Web Hosting
mittwald Webhosting (mStudio)
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Mittwald CM Service GmbH & Co. KG · www.mittwald.de
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
mittwald Webhosting (mStudio) at a glance
- Vendor
- Mittwald CM Service GmbH & Co. KG
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Germany source, captured 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates mittwald Webhosting (mStudio) 3/5, the mean of 6 judges. mittwald Webhosting (mStudio), from Mittwald CM Service GmbH & Co. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
mittwald Webhosting (mStudio) alternatives, European ones first →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
mittwald Webhosting (mStudio), from Mittwald CM Service GmbH & Co. KG of Espelkamp, scores highest on management and developer tools, where four judges give 8: a versioned REST API with cURL, JavaScript and PHP SDKs, a CLI for CI/CD pipelines, a Terraform provider and dev-and-prod environments. Security and backups is the weakest cluster, topping out at 6: the terms grant a daily backup only where contractually agreed, allow restore points up to 48 hours old and make liability for data loss conditional on the customer backing up at least daily — and we found no public information on two-factor login, malware scanning, a web application firewall or retention beyond that window. One judge registered 0 across the board — though that judge's findings describe the same strengths — while the other five score between 6 and 8. Among those five, sovereignty splits 7 against 6: the German contracting entity and its own Espelkamp data centre, against which we found no public information on a data processing agreement for the hosting itself, a subprocessor list or where backups are kept.
Speaks for it
- A versioned REST API with cURL, JavaScript and PHP SDKs, a CLI for CI/CD pipelines and a Terraform provider draw the top scores on the bench
- Scaling is documented end to end: tariff changes with preview and cancellation through the API, resources from 1 to 32 vCPU, and a ladder from webhosting to vServer to dedicated server
- Exit is concrete: data handed over on request in the stored format, deletion within 30 days of contract end, and cancellation on 30 days' notice
- Prices are public and itemised: webhosting at 13 €, 19 € and 36 € per month excluding VAT, vServer from 21 € per month, and migrations at fixed prices with stated durations
- The contracting entity is German — Mittwald CM Service GmbH & Co. KG of Espelkamp, registered at AG Bad Oeynhausen — with hosting in the company's own data centre in Espelkamp, German law, and an ISO 27001 certification from TÜV Rheinland
Held against it
- The daily automatic backup applies only where contractually agreed, restore points may be up to 48 hours old, and liability for data loss applies only if the customer backs up at least daily
- We found no public information on two-factor login, malware scanning, a web application firewall, backup retention beyond the 48-hour window, or a second backup location
- We found no public information on a data processing agreement for the hosting itself, a subprocessor list for the hosting chain, or where backups are kept
- The captured pages give different figures for support availability, pairing around-the-clock claims with chat hours of weekdays 8:30–17:00 and phone hours of weekdays 08:30–18:00
- We found no public information on a service credit behind the 99.99 percent availability guarantee, a CDN, HTTP/3, or the storage medium used
Best for
- You maintain WordPress or TYPO3 sites for clients and want API, CLI and Terraform automation with separate test and live environments
- You are an agency or business that wants a German contracting entity, German law, and hosting in the vendor's own Espelkamp data centre
- You want published, itemised pricing with a 10-day free trial and a documented exit on 30 days' notice
- You are moving a CMS or shop and prefer a priced migration service — 150 € for a CMS, 250 € for a shop, express moves at 299 € and 439 €, all excluding VAT
Avoid if
- You are a private consumer — offers are addressed exclusively to business customers (Gewerbetreibende), with all prices excluding statutory VAT
- You expect the host to bear liability for data loss unconditionally — the terms make it conditional on the customer backing up at least daily
- You need monthly billing — hosting is charged annually in advance
- You want several projects on the entry tier — webhosting covers one CMS or shop project, with multiple projects on the vServer tier from 21 € per month excluding VAT
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 3.5 of 5 |
| Control panel, WordPress & developer tooling | 4 of 5 |
| Security, backups & recovery | 3 of 5 |
| Scaling, migration & exit | 3.5 of 5 |
| Support, domains & email | 3 of 5 |
| European sovereignty | 3 of 5 |
| Pricing transparency | 3.5 of 5 |
Performance, uptime & infrastructure
panel disagrees
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
