European managed Kubernetes providers compared on sovereignty

Many European companies run a managed Kubernetes control plane for you. This guide compares seven that buyers often shortlist: OVHcloud, IONOS, STACKIT, Scaleway, Exoscale, T Cloud Public (formerly Open Telekom Cloud) and enum. Hetzner, often named in the same breath, has no first-party managed Kubernetes and is in the table for that reason. Others worth checking are listed below the table. Which of them counts as “sovereign” depends on seven things you can check yourself: who the legal entity is, whether any part of the group has ties to the US, where the control plane runs, which certifications are held today, which regions exist, who the sub-processors are, and what the control plane costs.

This guide lists those seven checks, then scores each provider against them in one table. Every competitor fact links to a primary source (the provider’s own page, its attestation, or a public filing) and was checked on 2026-10-09. We will update the table in place when something changes.

Disclosure: enum is one of the providers in the table. We wrote it to be fair, including where enum is behind.

What makes a managed Kubernetes provider sovereign?

“Sovereign” is used loosely. For a buyer, it comes down to who can be forced to hand over your data and where it physically sits. Seven checks cover it.

Legal entity and parent jurisdiction. Which company signs your contract, and where is its ultimate parent?
US ties in the group. The US CLOUD Act lets US authorities require providers subject to US jurisdiction to disclose data in their possession, custody or control, wherever it is stored. For a European provider, check what sits in the group: a US subsidiary, a US-listed parent, or neither.
Where the control plane runs. The control plane holds your Secrets, the key that signs service account tokens, and the full state of your cluster in etcd. Confirm it runs in the same European region as your workers, operated by the same European entity.
Certifications held, not planned. BSI C5, ISO 27001, SecNumCloud and HDS mean something only once the audit is done. Separate “held” from “in progress”, and check the scope: a certificate for a provider’s compute product does not automatically cover its Kubernetes product.
Regions. How many European regions, and do they have multiple availability zones? More regions make cross-region disaster recovery possible inside one provider.
Sub-processors and operations staff. Ask for the sub-processor list and where admin and support staff work. A US sub-processor raises the same US-ties question for the data it holds, whatever the provider’s own ownership.
Control plane pricing and SLA. Free control planes often come without a high-availability setup or an SLA. The paid tier is usually the one you would run production on.

European managed Kubernetes providers compared

“Held” means the provider lists the certification as achieved on its own pages or publishes the attestation. Where the provider does not name the Kubernetes product in the certificate scope, we say so. The US column applies one standard to every row: a US entity, US locations, or a parent with US operations or a US listing.

