Are you buying protection or delivery?
Both come bundled everywhere, and which one is the product determines what you should compare.
Protection is the product: Myra Security and Link11, both German, both engaged through enterprise sales, both selling DDoS mitigation, web application firewalls, bot management and DNS security to organisations for whom an outage is a serious event. The CDN is there to serve the protection.
Delivery is the product: Bunny.net, KeyCDN and Gcore, all self-serve and pay-as-you-go, where DDoS protection is included because a CDN absorbs volumetric attacks by construction. That covers the ordinary case well and is not the same as a mitigation service with engineers watching.
If your site being down for four hours costs a headline, you want the first group. If it costs a bad afternoon, the second group is the sensible spend.
What does this layer actually see?
Everything, which is why the jurisdiction question here is sharper than for most infrastructure.
A CDN or WAF sits in front of your site and terminates TLS, meaning it decrypts every request to inspect it — form submissions, login credentials in transit, API payloads, session cookies, and the IP address and behaviour of every visitor. It has to decrypt in order to filter, so this is inherent rather than a configuration choice.
With a US-established provider, that traffic sits within reach of the CLOUD Act regardless of which edge node served it. With Bunny.net in Slovenia, Myra and Link11 in Germany, Gcore in Luxembourg or OVHcloud in France, it is processed by an EU-established company under GDPR.
For a public body, a bank or a hospital, this is frequently the deciding factor rather than a preference — which is precisely why Myra and Link11 exist and why their BSI credentials matter.
What does BSI certification mean?
That the German federal office for information security has assessed the provider, and it is the strongest formal signal in this category.
Myra Security is BSI certified and Link11 is BSI qualified, which places both on the list of providers acceptable for German critical infrastructure — energy, water, healthcare, finance, government. That is an audited assessment rather than a self-declaration, and it is what gets a vendor through procurement at organisations where the wrong answer is a regulatory problem.
What they provide behind it is comparable in shape: Myra offers DDoS protection, a web application firewall, CDN, DNS security, bot management and SSL/TLS, hosted in Germany. Link11 leads with AI and machine-learning detection for zero-touch mitigation — attacks blocked without human intervention, which matters because DDoS attacks arrive at speeds humans cannot respond to — alongside its WAF, bot management, DNS protection and secure CDN from Frankfurt.
Both are enterprise pricing on request, which means a sales conversation before you can evaluate cost.
How cheap can delivery actually be?
Considerably cheaper than the incumbents have trained people to expect, and Bunny.net is the clearest demonstration.
Bunny.net charges from €0.01 per GB pay-as-you-go across more than 110 points of presence with a strong European footprint, adding Edge Storage, Bunny Stream for video hosting, DNS, image optimisation and DDoS protection. For a site serving a terabyte a month, that is a rounding error against what an enterprise CDN quotes.
KeyCDN runs 47-plus points of presence from Winterthur at €0.04 per GB with no minimum commitment, adding real-time analytics, instant cache purge, WebP conversion, HTTP/2, free SSL and DDoS protection under the Swiss Federal Data Protection Act.
Gcore covers 180-plus points of presence from Luxembourg with a free tier and paid plans from €25 per month, adding edge computing, cloud VMs, streaming, DNS and load balancing — with a particular focus on gaming and streaming, where latency is the product rather than a metric.
Where does the hosting provider fit?
OVHcloud sits in this category because security starts below the CDN, at the infrastructure the site runs on.
It is the largest European cloud provider, running public and private cloud, bare metal, managed Kubernetes and web hosting across more than 30 data centres with the majority in Europe, from €3.50 per month for a VPS — and it includes DDoS protection at the network level as standard rather than as an upsell.
The relevant point for this category is jurisdictional coherence: putting a European CDN in front of a US-hosted origin leaves the origin under US jurisdiction, which undoes much of the reason for choosing the CDN. If sovereignty is the goal, the stack has to agree with itself.
OVHcloud SAS operates from Roubaix. Its managed service catalogue is narrower than the US hyperscalers and support quality varies by tier, but for the specific question of where your servers are and whose law governs them, it is the largest European answer.