The plans publish vCPU, RAM and storage (1 vCPU/1 GiB/20 GiB up to 2 vCPU/4 GiB/60 GiB), the technology page names an own data centre in Espelkamp with redundant fibre and a mesh network, and the terms guarantee 99.99 percent availability in the yearly average up to the internet handover point, with a daily 23:00–06:00 maintenance window permitted. A public status page with monitored components and incident history sits behind it, and published before/after benchmarks show WordPress time to first byte dropping from 612 ms to 183 ms. I found no public information on a CDN, HTTP/2 or HTTP/3, server-side caching, or a service credit behind the uptime figure, which keeps this below the top rating. 1 3 4 8 11 12 13
The Small-Business Owner
The pages promise a 99.99 per cent availability guarantee for the servers, publish before-and-after speed figures for WordPress, TYPO3 and Shopware, show a status page with a disturbance history, and describe their own data centre in Espelkamp with technicians on site around the clock and redundant fibre — plus a published lifecycle for PHP versions, with paid extended support for old ones. I found no public information on SSD or NVMe storage, a content delivery network, or compensation if the availability guarantee is missed, so I stay one step below the top. 3 4 8 11 12 13
The Shop Operator
Every tariff names its vCPU, RAM and storage, the dedicated tier states dedizierte CPU, RAM & Storage, and Redis comes with the vServer tier — that is what I read before the price. A 99.99 % availability guarantee is stated as a yearly average up to the internet handover point, the status page shows incident history, and Shopware time-to-first-byte figures are published (203 ms before, 74 ms after); we found no public information on a service credit, a CDN, HTTP/3 or replicated storage. 1 3 4 8 11 12 13
The Freelance App Developer
Every tariff names its vCPU, RAM and storage, the vServer line adds Redis and Node.js, and a 99.99 percent availability guarantee sits in the terms alongside a public status page with incident history — more than I usually get to script against. They even publish before/after time-to-first-byte measurements for TYPO3, WordPress and Shopware from their own data centre in Espelkamp. We found no public information on HTTP/2 or HTTP/3, a CDN, SSD or NVMe storage being named, or a service credit behind the availability guarantee. 1 3 4 8 11 12 13
The Data Protection Officer
Resources per tariff are stated down to vCPU, RAM and storage, with dedicated CPU, RAM and storage on the server tariffs, a stated 99.99 percent availability guarantee in yearly average, a public status page with incident history and named monitored components, and published before/after Time to First Byte measurements for WordPress, TYPO3 and Shopware. A PHP lifecycle policy is published with community support durations and a priced extended support for PHP 8.1 and older. We found no public information on HTTP/3, a CDN, a service credit behind the availability guarantee, or the storage hardware. 1 3 4 8 11 12 13
The Skeptic
vCPU, RAM and storage are stated per plan, the terms guarantee 99.99 percent availability in the yearly average up to the internet handover point, and there is a status page with incident history plus published before/after load-time measurements. What I miss before the top band: no service credit is shown for a missed availability guarantee, the storage medium is not named, and we found no public information on a CDN, HTTP/3 or server-side caching beyond a Redis mention on the vServer. The PHP lifecycle is honest — three years community support, four from PHP 8.1, then paid extended support — which counts in their favour. 1 3 4 8 11 12 13
Control panel, WordPress & developer tooling
panel disagrees
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
This is the part I would buy for: mStudio gives me projects with dev and prod environments on one screen, one-click go-live, one-click installs for WordPress and TYPO3, automatic updates, and a rights-and-roles system that lets me give clients and freelancers different permissions. Underneath sits a documented v2 REST API with JavaScript and PHP SDKs, a CLI for CI/CD pipelines, and a Terraform provider covering projects, apps, databases, domains and containers, with deployment guides for GitHub Actions, GitLab CI and Deployer. I found no public information on update rollback, cloning, transferring a project to the client with its billing, or white-label options, which is the gap between this and the best-in-class platforms. 2 3 14 15 17 18 19
The Small-Business Owner
For a WordPress site like mine the captured pages show one-click installation for WordPress and TYPO3, automatic updates, separate test and live environments with go-live at a click, and a rights and roles system so colleagues only see what they should. Developers get a documented command-line tool, a versioned public API covering backups, databases and even tariff changes, and Terraform support; I found no public information on audit logs, single sign-on, or handing a project to a client with the billing transferred. 2 14 15 17 18
The Shop Operator
