# Customer-managed encryption keys: which European clouds offer them in 2026

Last updated: 2026-11-10

A customer-managed encryption key is a key you create and control inside the cloud's key management service: you decide who may use it, when it rotates and when it's disabled or deleted, and the provider's storage services use it to encrypt your data. Among European clouds, **OVHcloud** and **Scaleway** sell a key service with hardware-backed keys and wire it into their storage, **STACKIT** offers one in Germany and Austria, and **Exoscale** has a standalone service whose storage integration hasn't shipped yet. An app platform like **Eurobase** encrypts what it stores for you but doesn't take your own keys, so there you'd encrypt sensitive fields in your code.

## Key control at a glance

| Platform | Company | Customer keys | Bring your own key | Hardware-backed keys | Wired into | Price per key |
|---|---|---|---|---|---|---|
| OVHcloud | Roubaix, France | Yes, KMS | Yes, by RSA key wrapping | Thales Luna HSM, FIPS 140-3 Level 3 | Block Storage, Kubernetes etcd, VMware and Nutanix over KMIP | €0.06 a month, €1 on HSM, excl. VAT |
| Scaleway | France | Yes, Key Manager | Yes, AES-256 key material only | FIPS 140-3 Level 3, Paris region only | Object Storage, Secret Manager | €0.06 per key version a month, €0.85 on HSM |
| STACKIT | Bad Friedrichshall, Germany | Yes, KMS | Yes, import of existing keys | No, software keys only | Secrets Manager, through the API | €0.00209 an hour per software key version |
| Exoscale | Lausanne, Switzerland | Yes, KMS | Not documented | Not documented | Standalone today, storage support announced | One key free, then €1 a month per key |
| Eurobase | Warsaw, Poland | No | No | Not offered | Values and secrets stored encrypted by the platform | Not offered |

Prices are from each provider's own page or official documentation, checked on 10 November 2026. OVHcloud quotes excl. VAT; Scaleway, STACKIT and Exoscale don't say whether VAT is included.

## The words you'll meet

- **Provider-managed keys.** Encryption at rest is on, but the provider creates, holds and rotates the key. It protects against a stolen disk, not against the operator.
- **Customer-managed keys, or CMK.** You create the key in the provider's key management service and control its access policy, rotation and deletion. AWS uses the same term for keys you create, own and manage.
- **Bring your own key, or BYOK.** You generate the key material on your side and import it, so you can prove where it came from and keep a copy.
- **Customer-provided keys, or SSE-C.** You send a key with every object storage request. The provider encrypts with it and doesn't keep it, so a lost key means lost data.
- **Hold your own key, or external key store.** The key stays in a system you run, and the cloud has to ask it for every operation. It gives you the most control, and among the providers below only Exoscale documents one, as a private preview.

For what keys do and don't solve in a sovereignty review, read [data residency vs data sovereignty](/i/data-residency-vs-data-sovereignty).

## What to check before you rely on a key service

- **Which services actually use the key.** A key service on its own only encrypts what your code sends it. Ask which storage, volumes and databases accept your key today, and which are still "coming soon".
- **Where the key lives.** Software keys and hardware security module keys can sit under the same API. If an auditor asks for FIPS 140-3 Level 3, check that the region you use has hardware-backed keys.
- **Whether you can import.** BYOK lets you keep a copy of the key material outside the cloud.
- **What happens on deletion.** Scaleway, STACKIT and Exoscale schedule a deletion instead of running it at once, which leaves time to catch a mistake. After that window, anything encrypted with the key is gone for good.
- **Who the provider answers to.** Keys held by a provider can be used by that provider. The company and its parent still decide which governments can ask, as [EU region vs EU company](/i/eu-region-vs-eu-company-cloud-act) explains.

## 1. OVHcloud KMS

OVHcloud is a French group registered in Roubaix. Its Key Management Service manages keys for cloud, hybrid and on-premises systems over a REST API and KMIP. The standard tier keeps keys in software and is certified to FIPS 140-3 Level 1. KMS on HSM moves custody onto Thales Luna hardware validated to FIPS 140-3 Level 3 and EAL4+, under the same API, IAM policies and audit logs. You can import and export key material wrapped with RSA, so it's never exposed in plain text.

Its Object Storage encrypts with OVHcloud-managed keys or with SSE-C. With SSE-C, OVHcloud says it doesn't store your key, and an object whose key is lost can only be deleted.

- **Best for:** teams that need hardware-backed keys across several products, including VMware or Nutanix estates.
- **Price:** managed keys are free, a customer-managed key is €0.06 a month and an HSM key €1 a month, excl. VAT, with unlimited API calls.
- **What it lacks:** HSM keys are still being rolled out region by region.

## 2. Scaleway Key Manager

Scaleway is a French cloud provider. Key Manager stores key encryption keys that never leave the service and hands out data encryption keys for your code to use. It handles encryption, decryption, signing and key encapsulation, and you can choose software-protected or HSM-backed keys. Its BYOK flow imports AES-256 key material you generate yourself. Object Storage uses Key Manager for SSE-KMS bucket encryption, and Secret Manager is integrated too.

- **Best for:** apps already on Scaleway that want their buckets encrypted with a key they control.
- **Price:** €0.06 per key version a month in software and €0.85 on HSM, plus €0.03 per 10,000 requests.
- **What it lacks:** HSM-backed keys are only in Paris, BYOK takes AES keys only, and Block Storage and Relational Databases are listed as coming soon.