Provider and product	Legal entity and parent	US ties in the group	Control plane location (Europe)	Certifications held	In progress	Control plane price and SLA
enum Kubernetes Engine	enum GmbH, Cologne, Germany. No US parent.	None. No US parent and no US company in the structure.	Frankfurt, Germany, one zone (fra-a). HA across failure domains in one data center. No second region running; Berlin is offered on request.	None of its own yet. The Frankfurt facility holds ISO 27001 and EN 50600 (the operator’s certificates, not enum’s).	ISO 27001 (target Q4 2026), BSI C5 (target 2027)	HA control plane per cluster included. 99.9% SLA on the control plane API; contract terms, including any credits, are available from sales and not published.
IONOS Managed Kubernetes	IONOS Cloud GmbH, Germany (IONOS Group)	Yes. IONOS Cloud USA Inc. sells IONOS Cloud in the US; Managed Kubernetes also runs in Newark, Las Vegas and Lenexa.	Frankfurt (`de/fra`)	BSI C5:2020 Type 1 (May 2026, 33 services in scope, list on request); ISO 27001 on IT-Grundschutz basis names Managed Kubernetes	Not stated	Free, HA and geo-redundant. SLA: 99.95% for the Kubernetes API (IONOS Cloud SLA).
OVHcloud Managed Kubernetes Service	OVH Groupe, France	Yes. OVH US LLC, a separate entity, serves US regions. Its CLOUD Act FAQ says requests “could include data stored outside of the United States”.	Standard plan (with SLA): Roubaix, Paris (3 AZ), Milan (3 AZ). Free plan only: Gravelines, Strasbourg, Frankfurt, Warsaw, London.	ISO 27001/27017/27018 with Managed Kubernetes Service named in scope; SOC 1-3; BSI C5 (scope only in the report); HDS. Its SecNumCloud-qualified platform lists containers as planned.	Not stated	Free plan: 99.5% SLO, single zone. Standard: billed per cluster-hour, 99.99% SLA in 3-AZ regions, 99.9% in 1-AZ regions.
STACKIT Kubernetes Engine	Schwarz Digits Cloud GmbH & Co. KG, Germany (Schwarz Group)	No STACKIT US entity or region found. The Schwarz Group lists North America among its locations.	EU01 (Germany) and EU02 (Austria), at least three AZs each	BSI C5 Type 2 with SKE named in scope; ISO 27001 (company ISMS)	Not stated	Billed per cluster-hour. SLA: 99.9% for the Kubernetes API server (SKE docs).
Scaleway Kubernetes Kapsule	Scaleway, France (iliad group)	Not stated.	Paris (3 AZ), Amsterdam (3 AZ), Warsaw (3 AZ), Milan (1 AZ)	ISO 27001:2022, HDS	SecNumCloud qualification	Mutualized: free, no SLA. Dedicated: billed per hour, priced by control plane size, 99.5% SLA.
Exoscale SKS	Akenes SA, Switzerland, member of A1 Digital (A1 Group, Austria). A1 Group’s majority shareholder is América Móvil, Mexico (61.0%, Q1 2026).	No Exoscale US entity found. Indirect: América Móvil is NYSE-listed, files a Form 20-F with the SEC and operates in Puerto Rico.	SKS is available in all 8 zones: Frankfurt, Munich, Vienna (2), Geneva, Zurich, Sofia, Zagreb. A Madrid zone is announced.	BSI C5:2020 Type 2 (Exoscale states all zones and products are in scope), ISO 27001	Not stated	Starter: free, no SLA, no HA. Pro: HA, 99.95% SLA, billed per cluster-hour.
T Cloud Public Cloud Container Engine	T-Systems International GmbH, Germany (Deutsche Telekom)	Indirect. T-Systems states it has no US parent or US subsidiary; its parent Deutsche Telekom holds 52.8% of T-Mobile US.	Germany (Magdeburg, Biere), Netherlands	BSI C5 Type 2, ISO 27001/27017/27018, SOC 1-3 Type 2, TISAX	ISO 27001 on IT-Grundschutz basis applied for	Smallest non-HA cluster free. The medium non-HA cluster and all HA clusters are billed per hour, with different rates for EU-DE and EU-NL. No SLA for CCE: the service description’s 99.95% covers only compute, object storage and block storage.
Hetzner	Hetzner Online GmbH, Germany	Yes. Hetzner US LLC, a subsidiary, runs the Hillsboro and Ashburn cloud locations; Hetzner Online GmbH stays the contracting party.	No managed control plane. You run Kubernetes yourself on Hetzner servers.	BSI C5:2020 Type 2 (report dated 17 November 2025). The published summary lists cloud servers with block storage and load balancers, dedicated and managed servers, storage including Object Storage, web hosting and colocation. ISO/IEC 27001:2022.	Not applicable	Not applicable

Checked October 2026. Price models only; check each provider’s pricing page for current prices. Links are under Sources.

Other European providers worth checking

The table is a selection. These companies also run managed Kubernetes in Europe, and several hold certifications enum does not have yet:

plusserver (Germany): PSKE, with a highly available control plane by default. BSI C5 Type 2 for its pluscloud open and pluscloud VMware clouds (2025 report).
gridscale (Germany, owned by OVHcloud since 2023): managed Kubernetes and a BSI C5 Type 2 report for 2025.
noris network (Germany): Gardener-based Kubernetes in noris Sovereign Cloud. Its C5 Type 2 attestation covers noris Enterprise Cloud, not the Sovereign Cloud.
SysEleven (Germany, a subsidiary of secunet Security Networks AG): MetaKube under the secunet cloud brand, which lists BSI C5 Type 2. Ask whether MetaKube is in scope.
CloudFerro (Poland): managed Kubernetes and a BSI C5 Type 1 opinion (PaaS service model, February 2026).
UpCloud (Finland), Infomaniak (Switzerland), Leaseweb (Netherlands), Cleura and Elastx (Sweden) also sell managed Kubernetes.