The mStudio with one-click installations for WordPress and TYPO3, a documented command-line tool for scripts and CI/CD pipelines, a public API with PHP and JavaScript SDKs covering backups, databases and tariff changes, and a Terraform provider for projects, apps and databases is tooling my developer can actually work with. Roles and permissions for customers and colleagues plus dev and prod environments with one-click go-live round it out; we found no public information on audit logs of changes or single sign-on for the team. 2 3 14 15 17 18
The Freelance App Developer
For my kind of work this is the strongest part: an API-first mStudio, a documented version-2 REST API with cURL, PHP and JavaScript examples, the mittwald CLI built for non-interactive use in CI pipelines, and a Terraform provider covering projects, apps, databases, domains and containers. Deployment is taken seriously — Deployer with GitHub Actions and GitLab CI, SSH source deploys for PHP and Node apps, containers built from my own Docker image, one-click installs for WordPress and TYPO3, dev and prod environments, and a roles system for customers and colleagues. We found no public information on Composer or cron jobs being addressed, or on audit logs, single sign-on or per-branch preview environments. 2 3 14 15 17 19
The Data Protection Officer
The mStudio console comes with one-click installations for WordPress and TYPO3, development in a test environment followed by go-live with one click, and a rights and roles system giving customers and colleagues different permissions. The documented tooling is unusually deep for a German host: a versioned REST API with cURL, JavaScript and PHP SDKs, a command-line tool with guides for non-interactive CI/CD use, a Terraform provider, deployment over SSH, Deployer, GitHub Actions and GitLab CI, and container hosting running a Docker image you build yourself. We found no public information on rollback, cloning, Composer, audit logs or transferring project ownership to a client. 2 3 14 15 18 19
The Skeptic
The mStudio panel with one-click installs for WordPress and TYPO3 is only the floor here: there is a documented CLI built for CI/CD pipelines, a Terraform provider, and a versioned REST API with SDKs covering backups, database restores and tariff changes down to the endpoint. Roles for customers and colleagues are described, aimed at agencies. We found no public information on audit logs, single sign-on or preview environments per branch, which is what separates this from the top. 2 3 14 15 17 18
Security, backups & recovery
panel disagrees
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
Backups are automated and fully scriptable — a documented API creates, restores and exports them, including single-path restores and database dumps to a target database, as tar or zip with password protection — and free, auto-renewing Let's Encrypt certificates plus a TÜV Rheinland ISO 27001 certification are published. The terms peg daily backups to a restore point no older than 48 hours and make the vendor's liability for data loss conditional on the customer backing up at least daily. I found no public information on malware scanning or cleanup, a web application firewall, DDoS protection, two-factor login, customer isolation, retention beyond that restore point, or a second backup location. 4 11 16 17 19
The Small-Business Owner
Backups run automatically each day where a backup is part of the contract, with a restore point no older than 48 hours, and single paths or databases can be restored through the documented API; Let's Encrypt certificates are free and renew automatically 30 days before expiry, and a TÜV Rheinland ISO 27001 certification is stated. I found no public information on two-factor login to the panel, malware scanning or cleanup, a firewall, how long backups are kept, or where they are stored — the first questions I would ask with customer data on the site. 4 11 16 17 19
The Shop Operator
Let's Encrypt certificates are free, validate per ACME and renew automatically 30 days before expiry, and where a backup is contractually agreed a daily automatic backup runs with restore points no older than 48 hours; through the documented API I can create a backup on demand and restore single paths or a database to another target, which covers my case of getting yesterday's database back fast after a bad update. An ISO 27001 certification from TÜV Rheinland is published; we found no public information on retention beyond the 48-hour restore window, a second backup location, a web application firewall, malware scanning, DDoS protection or two-factor login to the panel. 2 4 11 16 17 19
The Freelance App Developer
Let's Encrypt certificates are free for all customers with ACME validation and automatic renewal 30 days before expiry, backups can be created on demand and restored through the API down to a single path or a database dump, exported as password-protected tar or zip, and an ISO 27001 certification from TÜV Rheinland is published. The terms promise a daily automatic backup with restore points no older than 48 hours. We found no public information on backup retention beyond that, a second backup location, a web application firewall, malware scanning, DDoS protection or two-factor login to the panel. 4 11 16 17 19
