AWS European Sovereign Cloud vs Bleu vs S3NS vs STACKIT: What Each One Actually Costs Compared to Standard Regions

Here is the single most useful fact if you are pricing a sovereign cloud in Europe right now: only two of the four main options publish numbers you can actually use. STACKIT lists per-resource prices on its site, and AWS publishes AWS European Sovereign Cloud pricing through its calculator. Bleu and S3NS are effectively quote-only once you go past entry-level resources. And where I can compare like-for-like, sovereign regions price above standard EU regions, not at parity and never below.

The headline per-vCPU rate is rarely the number that decides a project, but it is the one everyone asks about first. So let me answer it honestly, show you where the published prices stop and the quotes begin, and then get to the costs that actually move the total.

What are AWS European Sovereign Cloud, Bleu, S3NS, and STACKIT, and who runs each one?

These four are not the same kind of product, and the differences change your switching cost more than the price does.

AWS European Sovereign Cloud is AWS, operated by an EU-controlled AWS entity with EU-resident staff, a separate control plane, and separate billing. The first region is in Brandenburg, Germany, and it went generally available in January 2026. AWS has committed to invest 7.8 billion euros in it through 2040, with planned expansion to Belgium, the Netherlands, and Portugal via sovereign Local Zones.

Bleu is a Capgemini and Orange joint venture delivering Microsoft technology (Azure and Microsoft 365) on French soil, aimed at SecNumCloud qualification and the French public sector. Read the next section carefully on this one: as of late 2026, Bleu is not yet SecNumCloud qualified. It is working through the ANSSI process and targeting qualification around year-end. The commercial launch was announced earlier, but the qualification is the thing most buyers are actually paying for, so check the status before you quote it.

S3NS is a Thales and Google Cloud joint venture, French-controlled, running Google Cloud technology. Its PREMI3NS offering received SecNumCloud 3.2 qualification in December 2025. It is operated by S3NS staff in French data centers, and every underlying technology update is quarantined and validated by S3NS before it ships. This is the one of the four JVs that is actually qualified today.

STACKIT is the Schwarz Group's cloud (the retail group behind Lidl and Kaufland), with regions in Germany and Austria. Unlike the other three, it runs its own OpenStack-based catalog rather than licensing a hyperscaler stack, so it is not API-compatible with AWS, GCP, or Azure. That makes the service comparison matter more than the price comparison.

A quick word on the adjacent options people always ask about, because they sit in a different category: Microsoft EU Data Boundary and Azure's sovereign features, Google Cloud Sovereign Controls for the EU, OVHcloud, Scaleway, Ionos, and T-Systems/Delos. Those are controls or European providers you layer on or choose, not the same thing as a separately operated sovereign region.

Certification claims verified against vendor and ANSSI sources on the cyber.gouv.fr SecNumCloud list; verify current status before you rely on it in a tender.

What does each one cost versus a standard AWS, GCP, or Azure region?

Where prices are published, a sovereign region sits above the standard EU region for the same shape of compute. For Bleu and S3NS you cannot verify any number without a signed quote, so the only honest table is one built from published pages with the rest marked "quote-only."

Fix one reference workload and reuse it everywhere: roughly 4 vCPU / 16 GB general-purpose compute, 500 GB block storage, 1 TB object storage, 1 TB monthly egress, and one managed PostgreSQL at the same vCPU and RAM.

For the compute piece, here is what the published pages say (prices checked October 2026 - verify before quoting, and note AWS lists in USD while the European providers list in EUR, so treat cross-currency cells as approximate):

The AWS European Sovereign Cloud premium is the most citable number here. A detailed tecRacer analysis built from the AWS calculator found a consistent uplift of about 15 percent versus Frankfurt across EC2, S3, RDS, and Lambda. Their words: "a noticeable, but not dramatic uplift." I would not treat 15 percent as a guarantee for every SKU, but it is the right order of magnitude, and it comes from real published prices rather than a guess.