How to read the table

Where competitors are ahead of enum. STACKIT, Exoscale, T Cloud Public and OVHcloud already hold BSI C5, and IONOS holds a C5 Type 1 attestation. Hetzner holds C5 Type 2 for its servers and storage but has no managed Kubernetes. If a tender or a customer’s security questionnaire names C5 as a hard requirement, enum does not meet it today. OVHcloud, Exoscale, STACKIT, Scaleway and T Cloud Public run more European regions, and OVHcloud (Paris, Milan), STACKIT and Scaleway (Paris, Amsterdam, Warsaw) have regions with three availability zones, which makes in-provider disaster recovery simpler. enum has one region and one zone. IONOS, Exoscale Pro and OVHcloud Standard in 3-AZ regions have a higher control plane SLA than enum’s 99.9%. OVHcloud, IONOS and T Cloud Public have a much longer track record.

Free is not the same as production. OVHcloud’s free plan, Scaleway’s mutualized control plane, Exoscale Starter and T Cloud Public’s smallest cluster are fine for development. None of them comes with an HA control plane plus a formal SLA. IONOS is the exception: its control plane is free, HA, and covered by a 99.95% SLA. Compare production-grade control planes against each other: OVHcloud Standard, Scaleway Dedicated, Exoscale Pro, STACKIT SKE, IONOS and enum’s included control plane. T Cloud Public’s HA clusters are billed, but CCE has no SLA.

Group structure matters more than headquarters. Every provider here is headquartered in Europe. The difference is what else sits in the group. OVHcloud runs its US business through OVH US LLC, and its European entity signs contracts for European regions; OVH US says CLOUD Act requests it receives “could include data stored outside of the United States”. IONOS sells through IONOS Cloud USA Inc. in the US. T-Systems has no US subsidiary itself, but Deutsche Telekom controls T-Mobile US. The Schwarz Group behind STACKIT and América Móvil behind Exoscale have operations in North America. Whether a US affiliate can be required to obtain data from a European sister company is a point for your counsel. enum GmbH has no US parent and no US entity in its structure.

Certificate scope. IONOS’s C5 Type 1 attestation from May 2026 covers 33 services, but IONOS does not publish the list; Managed Kubernetes is named in its IT-Grundschutz ISO 27001 certificate. OVHcloud names Managed Kubernetes Service in its ISO 27001/27017/27018 scope, but its C5 scope is only in the report. Its SecNumCloud-qualified platform lists containers as planned. STACKIT names SKE in its C5 Type 2 scope. Hetzner’s C5 summary lists its products, and Kubernetes is not one of them because Hetzner does not sell it. Ask for the certificate and check whether your product is in scope.

None of GDPR, NIS2 or DORA says “use a European cloud”. GDPR sets conditions for transferring personal data to third countries, and NIS2 and DORA deal with how you manage the risk of your ICT suppliers. Our page on Kubernetes under NIS2 and DORA goes through what a provider can and cannot cover.

Buyers often ask how EU cloud providers compare to US hyperscalers on sovereignty. Run the checklist above against your current provider too.

This guide is general information, not legal advice. Have your counsel assess your specific situation.

Is European managed Kubernetes cheaper than AWS EKS?

For the control plane alone, EKS charges $0.10 per cluster-hour (about $73 a month), rising to $0.60 per cluster-hour once a Kubernetes version moves to extended support. OVHcloud Standard, STACKIT, Scaleway Dedicated, Exoscale Pro and T Cloud Public’s larger clusters also bill the control plane by the hour. IONOS and enum include it at no charge.

The larger differences are in worker nodes, egress and request fees, which this guide does not compare. Price your actual workload on each provider’s calculator. For enum’s prices, see /pricing.