The Data Protection Officer
Let's Encrypt certificates are free for all customers with ACME validation, 90-day validity and automatic renewal 30 days before expiry, the operation holds an ISO 27001 certification from TÜV Rheinland, and backups are handled daily with restore points no older than 48 hours where contractually agreed, plus full API control including on-demand backup creation, restore of individual paths and databases, and password-protected tar or zip exports. For my clients I would note what is not documented: backup retention periods beyond that window, a second backup location, tenant isolation between customers, two-factor login, malware scanning and a web application firewall are all absent from the captured pages. 4 11 16 17 19
The Skeptic
Free Let's Encrypt certificates with automatic renewal, on-demand backups through the API with restore down to single paths and target databases, password-protected tar or zip export, and an ISO 27001 confirmation from TÜV Rheinland — that is a solid base. But read the small print: the daily backup is promised only "soweit vereinbart", the restore point may be up to 48 hours old, and liability for data loss applies only if the customer backs up at least daily themselves. We found no public information on backup retention in days, a second backup location, two-factor login, malware scanning or a web application firewall. 4 9 11 16 17 19
Scaling, migration & exit
panel disagrees
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
Growth is documented across the whole ladder: a configurator for vCPU, RAM and storage (1 to 32 vCPU with recommended ceilings per project count), tariff changes with preview and cancellation via the API, unlimited projects on a vServer, and a path from webhosting through vServer to dedicated servers at the same vendor. Exit is equally concrete — one month's notice, deletion of stored data within 30 days of termination, handover of a copy of all stored data on request, and API export of backups as tar or zip. The migration service is scoped with timelines and priced (150 € CMS, 250 € shop, 9 € per mailbox or free via the move tool) rather than free, and I found no public information on domain transfer-out fees. 3 4 6 11 12 18 19
The Small-Business Owner
Growing and leaving are both documented: a configurator for processor cores, memory and storage, tariff changes through the panel or API, a clear ladder from web hosting to vServer to dedicated server, and a migration service priced by scope — 150 € zzgl. USt. for a CMS move in 5–10 working days, 250 € zzgl. USt. for a shop, mailbox moves free via their tool. On exit the terms promise handover of the data on request, deletion within 30 days of the contract ending, cancellation with 30 days' notice, and backups that export as password-protected tar or zip files. 3 4 6 11 18 19
The Shop Operator
Tariff changes run through a documented API endpoint with preview and cancellation, resources are chosen in a configurator scaling up to 32 vCPU, and the shop migration is priced with its scope and duration (Umzug Onlineshop zu mittwald, 10 - 14 Werktage, 250 € zzgl. USt.) — paid, but predictable. Visitor overage is handled transparently (info mail, 7 days to raise the tariff, then slower page delivery), data is exported on request at contract end and deleted within 30 days; we found no public information on scaling without downtime or on domain transfer out. 1 3 4 6 11 12 18 19
The Freelance App Developer
Growing and leaving are both documented: tariff changes run through the API with a preview and a cancellation endpoint, resources scale from 1 to 32 vCPU, and there is a stated path from webhosting to vServer to dedicated server with the same vendor. The migration service is itemised in public prices — 9 € for a domain, 150 € for a CMS project, 250 € for a shop — and the exit terms are concrete: data handed over on request at contract end in the stored format, deletion within 30 days, 30 days' notice. We found no public information on monthly terms for hosting, and the migration service is paid rather than free. 1 3 4 6 11 12 18 19
The Data Protection Officer
Tariff changes run through a configurator and the API, with preview, ordering and cancellation of a scheduled change documented, and a documented path from shared webhosting through vServer to dedicated servers at the same vendor. The migration service is priced by scope (CMS project 150 € excluding VAT, shop 250 €, express moves 299 € and 439 €, domain 9 €, mailbox 9 € or free via the migration tool), and exit terms are clear: data returned on request in the stored format on a data carrier or by remote transfer, deletion within 30 days of contract end, and a 30-day cancellation notice. We found no public information on domain transfer out or monthly billing terms for hosting, which is charged annually in advance. 1 3 6 11 12 18 19
The Skeptic