STACKIT's own list price for a 4 vCPU / 16 GB general-purpose instance (g1a.4d) is about 0.1967 euros per hour, which at current exchange rates lands slightly under AWS Frankfurt, not above it. That is the pattern across the European providers: a German or French provider with its own stack often beats the hyperscalers on raw compute. Scaleway is cheaper again, with a comparable instance starting near 0.069 euros per hour.

Why does the sovereign premium exist at all? Smaller scale and lower utilization, a duplicated control plane and operations team, EU-only personnel requirements, audit and qualification overhead, and fewer hardware generations to amortize. None of that goes away by negotiating harder.

Two things widen the gap beyond the on-demand rate. First, commitment discounts. AWS confirms that Savings Plans are available in the European Sovereign Cloud with savings up to 72 percent, which is good, but a thinner region with fewer instance families gives those plans less room to work than Frankfurt does. Second, the entry cost. STACKIT and Scaleway are self-service with a card. The SecNumCloud-qualified offers come with sales cycles, onboarding, and often minimum commitments that are themselves a cost before you run a single container.

Which costs do these comparisons usually miss?

The per-vCPU premium is the smallest line in most sovereign bills I have seen. The costs that decide the project are elsewhere.

Service catalog gaps. This is the big one. A new sovereign region does not launch with the full parent catalog. The AWS European Sovereign Cloud opened with a core set of services, and the tecRacer teardown noted real gaps at launch: Bedrock limited to Amazon Nova models, CloudFront not expected until late 2026, and several CI/CD services arriving later. Every service you rely on that is missing becomes self-hosted work, and engineering time is almost always a bigger number than the compute delta.

Region and availability-zone depth. With one region, multi-region disaster recovery either does not exist yet or forces a hybrid design with a standard region, which quietly reintroduces the cross-border data flow and the legal question you were trying to solve.

Commitment discounts and support. Confirm per offer whether Savings Plans, CUDs, or Reservations apply in that specific region and at what rate. And budget the support tier: AWS Business and Enterprise Support is priced as a percentage of monthly usage, which scales with your bill, not your needs.

People and exit cost. Fewer managed services means more platform engineering, so convert that to loaded FTE cost and state it openly. And remember that a licensed-technology offer (Bleu, S3NS) keeps your code reasonably portable back to the parent hyperscaler, while STACKIT's own catalog does not, which changes your exit cost.

When is a sovereign cloud worth the premium?

Pay it when a regulator or a contract names a qualification you cannot satisfy any other way. Stay in a standard EU region with residency controls when your real requirement is GDPR compliance and data location, which the hyperscalers' EU regions plus EU Data Boundary and Sovereign Controls already address.

The honest version most vendors will not tell you: most European SaaS companies do not need SecNumCloud and should not pay for it. Residency in an EU region, encryption, and a clean DPA is the correct and cheaper answer for the majority. And for a general workload, Scaleway and OVHcloud often beat all four of these on price, with a thinner catalog as the trade-off.

Buy the real qualification when you hit a real trigger: a French public tender that names SecNumCloud, DORA obligations for EU financial entities (in application since 17 January 2025), NIS2 scope, or HDS for French health data. On the CLOUD Act question, the structure is the point: EU-controlled entities and licensed-technology JVs are built to limit extraterritorial reach, and that structure is a large part of what the premium buys. It is also an area where you should read the primary regulatory text, not a vendor slide.

This is not a fringe concern anymore. IDC's Worldwide Digital Sovereignty Survey found sovereign cloud use among European organizations rose from about 30 percent in 2023-2024 to 40 percent in 2025, with a further 31 percent planning to adopt it.

How do you keep costs under control once you commit?

Architecture controls more of a sovereign bill than negotiation does, because the levers that work best in a thin-catalog, premium-priced region are the ones you own.

Right-size against measured p95 CPU and memory, not the instance family you are used to. In a region with fewer instance shapes, the default pick is usually oversized. Then go after non-production, which is the fastest win: dev, staging, and preview environments sit idle nights and weekends, and a weekday-only schedule removes the large majority of their hours. Qovery does this natively with environment auto-stop.

Keep the workload portable. Containers plus Kubernetes plus Terraform turn a sovereign region into a deployment target instead of a lock-in event, and that portability is also your leverage in the next negotiation.

