balancers are L4 only. You run your own ingress or Gateway controller.
- Only general-purpose x86 nodes (AMD EPYC). No Arm, CPU-optimised or memory-optimised types.
- No volume snapshots and no managed databases.
- The 99.9% covers the control plane API, not worker nodes. Credit terms are not published; ask sales for the contract terms.
- IAM roles, cluster audit logs and a Terraform provider are planned for Q4 2026.
- Included support covers working days. If you need someone on call at night, that is Enterprise Support, which covers critical (P1) incidents 24/7, or enum’s DevOps as a Service, not the platform price.
Honest trade-off: a free tier without an SLA moves the risk back onto your one infra person. Compare the paid tiers against each other, not the free ones.
Regulated fintech or health team facing a security review
Your customers’ security teams or your regulator will send a questionnaire: where data is stored, which company operates the platform, which law applies, which attestations exist. DORA and NIS2 cover how you manage the ICT providers you depend on, so the answers have to be checkable.
What matters: provider jurisdiction, attestations that already exist (not ones on a roadmap), the scope of those attestations, isolation between your environments, and a credible exit path.
The EU Data Act and DORA both contain rules on switching and exit from cloud providers. Ask each provider up front for its switching and exit terms, its legal entity identifier (LEI), its parent company and its data locations.
Options that fit:
- STACKIT names its Kubernetes Engine in the scope of its BSI C5 Type 2 attestation, holds ISO 27001 for its ISMS and runs in Germany (EU01) and Austria (EU02). It is part of Schwarz Digits.
- Exoscale holds ISO 27001 and a BSI C5:2020 Type 2 attestation, and states that all its zones and products are covered. It is part of the A1 Digital group.
- T Cloud Public (formerly Open Telekom Cloud, run by T-Systems International GmbH) offers Cloud Container Engine (CCE) and holds BSI C5 Type 2 and ISO 27001. It states that it has no US parent or US subsidiary. Two caveats: its service description (section 4.2) gives an availability SLA only for compute, object storage and block storage, so CCE has none, and its parent Deutsche Telekom holds 52.8% of T-Mobile US.
- Scaleway holds ISO 27001:2022 and HDS certification, which matters for health data in France. Its SecNumCloud qualification is still under assessment.
- IONOS received a BSI C5:2020 Type 1 attestation in May 2026 covering 33 services, but it does not publish which ones, so ask IONOS whether Managed Kubernetes is in scope. Type 1 assesses the design of controls at one point in time. Type 2 also tests that controls operated effectively over an audit period, so a requirement for Type 2 excludes IONOS today. Managed Kubernetes is named in its ISO 27001 certificate based on IT-Grundschutz.
- enum is a German company (enum GmbH, Cologne) with no US parent and no US company in its structure. Data stays in a Tier III+ data centre in Frankfurt. Every cluster has its own isolated control plane, and a DPA is available.
What enum does not have today: its own ISO 27001 certification is in progress with a Q4 2026 target, and BSI C5 is on the roadmap for 2027. The facility’s ISO 27001 and EN 50600 certifications belong to the facility operator, not to enum. enum does not publish a sub-processor list, offers no customer-managed keys or KMS, and has no customer audit log yet (planned for Q4 2026). Worker nodes are VMs on servers shared with other customers; only the control plane is per cluster, and there is no single-tenant or dedicated-host option. It was founded in November 2024 and is a small team. Ask for its sub-processors and its continuity and exit terms as part of your review.
Honest trade-off: if your questionnaire requires a C5 attestation or an ISO 27001 certificate from the cloud provider today, enum does not have one yet, and STACKIT, Exoscale or T Cloud Public is the safer pick for now. Hetzner holds a BSI C5:2020 Type 2 attestation, and its published summary lists Cloud Server, Block Storage, Load Balancer and Object Storage in scope. It has no managed Kubernetes, so the control plane and its documentation stay with you. If the deciding question is the provider’s group structure, note that the US CLOUD Act applies to providers subject to US jurisdiction, wherever the data is stored. AWS now runs a separate European Sovereign Cloud with EKS in Brandenburg, Germany. Whether that satisfies your reviewers depends on how they weigh a US parent company; ask them before you plan around it.
enum’s fintech page and the NIS2 and DORA page list what enum covers on the provider side and what stays with you. The medtech page covers data location and certifications for health workloads.
This guide is general information, not legal advice. Have your counsel assess your specific situation.
