Bahnhof S3 vs Cloudflare R2
Bahnhof S3 is a European alternative to Cloudflare R2: same cloud & hosting use case, headquartered in Sweden and governed by EU GDPR, while Cloudflare R2 (Cloudflare) is based in the United States.
By the EU Alternatives team Last updated
S3-compatible object storage in Swedish datacentres at a flat per-terabyte price, with unlimited traffic, no API charges, versioning and Veeam support.
- Jurisdiction
- EU / EEA
- Primary privacy law
- EU GDPR
- US CLOUD Act exposure
- No
- Open source
- No
- Free tier
- No
Zero egress fees are the whole argument: object storage at 0.015 dollars per GB-month behind an S3-compatible API, 10 GB free, and no bill when you read your data back out. Buckets can be pinned to an EU jurisdiction, though that choice is permanent at creation. The operator is Cloudflare, Inc. of San Francisco, so American law still reaches the account.
- Jurisdiction
- United States
- GDPR by default
- Requires DPA + TIA
- US CLOUD Act exposure
- Yes
Bahnhof S3 vs Cloudflare R2 at a glance
| Bahnhof S3 | Cloudflare R2 | |
|---|---|---|
| Headquarters | Sweden | United States |
| Data jurisdiction | EU / EEA | United States |
| Primary privacy law | EU GDPR | Requires DPA + transfer assessment |
| US CLOUD Act exposure | No | Yes |
| Best for | Teams that need cloud & hosting built for European data-protection requirements | Teams already invested in the Cloudflare ecosystem |
Choose Bahnhof S3 if…
- You want a provider governed by a European privacy regime
- GDPR or public-sector data-protection requirements apply to you
- You'd rather back the European tech ecosystem
Stick with Cloudflare R2 if…
- You depend on integrations only available in the Cloudflare ecosystem
- Your organisation has no EU data-residency constraints
- Migration costs outweigh the jurisdiction benefits for now
About Bahnhof S3
Bahnhof S3 is S3-compatible object storage run entirely from Swedish datacentres by one of Sweden's best-known internet providers. Pricing is refreshingly flat: a single per-terabyte rate with unlimited traffic and no API costs, so egress and request bills never creep up on you.
The service speaks the industry-standard S3 API, which means existing backup software, SDKs and command-line tools work without code changes. Data is organised into buckets with unlimited storage and objects up to 5 TB each, and versioning plus built-in redundancy protect against accidental deletion. Enterprise backup suites such as Veeam, Commvault and Cohesity are supported as targets.
Key benefits:
- Flat per-terabyte pricing at 20 EUR per TB, with a 10 TB minimum
- Unlimited traffic with no egress fees when you read data back
- No API charges on storage requests
- Standard S3 API compatible with existing tools and SDKs
- Versioning and redundancy guarding against data loss
- Granular access control and secure sharing of stored data
- Backup integrations with Veeam, Commvault and Cohesity
Bahnhof AB is headquartered in Stockholm, Sweden, and has run internet and datacentre services since 1994 while campaigning against mass surveillance for decades. The S3 service is ISO 27001 certified and keeps data in Swedish datacentres under Swedish and EU jurisdiction and the GDPR, outside the reach of US cloud providers.
Ideal for companies moving backups and archives off Amazon S3 or other hyperscalers that want predictable storage bills and data kept in Sweden.
Why choose Bahnhof S3 over Cloudflare R2?
The decisive argument is data jurisdiction. Cloudflare R2 is headquartered in the United States, which means personal data processed through it can be subject to non-EU legal regimes: the US CLOUD Act, FISA 702, or similar laws depending on the provider. After the 2020 Schrems II ruling, EU organisations must carry out a transfer impact assessment for every such data flow.
Bahnhof S3 removes that overhead. As a Sweden-based provider, it operates under EU GDPR, and data stays inside the EU/EEA by default. For regulated sectors such as health, public administration, and finance, that's not a nice-to-have but a requirement. For everyone else, it's concentration-risk insurance: you avoid depending on a single jurisdiction that can change the rules without warning.