Hetzner
German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.
Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.
Key capabilities
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.
Best fit when
- Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
- Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
- Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
- Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
- German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console
Poor fit when
- Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
- Policies that forbid any US subsidiary, US colocation, or optional US region at group level
- Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
- Teams expecting fully managed OS patching, databases, and DR without operating the stack
Consider instead when
When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.
- Independent security / no-logs audit·Not applicable
- ISO 27001·Verified
- SOC 2 / SOC 3·Not found
- GDPR / EU data protection·Vendor claimed
- +5
Considerations & known limitations
- MediumOptional US and Singapore cloud regions
Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.
- MediumUnmanaged cloud and dedicated servers
You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.
- LowNarrower managed-service catalog vs hyperscalers
Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.
- LowISO scope is DE/FI parks
Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.
Open questions for due diligence
- Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
- Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
- Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
- Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?
Häufig gestellte Fragen
Yes if you choose EU product locations. Non-cloud products process and store data exclusively in the EU. For Cloud, Falkenstein, Nuremberg, or Helsinki keep server data in the EU; customer master/contract/billing data always stay in the EU. Choosing Ashburn, Hillsboro, or Singapore moves only that server's content (and related traffic) to the third country under your location selection. EU-location backups stay in the EU per Hetzner's data-protection docs.
For many VPS, bare-metal, storage, and self-hosted stacks—especially when egress cost and EEA residency dominate—often yes as the primary compute layer. It is not a drop-in for the full hyperscaler catalog (deep managed databases, serverless, AI platforms, global enterprise support programs). Common pattern: run compute and storage on Hetzner and keep specialized managed services elsewhere.
Hetzner publishes ISO/IEC 27001:2022 for the ISMS covering infrastructure, operation, and customer support of the Nuremberg, Falkenstein, and Helsinki parks, and a BSI C5 Type 2 attestation for cloud. US and Singapore cloud run on Hetzner's servers in third-party colocation (approved subprocessors include NTT and QTS in the US, NTT in Singapore, plus local Hetzner subsidiaries). Contract partner remains Hetzner Online GmbH; do not assume DE/FI ISO park scope automatically equals every global location.
Accept the standard Art. 28 DPA in the customer account (accounts.hetzner.com); Hetzner does not issue custom wet-ink DPAs. Subcontractor overview is published at hetzner.com/AV/subunternehmer.pdf (e.g. Hetzner Finland Oy; for US/SG locations Hetzner US LLC, Hetzner Singapore Pte. Ltd., and named colocation providers). Support is generally from EU teams for all locations.
Cloud and dedicated root servers are unmanaged: you patch the OS, configure firewalls beyond the platform tools you use, and implement backups. Hetzner provides optional Storage Boxes and product-specific backup features; automatic backups are not a full managed DR product for every plan. Web hosting and managed-server products have different operational models—check product docs for your SKU.