Cost-driven team with Kubernetes skills
Some teams can run Kubernetes and would rather spend engineering time than money. That is a legitimate choice.
What matters: price per vCPU and per GB, egress pricing, and how much operational work you accept: control plane, etcd backups, upgrades, CSI and ingress.
Options that fit:
- Hetzner has no first-party managed Kubernetes. Teams run k3s, Talos or Cluster API on Hetzner Cloud servers themselves, or add a third-party control plane. Hetzner Cloud runs in Germany and Finland, with further locations in the USA and Singapore. You pay for infrastructure only (servers, load balancers, volumes, IPv4 addresses and traffic above the included allowance) and run the control plane yourself.
- Free control planes at IONOS (HA, with a 99.95% SLA) and free tiers at OVHcloud, Scaleway and Exoscale mean you pay for nodes, volumes and load balancers but not the control plane. OVHcloud’s free plan has a 99.5% SLO. Its Standard plan is billed per cluster-hour and has a 99.99% SLA in three-zone regions and 99.9% in single-zone regions.
Egress differs widely. OVHcloud states that traffic to the internet is free for its managed Kubernetes in EU regions. Hetzner Cloud includes a traffic allowance with its servers and charges €1 per TB above it in the EU (Hetzner Cloud). IONOS includes 2 TB a month per contract, then charges from €0.03 per GB (IONOS prices). Exoscale charges €0.02 per GiB beyond a pooled allowance (Exoscale pricing). enum charges €0.025 per GB from the first GB.
Honest trade-off: enum is not the right choice for a price-first team. Per vCPU, enum’s nodes cost more than Hetzner Cloud servers or IONOS vCPU servers, and enum has no free egress allowance. Raw servers cost less per CPU than a platform that includes an operated control plane, NAT, 100 GB of disk per node and support. enum makes sense once the engineering hours spent on upgrades, certificates and on-call cost more than the difference. The Hetzner comparison shows who runs what, and the calculator gives the enum price for your setup to set against your server bill plus the hours your team spends on the platform.
Public-sector or public-sector-adjacent buyer
A public authority usually buys through a tender that names required attestations. A company selling software to authorities has more freedom, but its customers still ask where data sits and who operates the platform.
What matters: the attestation or qualification named in the tender (a BSI C5 attestation in Germany, SecNumCloud qualification in France), operator jurisdiction, open standards and the ability to move.
Options that fit:
- STACKIT for a German tender that names C5, since its Kubernetes Engine is in its C5 Type 2 scope.
- T Cloud Public where C5 Type 2 is required and the tender does not ask for an availability SLA on the Kubernetes service itself.
- OVHcloud states that it meets the C5 catalogue and offers SecNumCloud-qualified products. Its C5 page does not list which services are in scope, so ask for the report. Its SecNumCloud-qualified public cloud, SNC Cloud Platform, covers virtual machines, block and object storage, private networking and access management; containers are planned, not qualified.
- S3NS where SecNumCloud is required for managed Kubernetes itself. In the ANSSI catalogue updated on 15 September 2026, its “Cloud de confiance S3NS” is the only service qualified for CaaS. S3NS is an alliance of Thales and Google Cloud and runs Google Cloud technology. Cloud Temple’s OpenShift is qualified as PaaS. Qualifications name a service and expire, so check the catalogue.
- Exoscale where C5 is required and a Swiss or Austrian location is useful.
- IONOS only where a C5 Type 1 attestation is enough.
- enum for software companies that sell to government and want upstream Kubernetes from a German provider without a US parent. enum is not a fit yet where the tender requires C5, which is on the roadmap for 2027, or where the buying process is a long formal procurement.