Own the account. Commitment discounts (Savings Plans, CUDs, Reservations) and real cost visibility (Cost Explorer, the CUR, billing exports, Infracost, OpenCost) only work when the cloud account is yours. A traditional PaaS running in the vendor's account gives you one opaque invoice line and no discount eligibility.

That is where Qovery fits, and I will keep this factual. Qovery is a bring-your-own-cloud internal developer platform that installs inside your own AWS, GCP, Azure, or Scaleway account, or into your existing Kubernetes cluster, including a cluster running in a sovereign or on-prem environment. You get git-push deploys, a preview environment per pull request, auto-stop for non-production, managed cluster upgrades, per-environment RBAC, and databases backed by managed cloud services, while the bill, the commitment discounts, and the region choice stay in your name. To be clear about what Qovery is not: it is not SecNumCloud certified, not a sovereign region of its own, and not integrated with Bleu, S3NS, or STACKIT. The relevant capability is bring-your-own-Kubernetes into the environment you already control.

The practical hybrid pattern falls out of this: regulated services run in the sovereign region, everything else runs in a standard region, and one deployment workflow spans both so the split does not cost you developer velocity. Before you sign anything, get the commitment tiers, the service roadmap with dates, the egress terms, the support percentage, and the data-export terms in writing.

Frequently asked questions about sovereign cloud pricing in Europe

How much more expensive is a sovereign cloud than a standard AWS, GCP, or Azure region?

Expect a premium, not parity. For the AWS European Sovereign Cloud, an independent tecRacer analysis measured roughly 15 percent above Frankfurt across several services. For Bleu and S3NS the number is quote-only, so you cannot verify it without a signed quote. European providers with their own stack, like STACKIT, can actually land at or below hyperscaler list prices.

Does AWS European Sovereign Cloud cost more than AWS Frankfurt (eu-central-1)?

Yes. The published prices run about 15 percent higher for the same shape of resource, per the tecRacer calculator-based analysis. Savings Plans are available in the sovereign region with savings up to 72 percent, but the smaller region footprint gives commitment discounts less room than Frankfurt.

Do Bleu and S3NS publish public pricing?

No. Neither publishes a usable public price list beyond entry-level details, so any real comparison has to be built on a signed quote. That is not a knock on them; SecNumCloud-qualified offers are sold through a sales process. Just do not trust a calculator that claims to price them.

Is STACKIT cheaper than AWS, Azure, or Google Cloud in Europe?

On raw compute it can be. STACKIT's published list price for a 4 vCPU / 16 GB instance is about 0.1967 euros per hour, which is competitive with or below AWS Frankfurt for the same shape. The trade-off is a narrower, non-hyperscaler-compatible catalog, so the service comparison matters more than the sticker price.

Do I need SecNumCloud, or is a standard EU region enough for GDPR?

For most companies, a standard EU region plus encryption and a clean DPA is enough for GDPR. SecNumCloud is for sensitive French public-sector and critical-infrastructure workloads, or tenders that explicitly require it. If no regulation or contract names it, you probably should not pay for it.

Can I use AWS Savings Plans, Google Cloud CUDs, or Azure Reservations in a sovereign region?

For AWS, yes: Savings Plans work in the European Sovereign Cloud. For the other offers, confirm it in writing per region, because a sovereign offer without a 3-year commitment tier loses on a 3-year total cost of ownership even at similar on-demand rates. The discounts also only apply when the cloud account is yours.

What is the cheapest way to run a workload in Europe with full data residency?

For a general workload that needs residency but not a formal qualification, a standard EU region or a European provider like Scaleway or OVHcloud is usually the cheapest correct answer. Keep the workload on Kubernetes so you can move it, own the account so you keep the discounts, and only pay the sovereign premium where a rule actually forces it.

Sovereignty and cost are two different decisions, and only one of them is a spreadsheet. Decide the qualification you genuinely need, then control the bill with architecture and account ownership. If you want the region choice and the cloud bill to stay in your name while your team keeps shipping, try Qovery in your own cloud account.