Scaling runs through a configurator and tariff changes are exposed to the API including preview and cancellation; leaving is documented better than most: data is handed over in the format it is stored in, deleted within 30 days of contract end, and cancellation runs on 30 days' notice. Migration in is priced item by item with working-day durations — CMS 150 €, shop 250 €, express 299 € — and the visitor overage policy is published with its throttling consequence. We found no public information on domain transfer out or exporting mailboxes, and the migration service is paid rather than free, so I stay below the top band. 1 3 4 6 11 12 18
Support, domains & email
panel disagrees
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
Phone and chat run Monday to Friday with stated speeds — minutes in live chat, complex tickets often solved the same day — and a 24/7 emergency hotline plus technicians on site at the data centre cover the nights, with separate numbers for Kundencenter and mStudio users. Support is described as certified, goes the extra mile on CMS and shop systems, and offers paid debugging; domains, SSL certificates and mailboxes are bookable in the same account. I found no public information on an agency or partner programme with stated benefits, on help with hacked sites, or on mailbox size, aliases and server-side filtering. 1 4 5 9 11 20
The Small-Business Owner
This is decisive for me, and it reads well: German-speaking phone support with named numbers and hours (Monday to Friday 08:30–18:00), a live chat answering within minutes on weekdays, a ticket system where complex requests are often solved the same day, a 24/7 emergency hotline, and explicit willingness to go the extra mile on CMS and shop questions. Domains, SSL certificates and email services sit alongside the hosting, with communication in German and English; I found no public information on mailbox sizes, aliases, spam filtering, or help with a hacked site. 1 5 9 11 20
The Shop Operator
A 24/7 emergency hotline with technicians on site around the clock next to the data centre is what I need on a Black Friday Saturday night, and response speeds are stated per channel (chat within a few minutes, complex tickets often solved the same day) by people who explicitly go the extra mile on CMS and shop systems. The captured pages give different figures for availability: chat is listed Monday to Friday 8:30–17:00 and phone 08:30–18:00 alongside the around-the-clock hotline; we found no public information on help with hacked sites, a partner programme's stated benefits, or mailbox sizes and spam filtering. 1 4 5 9 20
The Freelance App Developer
Phone, live chat and a ticket system are documented with hours and dedicated numbers per product, a 24/7 emergency hotline exists, chat answers in a few minutes and tickets are often solved the same day, and the depth is real — certified support that goes the extra mile on CMS and shop systems, a paid debugging service, and PHP Extended Support in cooperation with Zend. Domains, email services and the DNS service live in the same account, in German and English. We found no public information on mailbox sizes, webmail or spam filtering, or on the benefits of an agency or partner programme. 1 5 6 9 11 13 20
The Data Protection Officer
Support runs by telephone with separate numbers for Kundencenter, mStudio and sales advice, live chat Monday to Friday from 8:30 to 17:00 with answers in a few minutes, a ticket system in the Kundencenter whose complex requests are often solved the same day, and a 24/7 emergency hotline, in German and English, from a certified team that also helps with CMS and shop questions; deeper debugging can be commissioned as a paid service. Domains and SSL certificates are bookable addons and email is part of the booked storage. We found no public information on mailbox sizes, aliases, server-side filtering, webmail or help with hacked sites. 1 5 9 13 20
The Skeptic
Phone, chat, tickets and email are all documented with stated hours, a 24/7 emergency hotline exists, communication runs in German and English, and there is paid debugging as a deeper tier; technicians sit next to the data centre around the clock. The captured pages give different figures for round-the-clock availability — "24/7 Expertenhilfe" on the one hand, chat weekdays 8:30–17:00 and phone weekdays 8:30–18:00 on the other — and the response figures ("in wenigen Minuten", "häufig noch am selben Tag") are marketing, not guarantees. We found no public information on mailbox sizes, webmail or spam filtering. 1 3 4 5 9 13 20
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
The contracting entity is Mittwald CM Service GmbH & Co. KG of Espelkamp with a German general partner (Robert Meyer Verwaltungs GmbH), the sites run in the vendor's own data centre in Espelkamp, support sits at the German headquarters, a TÜV Rheinland ISO 27001 certification is published, and the vendor claims independence from international digital corporations. The privacy page names only services behind mittwald's own website (etracker of Hamburg, LinkedIn Ireland). I found no public information on a data processing agreement for the hosting itself, on the subprocessors of the hosting chain, or on where backups are kept, so the full chain cannot be rated. 1 3 4 5 9 10
