Context
Wombat's multi-provider Terraform coverage includes STACKIT alongside AWS, Azure, GCP, OVHcloud and Hetzner Cloud (framework v1.1.0).
STACKIT
Assess STACKIT workloads with the same provider-neutral controls you use on hyperscalers — and make residency, exit and supplier concentration explicit.
- European cloud, same control model
- Framework control coverage
- 73 controls with provider-specific checks
- 4 relevant pillars
- 4 starting points
What Wombat adds to the provider view.
STACKIT is a European cloud option for teams that need a different jurisdiction and provider concentration profile. Wombat's multi-provider Terraform coverage includes STACKIT, so the sovereignty conversation can be backed by the same score and evidence as the rest of the estate.
The current framework control pack includes 73 controls with STACKIT-specific checks.
Context
Use the sovereignty hub to connect provider choice to residency, key ownership, exit and supplier risk.
Context
The same control model lets you compare STACKIT with the hyperscalers without maintaining a separate assessment.
STACKIT quickstart
Use the STACKIT provider and pass the region explicitly so residency is part of the code review.
main.tf
terraform {
required_version = ">= 1.6.0"
required_providers {
stackit = {
source = "SchwarzIT/stackit"
version = "~> 2.0"
}
}
}
provider "stackit" {
region = var.stackit_region
}
terminal
wombat check . --output jsonSet the STACKIT credentials and region through your standard secret and variable workflow.
Known regions in the dashboard map.
Approximate locations only. The dashboard maps 34 region codes for this provider; below are the distinct locations in that map.
Approximate region locations from the dashboard map. Not a datacenter map.
Falkenstein, Germany
Hamburg, Germany
Munich, Germany
Vienna, Austria
Frankfurt, Germany
Quebec City, Canada
Sydney, Australia
Berlin, Germany
Data and verification
Data status. The region labels for STACKIT are compiled from the WOMBATpass dashboard region map. The current extract is dated 31 Oct 2026. The page currently lists 34 region codes from that map.
Verification. The data has not been cross-validated with the provider. It may be incomplete, approximate or outdated.
Intended use. The information is provided for general orientation only. It is not a guarantee of service availability, a representation of exact datacenter locations, or a statement of provider certification.
Corrections. Providers and other parties may submit corrections — including the provider name, the affected region code or control count, and a public source — to page@wombat-gov.dev or open a correction issue ↗.
Trademarks. Provider names and trademarks are the property of their respective owners. Wombat is not affiliated with, endorsed by or sponsored by these providers; the names are used solely for identification.
License. The provider data on this page is published under CC BY 4.0. It is a derived compilation from the WOMBATpass dashboard and the Wombat framework control pack. Attribution: Wombat Community. The data is provided without warranty. Data license.
Methodology. Read the data methodology →
Pillars that matter on STACKIT.
The same control model applies across providers, so the comparison stays consistent when the estate does not.
WAF-SOV
Sovereign
The primary lens: residency, jurisdiction, key custody, exit and provider concentration.
Read the Sovereign pillar →WAF-SEC
Security
Identity, network isolation and encryption still determine the security baseline.
Read the Security pillar →WAF-OPS
Operational Excellence
Supplier oversight, incident handling and evidence collection need an operating model.
Read the Operational Excellence pillar →WAF-REL
Reliability
Portability and recovery only help if the workload can actually run elsewhere.
Read the Reliability pillar →Control coverage by pillar.
Unique controls with provider-specific checks in the current framework control pack. A control may have multiple checks.
Snapshot of the current framework control pack; counts are not a certification. See the full coverage table →
Start here.
Use the provider-native guidance for depth, and the Wombat baseline for the cross-provider score, comparison and evidence.
Make the European provider choice evidence-backed
Score the STACKIT workload against the same neutral baseline, then use the sovereignty hub to turn residency and exit into controls.