## 3. STACKIT KMS

STACKIT is the cloud of Schwarz Digits, run by Schwarz Digits Cloud GmbH & Co. KG in Bad Friedrichshall, Germany. Its KMS creates, rotates and schedules deletion of keys through an API or the portal, imports keys you already have, and signs with asymmetric keys such as RSA. Keys are protected in software; its docs say that's the only protection level for now. Its price list names EU01 in Germany and EU02 in Austria. Secrets Manager can encrypt every value in an instance with a KMS key, set through the API.

- **Best for:** teams already on STACKIT that want a German operator for their keys.
- **Price:** €0.00209 an hour for each software key version in its German region, with no VAT note on the price list.
- **What it lacks:** hardware-backed keys, and its product page doesn't list which storage services take a KMS key.

## 4. Exoscale KMS

Exoscale is a Swiss cloud based in Lausanne and part of A1 Digital. Its KMS creates AES-256, RSA and signing keys, rotates symmetric keys every 365 days by default, and can replicate a key across zones if you choose that at creation. Volumes and buckets are already encrypted at rest, but with keys Exoscale manages.

- **Best for:** teams on Exoscale preparing for customer keys on their storage.
- **Price:** one key is free in every account, and each extra customer-managed key is €1 a month, billed by the hour, with no charge for operations or rotations.
- **What it lacks:** Compute, Block Storage and Object Storage support for KMS keys is announced as coming soon, and the external key store is a private preview.

## 5. Eurobase

Eurobase deploys web apps from Git to European infrastructure run by Scaleway, a French provider, and is a business registered in Warsaw, Poland. Every environment variable is stored encrypted and a secret can't be read back once saved, but the keys belong to the platform. There's no way to plug in your own.

When a contract asks for customer-managed keys, the workable pattern is envelope encryption in your code. Create a key in one of the services above, store its API credentials as a Eurobase secret, and encrypt sensitive fields before they reach your database or storage.

- **Best for:** apps where platform-held encryption is enough, or where you're happy to encrypt the sensitive fields yourself.
- **Price:** Free, Starter at €10 or Pro at €20 a month + VAT, one plan per workspace. Nothing is billed by usage today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.
- **What it lacks:** customer-managed keys, a key management service and managed Postgres. Its ISO 27001 and SOC 2 work hasn't finished yet.

## How to choose

1. List the data that must be under your key: buckets, volumes, databases or single fields.
2. Pick the provider whose storage takes your key for that data today, not on a roadmap.
3. If you need hardware-backed keys, check the region you deploy to has them.
4. Write down who may disable or delete the key. That person can make your data unreadable.

## Frequently asked questions

### What is the difference between BYOK and customer-managed keys?

A customer-managed key is one you control inside the provider's key service, however it was created. BYOK is one way to create it: you generate the key material yourself and import it. Scaleway, OVHcloud and STACKIT all accept imported keys.

### Can the cloud provider still read data encrypted with my key?

The key service runs on the provider's systems, so the provider's software uses the key whenever an authorized request comes in. Customer-managed keys give you control and an audit trail, but only an external key store or encrypting before upload keeps the key out of the provider's reach.

### Which European clouds have HSM-backed customer keys?

OVHcloud offers KMS on HSM on Thales Luna hardware, and Scaleway offers HSM-backed keys in its Paris region. Both are validated to FIPS 140-3 Level 3.

### What happens if I delete a customer-managed key?

The data it encrypted becomes unreadable. Scaleway and Exoscale hold a deleted key for 7 days, during which you can cancel, and STACKIT removes a key 30 days after you schedule its deletion. Once that period ends, there's no way back.

### Do I need customer-managed keys for GDPR?

Article 32 of the GDPR names encryption as one example of an appropriate measure, but it doesn't require you to hold the keys. Customer keys matter more when a contract, a sector rule or a sovereignty review asks for them. For the other hosting points, work through the [GDPR hosting checklist](/i/gdpr-hosting-checklist).

## Sources

- [OVHcloud Key Management Service](https://www.ovhcloud.com/en-ie/identity-security-operations/key-management-service/) and [OVHcloud SSE-C for Object Storage](https://docs.ovhcloud.com/en/guides/storage-and-backup/object-storage/s3-encrypt-your-objects-with-sse-c)
- [Scaleway Key Manager FAQ](https://www.scaleway.com/en/docs/key-manager/faq/), [Scaleway Key Manager concepts](https://www.scaleway.com/en/docs/key-manager/concepts/), [Scaleway BYOK](https://www.scaleway.com/en/docs/key-manager/api-cli/byok-api-cli/) and [Scaleway SSE-KMS](https://www.scaleway.com/en/docs/object-storage/how-to/enable-sse-kms/)
- [STACKIT Key Management Service](https://stackit.com/en/products/security/stackit-key-management-service), [STACKIT KMS docs](https://docs.stackit.cloud/products/security/kms/basics/introduction/), [STACKIT key management how-to](https://docs.stackit.cloud/products/security/kms/how-tos/create-and-manage-keys/) and [STACKIT Secrets Manager with KMS](https://docs.stackit.cloud/products/security/secrets-manager/how-tos/kms-encryption-in-the-secrets-manager/)
- [Exoscale KMS overview](https://community.exoscale.com/product/security/kms/overview/), [Exoscale KMS key deletion](https://community.exoscale.com/reference/terraform/provider/resources/kms_key/), [Exoscale encryption](https://www.exoscale.com/compliance/encryption/) and [Exoscale pricing](https://www.exoscale.com/pricing/)
- [AWS KMS key types](https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html)
- [GDPR text on EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [Eurobase getting started](/docs/getting-started), [Eurobase plans](/docs/plans) and [Eurobase subprocessors](/legal/subprocessors)