The Small-Business Owner
Everything the captured pages show points to Germany: the contracting entity is Mittwald CM Service GmbH & Co. KG of Espelkamp with a commercial register entry at Bad Oeynhausen, the servers run in the company's own data centre in Espelkamp next to the offices, support sits at the headquarters, a TÜV Rheinland ISO 27001 certification and DSGVO positioning are stated, and data is deleted 30 days after the contract ends. I found no public information on where backups are kept, on the service providers in the hosting chain, or on a published data processing agreement for the hosting itself, which keeps me below the top marks. 4 5 9 10 11
The Shop Operator
The contracting entity Mittwald CM Service GmbH & Co. KG with a German general partner, its own data centre named in Espelkamp and servers in Nordrhein-Westfalen put my shop data demonstrably in Germany under German law, with an ISO 27001 certification published and hosting advertised as DSGVO-conform. The privacy policy names service providers such as etracker from Hamburg, and PHP fixes come from Zend in cooperation; we found no public information on where backups are stored or a published list of subprocessors for the hosting chain itself. 1 4 9 10 13
The Freelance App Developer
The chain is provably German: Mittwald CM Service GmbH & Co. KG of Espelkamp, with a German general partner, is the contracting entity, the servers run in the company's own data centre in Espelkamp, support sits at the German headquarters with technicians on site around the clock, and an ISO 27001 certification from TÜV Rheinland is published, with the vendor positioning itself as independent of international digital corporations. We found no public information on where backups are kept, a published list of subprocessors for the hosting chain, or a data processing agreement between mittwald and its hosting customers — the AV Manager offered is a tool for customers to manage their own contracts. 1 4 5 9 10 11
The Data Protection Officer
The contracting entity is a German limited partnership registered at AG Bad Oeynhausen with a German general partner, the data centre is the company's own and is named by location in Espelkamp, Germany, running on 100 percent renewable energy, independence from international digital corporations is claimed, and the operation is ISO 27001 certified by TÜV Rheinland. What I look for first is missing from the captured pages: a published data processing agreement for the hosting itself, a list of subprocessors for the hosting chain with their locations, and where the backups are kept; the terms only state that subcontractors may be engaged. 1 4 9 11
The Skeptic
The contracting entity is a German GmbH & Co. KG with register number and German general partner, the data centre is the company's own and named by location in Espelkamp, and the vendor claims independence from international digital corporations — that is more than most hosts show. What keeps me off the top band: we found no published data processing agreement for the hosting itself and no subprocessor list for the hosting chain — the privacy policy names processors for the vendor's own website only — and the ISO 27001 confirmation comes without its scope. Subcontractor use is permitted by the terms without naming anyone. 1 4 9 10 11
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
Webhosting S, M and L are published with resources and monthly prices (13 €, 19 €, 36 €), vServer and dedicated tiers start at 21 € and 169 € per month, and a configurator prices vCPU, RAM and storage to the euro; add-ons are itemised — CMS migration 150 €, shop migration 250 €, domain move 9 €, extended PHP support 5 € or 15 € per version per project and month — with overage handling, net prices excluding statutory VAT for business customers, and one-month cancellation stated. I found no public information on first-term versus renewal pricing side by side, setup fees, or the price of domains, mailboxes, paid SSL certificates and restores. 1 3 4 6 7 11 13
The Small-Business Owner
I can nearly compute my yearly bill from the website alone: web hosting at 13 €, 19 € and 36 € pro Monat zzgl. USt. with the resources listed, a vServer ab 21 € and dedicated servers ab 169 € pro Monat zzgl. USt., storage add-ons shown at 2,00 € for 40 GiB and 5,00 € for 100 GiB, and every migration variant priced with its duration, including express moves. Prices are clearly net and for business customers only, billing is yearly in advance, cancellation takes one month, and overage for storage and visitor limits is described; I found no public information on setup fees or what a restore costs. 1 4 6 11 13
The Shop Operator