European managed Kubernetes providers compared
| Provider | Company | Managed control plane | Control plane price | Published SLA | Locations | Attestations listed by the provider |
|---|---|---|---|---|---|---|
| enum | enum GmbH, Germany, no US parent or subsidiary | Yes, HA, one per cluster | Included | 99.9% control plane API (contract terms on request) | Frankfurt, one zone | ISO 27001 in progress (Q4 2026 target), BSI C5 on roadmap (2027) |
| IONOS | IONOS Cloud GmbH, Germany | Yes, HA and geo-redundant | Free | 99.95% Kubernetes API | Frankfurt; also Newark, Las Vegas, Lenexa (USA) | BSI C5 Type 1 (33 services, list on request), ISO 27001 on IT-Grundschutz basis incl. Managed Kubernetes |
| OVHcloud | OVHcloud, France | Yes | Free plan, or Standard billed per cluster-hour | 99.5% SLO free, up to 99.99% Standard (3 zones) | Free: Gravelines, Strasbourg, Frankfurt, London, Warsaw. Standard: Roubaix, Paris (3 zones), Milan (3 zones). Also Canada, US and Asia-Pacific | C5 (scope not listed per product), SecNumCloud for selected products |
| Scaleway | Scaleway, France | Yes | Free mutualized, dedicated billed per hour by size, 30-day minimum | None on free, 99.5% on dedicated | Paris, Amsterdam, Warsaw, Milan | ISO 27001:2022, HDS, SecNumCloud under assessment |
| Exoscale | Part of A1 Digital | Yes | Starter free, Pro billed per cluster-hour | None on Starter, 99.95% on Pro | 8 zones in DE, AT, CH, BG, HR; Madrid announced | ISO 27001, BSI C5 Type 2 (all zones and products) |
| STACKIT | Schwarz Digits, Germany | Yes, HA | Billed per cluster-hour | 99.9% Kubernetes API server | Germany (EU01), Austria (EU02) | BSI C5 Type 2 (SKE in scope), ISO 27001 |
| T Cloud Public | T-Systems International GmbH, Germany (Deutsche Telekom, which holds 52.8% of T-Mobile US) | Yes (CCE), HA flavours available | Smallest non-HA cluster free, other flavours billed per cluster-hour | None for CCE | Germany, Netherlands | BSI C5 Type 2, ISO 27001 |
| Hetzner | Hetzner, Germany | No first-party offer | Not applicable | Not applicable | Germany, Finland, USA, Singapore | BSI C5:2020 Type 2 (Cloud Server, Block Storage, Load Balancer, Object Storage in scope) |
Checked October 2026.
Paid control planes at Exoscale, OVHcloud, STACKIT and Scaleway cost roughly €40 to €80 a month per cluster: Exoscale Pro €0.055 per hour, OVHcloud Standard €0.09 per hour, STACKIT €0.0996 per hour and Scaleway Dedicated from €0.11 per hour with a 30-day minimum. T Cloud Public costs more: its HA CCE flavours start at €0.380181 per hour in EU-DE (about €277 a month), and even the non-HA cce.s1.medium costs €0.133395 per hour. Scaleway Mutualized runs a single control plane replica, Exoscale Starter and T Cloud Public’s free cce.s1.small have no HA, and OVHcloud’s Free plan is highly available only within one zone. Exoscale deletes inactive Starter clusters without node pools after 30 days. Check each provider’s pricing page for current prices: enum, IONOS, OVHcloud, Scaleway, Exoscale, STACKIT price list (PDF), T Cloud Public service description (PDF), Hetzner.
FAQ
Is there a European managed Kubernetes with a free control plane? Yes. IONOS, OVHcloud, Scaleway and Exoscale have free control plane tiers, T Cloud Public’s smallest non-HA cluster is free, and enum includes its highly available control plane at no charge. At OVHcloud, Scaleway and Exoscale the free tier has a lower SLO or no SLA, and T Cloud Public has no SLA for CCE; check the tier before running production on it.
Which European managed Kubernetes providers list BSI C5? STACKIT names its Kubernetes Engine in its C5 Type 2 scope, and Exoscale states that its C5 Type 2 attestation covers all its products. T Cloud Public holds C5 Type 2, but CCE has no availability SLA. IONOS holds a C5 Type 1 attestation for 33 services without publishing the list, and OVHcloud holds C5 without naming managed Kubernetes in the published scope. Hetzner holds a C5 Type 2 attestation covering its cloud infrastructure, but has no managed Kubernetes. enum has C5 on its roadmap for 2027.
Does Hetzner offer managed Kubernetes? No. Hetzner provides servers, networking, load balancers and storage. You run the Kubernetes control plane yourself or use a third-party control plane on top.
Is an EU region of AWS, Azure or Google Cloud enough for sovereignty? It keeps data in the EU. EU customers usually contract with a European subsidiary, but the provider is owned by a US parent. Whether that is acceptable is a decision for your security reviewers. With a European provider, still ask whether it has US subsidiaries or US sub-processors in the data path. Partner-operated variants such as S3NS change the operator but not the technology supplier.
If you are a product team that wants the control plane, upgrades and storage run for you in Frankfurt by a German company, the enum Kubernetes Engine page has the details and current prices, and the migration page explains how a move from EKS, GKE, AKS or a self-managed cluster works.