Where enum fits

enum is a public cloud platform from enum GmbH, a German company with no US parent and no US entity in its structure. enum Kubernetes Engine is upstream Kubernetes with its own HA control plane per cluster, included in the price, with a 99.9% SLA on the control plane API. It runs in Frankfurt on infrastructure enum operates itself.

The limits, plainly:

One region (Frankfurt) and one zone (fra-a). The control plane is replicated across failure domains inside one data center. Berlin is offered on request, but nothing runs there by default.
The 99.9% SLA covers the control plane API, not worker nodes. It is below IONOS (99.95%), Exoscale Pro (99.95%) and OVHcloud Standard in 3-AZ regions (99.99%), equal to STACKIT, and above Scaleway Dedicated (99.5%). Contract terms, including any credits, are available from sales and not published.
No certifications of its own yet. ISO 27001 targets Q4 2026 and BSI C5 2027.
No published sub-processor list. Ask us for it.
No customer-managed keys or KMS. Data is encrypted at rest with AES-256; customer-managed keys are on the roadmap without a date.
No fine-grained IAM roles and no customer audit log yet. Both are planned for Q4 2026.
Clusters are set up on request until self-service cluster creation ships in Q4 2026. There is no node autoscaling; you size node pools for your peak. Nodes are x86 (AMD EPYC) only.
No Certified Kubernetes listing yet.
Included support covers working days. 24/7 response for critical incidents comes with Enterprise Support.
enum was founded in November 2024.

If you need C5 today or three availability zones in one region, the table and the list above show who has them. If the deciding questions are jurisdiction and a control plane someone else runs for you, see the enum Kubernetes Engine.

FAQ

Which managed Kubernetes provider in Europe has no US parent? Every provider in the table is headquartered in Europe. enum GmbH has no US parent and no US entity in its structure. OVHcloud (OVH US LLC) and IONOS (IONOS Cloud USA Inc.) have US subsidiaries, and Hetzner runs its US cloud locations through Hetzner US LLC. T-Systems has no US subsidiary itself, but its parent Deutsche Telekom holds 52.8% of T-Mobile US. The Schwarz Group behind STACKIT lists North America among its locations, and Exoscale’s ultimate majority owner América Móvil is NYSE-listed and operates in Puerto Rico.

Which European managed Kubernetes providers hold BSI C5? Per their own pages: STACKIT (Type 2, SKE named in scope), T Cloud Public (Type 2), Exoscale (Type 2, all zones and products stated in scope), OVHcloud (scope only in the report) and IONOS (Type 1, 33 services, list on request). Hetzner holds Type 2 for its servers and storage but sells no managed Kubernetes. Outside the table, plusserver and gridscale hold Type 2 for their clouds, noris network holds Type 2 for its Enterprise Cloud, and CloudFerro holds Type 1. enum targets C5 in 2027.

Is a free control plane good enough for production? Usually not. OVHcloud’s free plan lists a 99.5% SLO (its FAQ calls it an SLA) and runs in one zone; Scaleway Mutualized and Exoscale Starter have no SLA. IONOS is the exception, with a free HA control plane and a 99.95% SLA. Pick a tier with an HA control plane and a written SLA.

Does Hetzner offer managed Kubernetes? Not as a first-party product. Hetzner provides servers, load balancers and networks with Kubernetes integrations; you or a third party run the control plane. See enum compared to Hetzner.

Does an AWS or Google region in Frankfurt solve the sovereignty question? Not by itself. A Frankfurt region changes where the data sits, not which company runs the service. AWS’s separate European Sovereign Cloud (Brandenburg, launched January 2026, with EKS) is run by a German parent company and German subsidiaries that AWS set up, and AWS EMEA SARL in Luxembourg signs the contract for EU customers. S3NS, a Thales-controlled company working with Google Cloud, received SecNumCloud qualification for its PREMI3NS offer in December 2025. Partner-operated clouds like S3NS change the operator, while the software still comes from the US vendor. See enum compared to AWS.

Sources

Checked on 2026-10-09.