Webhosting tariffs are published with resources and price (S at 13 € pro Monat zzgl. USt., L at 36 € pro Monat zzgl. USt.), add-ons are priced down to PHP Extended Support at 5 € pro PHP-Version je Projekt, pro Monat zzgl. USt., migration flat rates and storage packages are listed, VAT treatment for business customers is stated, and on-demand overage for storage and stage environments is explained. Hosting is billed annually in advance with a one-month cancellation period; we found no public information on setup fees, the renewal price as a separate figure, or the cost of a restore. 1 3 6 7 11 12 13
The Freelance App Developer
Prices are public and computable in outline: every webhosting plan carries a monthly net price with its resources, the configurator shows worked examples such as 1 vCPU / 2 GiB RAM at 17,00 € plus 40 GiB storage at 2,00 €, everything is stated exclusive of VAT for business customers, and billing is annual in advance with a 30-day cancellation. Add-ons are itemised, from 5 € per PHP version per project and month for extended PHP support to migration fees between 9 € and 439 €. We found no public information on setup fees, a distinction between first-term and renewal pricing, or the rates charged for on-demand overage. 1 3 6 11 13
The Data Protection Officer
Tariffs are public with monthly prices for business customers only, all excluding statutory VAT with the EU tax-rate caveat stated, and the configurator prices each line item (for example 4 vCPU and 16 GiB RAM at 99.00 € plus 100 GiB storage at 5.00 €). Add-ons are individually priced, including PHP Extended Support at 5 € or 15 € per version per project per month and the migration services, on-demand overage billing for storage and staging environments is described, and cancellation takes 30 days with annual prepayment. Setup fees and an explicit first-term versus renewal price split are not stated. 1 3 4 6 11 13
The Skeptic
The prices are refreshingly plain: 13 €, 19 € and 36 € per month net with resources attached, no teaser first term that doubles on renewal, VAT treatment and the 30-day cancellation stated, and add-ons itemised — PHP extended support at 5 € or 15 € per version per project and month, migrations at fixed prices. Overage handling is published, including the seven-day grace before page delivery is slowed. What a buyer still cannot compute: we found no public information on setup fees, restore fees, domain prices or mailbox prices. 1 3 6 11 12 13 16
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about mittwald Webhosting (mStudio)
Is mittwald Webhosting (mStudio) European?
Yes. whats-best.ai classifies mittwald Webhosting (mStudio) as EU-Made.
Where does mittwald Webhosting (mStudio) store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Germany as hosting location, per the vendor’s page captured 1 Nov 2026.
Does mittwald Webhosting (mStudio) have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to mittwald Webhosting (mStudio)?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: mittwald Webhosting (mStudio) alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Hosting location. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 18 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 hosting fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (22)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (web hosting, with pricing) www.mittwald.de Checked 1 Nov 2026 Details →
- 2 Features page (mStudio control panel) www.mittwald.de Checked 1 Nov 2026 Details →
- 3 Features page (virtual servers) www.mittwald.de Checked 1 Nov 2026 Details →
- 4 Features page (technology and data centre) www.mittwald.de Checked 1 Nov 2026 Details →
- 5 Support page www.mittwald.de Checked 1 Nov 2026 Details →
- 6 Features page (migration service) www.mittwald.de Checked 1 Nov 2026 Details →
- 7 Features page (data processing agreement manager) www.mittwald.de Checked 1 Nov 2026 Details →
- 8 Status page www.mittwald-status.de Checked 1 Nov 2026 Details →
- 9 Legal notice www.mittwald.de Checked 1 Nov 2026 Details →
- 10 Privacy policy www.mittwald.de Checked 1 Nov 2026 Details →
- 11 Terms of service www.mittwald.de Checked 1 Nov 2026 Details →
- 12 Performance, uptime & infrastructure — found from sitemap www.mittwald.de Checked 1 Nov 2026 Details →
- 13 Performance, uptime & infrastructure — found from sitemap www.mittwald.de Checked 1 Nov 2026 Details →
- 14 Control panel, WordPress & developer tooling — found from sitemap developer.mittwald.de Checked 1 Nov 2026 Details →
- 15 Control panel, WordPress & developer tooling — found from sitemap developer.mittwald.de Checked 1 Nov 2026 Details →
- 16 Security, backups & recovery — found from sitemap www.mittwald.de Checked 1 Nov 2026 Details →
- 17 Security, backups & recovery — found from sitemap developer.mittwald.de Checked 1 Nov 2026 Details →
- 18 Scaling, migration & exit — found from sitemap developer.mittwald.de Checked 1 Nov 2026 Details →
- 19 Scaling, migration & exit — found from sitemap developer.mittwald.de Checked 1 Nov 2026 Details →
- 20 Support, domains & email — found from sitemap www.mittwald.de Checked 1 Nov 2026 Details →
- 21 Support, domains & email — found from sitemap www.mittwald.de Checked 1 Nov 2026 Details →
- 22 Self-hosting / on-premises installation docs — found from the homepage www.mittwald.de Checked 1 Nov 2026 Details →