Scaleway

Provider-specific sources from the current dataset. Use the Compass for scoring, weighting, and A/B comparison.

Compare in the Compass

Provider Snapshot

Criterion	Score
Customer content in the EU	4.0
Customer-created metadata in the EU	3.0
Physically & logically separated	1.0
EU-based operations & support	3.0
No critical non-EU dependencies	4.0
Ownership / ultimate parent (EU-owned?)	5.0
Controlling interest & FISA 702 risk (jurisdiction ≠ residency)	5.0
Local contracting entity & EU governance (operational model)	4.0
Independent advisory board	0.0
EU root CA / trust services	1.0
BSI C5	0.0
ISO 27001 / ISMS	4.0
IT-Grundschutz (BSI)	0.0
SecNumCloud (ANSSI)	2.0
Open standards / API portability	4.0
Service portfolio depth	4.5
Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)	4.0
Audit reports / evidence pack	4.0
Policy enforcement (guardrails)	2.0
Default deny / secure by default	1.0
Independent verification (continuous)	2.0
Blackbox exposure (ops/control plane)	2.0
Operator access exclusion (workload scope)	0.0
IaC & automation (Terraform/OpenTofu, SDKs, APIs)	4.0
Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)	4.0
Observability (logs/metrics/traces, alerting)	4.0
Limits/quotas (transparency & increase)	2.0
Reference architectures / landing zones	2.0
Unified security stack	3.8
Energieeffizienz / PUE & Zielwerte	5.0
CO₂-/Wasser-Reporting + erneuerbare Energiequellen	5.0

Scope: Cloud Suite (IaaS+PaaS)

Customer content in the EU: 4.0; Customer-created metadata in the EU: 3.0; Physically & logically separated: 1.0; EU-based operations & support: 3.0; No critical non-EU dependencies: 4.0; Ownership / ultimate parent (EU-owned?): 5.0; Controlling interest & FISA 702 risk (jurisdiction ≠ residency): 5.0; Local contracting entity & EU governance (operational model): 4.0; Independent advisory board: 0.0; EU root CA / trust services: 1.0; BSI C5: 0.0; ISO 27001 / ISMS: 4.0; IT-Grundschutz (BSI): 0.0; SecNumCloud (ANSSI): 2.0; Open standards / API portability: 4.0; Service portfolio depth: 4.5; Geographic footprint & redundancy (regions/AZ/DCs in EU/DE): 4.0; Audit reports / evidence pack: 4.0; Policy enforcement (guardrails): 2.0; Default deny / secure by default: 1.0; Independent verification (continuous): 2.0; Blackbox exposure (ops/control plane): 2.0; Operator access exclusion (workload scope): 0.0; IaC & automation (Terraform/OpenTofu, SDKs, APIs): 4.0; Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s): 4.0; Observability (logs/metrics/traces, alerting): 4.0; Limits/quotas (transparency & increase): 2.0; Reference architectures / landing zones: 2.0; Unified security stack: 3.8; Energieeffizienz / PUE & Zielwerte: 5.0; CO₂-/Wasser-Reporting + erneuerbare Energiequellen: 5.0

Sources / Evidence

Customer content in the EU

Europäischer Anbieter; Datenzentren/Services in Europa (stated).

Customer-created metadata in the EU

Französisches Unternehmen (Paris). RZ in Frankreich. ISO 27001:2022. SecNumCloud in Progress (ANSSI, Jan 2025).

Physically & logically separated

Keine separate 'Sovereign Realm'-Architektur belegt; Standard-Tenant-Isolation/Projekttrennung → TBD (Scope).

EU-based operations & support

France-based in-house technical support teams (24/7) (stated); EU-only Privileged Access/Break-glass nicht öffentlich belegt.

No critical non-EU dependencies

Französisches Unternehmen (Iliad-Gruppe). Eigene RZ in FR. SecNumCloud-Qualifizierung in Progress.

Ownership / ultimate parent (EU-owned?)

Scaleway (FR) – Teil der Iliad Group (FR) (stated).

Controlling interest & FISA 702 risk (jurisdiction ≠ residency)

Scaleway (FR/EU), Teil der Iliad Group (FR/EU). Kein US-Parent; Risiko extraterritorialer US-Zugriffspflichten deutlich geringer.

Local contracting entity & EU governance (operational model)

Contracting entity: Scaleway SAS (FR); Governance nach EU/FR Recht (stated).

Independent advisory board

Kein unabhängiges Advisory Board dokumentiert.

EU root CA / trust services

KMS (Key Manager) GA. Secret Manager verfügbar. Aber: Root CA / Trust Services nicht spezifisch dokumentiert.

BSI C5

Kein BSI‑C5 öffentlich gelistet (Compliance-/Zertifikate-Seite).

ISO 27001 / ISMS

ISO/IEC 27001:2022 (Download auf Security/Resilience-Seite) (stated).

IT-Grundschutz (BSI)

Kein IT‑Grundschutz-Zertifikat öffentlich gelistet (Stand: Recherche über Compliance-/Zertifikate-Seite).

SecNumCloud (ANSSI)

Eintritt in SecNumCloud-Qualifikationsprozess (Jan 2025) (stated).

Open standards / API portability

S3-kompatibles Object Storage + Terraform Provider (stated).

Service portfolio depth

Breites Public-Cloud-Portfolio (IaaS+ viele Managed/PaaS-Services) (stated).

Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)

Mehrere europäische Regionen/Standorte – Redundanz je Setup/Region (stated).

Audit reports / evidence pack

ISO-Zertifikat als Download verfügbar; weitere Compliance-Infos auf Security/Resilience-Seite (stated).

Policy enforcement (guardrails)

IAM Policies (Org/Project Scope) inkl. Conditions dokumentiert; Guardrails primär über IAM/Org-Struktur (partial).

Default deny / secure by default

Default nicht 'deny': Security Baseline nennt Default-SG mit inbound 'allow all'; kann via Security Group Policies restriktiv gesetzt werden.

Independent verification (continuous)

Regelmäßige externe Audits über Zertifizierungen (ISO/HDS etc.) belegt; keine Continuous/maschinenlesbare Verification öffentlich belegt.

Blackbox exposure (ops/control plane)

Audit Trail (IAM/Project Events) dokumentiert; Logs exportierbar. Transparenz zu Support-/Privileged-Access-Aktionen nicht vollständig öffentlich.

Operator access exclusion (workload scope)

Kein Confidential Computing-Angebot dokumentiert.

IaC & automation (Terraform/OpenTofu, SDKs, APIs)

Terraform Provider + API/CLI (stated).

Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)

Breite DevOps/Security-Services (Container Registry, Secret Manager, IAM) + K8s/Serverless (stated).

Observability (logs/metrics/traces, alerting)

Managed Observability (Cockpit) + Logs/Metrics/Traces Angebote (stated).

Limits/quotas (transparency & increase)

Organization‑Quotas dokumentiert (per Org); Erhöhung via Account‑Level/Verifikation bzw. Support möglich (partial).

Reference architectures / landing zones

TBD.

Energieeffizienz / PUE & Zielwerte

Veröffentlicht PUE/WUE je Datacenter + Durchschnitt; 2024 avg PUE 1.37, DC-KPIs inkl. 100% Wind/Hydro (GO). (Quelle: Scaleway Environmental Leadership)

CO₂-/Wasser-Reporting + erneuerbare Energiequellen

ESG-Transparenz inkl. Scope 1–3, PUE/WUE, 100% Wind/Hydro (GO) und Environmental Impact Calculator (Carbon+Water). (Quelle: Scaleway Environmental Leadership)

Service catalog (core/security)

Expand to load the service catalog …