Hetzner Cloud

Provider-specific sources from the current dataset. Use the Compass for scoring, weighting, and A/B comparison.

Compare in the Compass

Provider Snapshot

Criterion	Score
Customer content in the EU	4.0
Customer-created metadata in the EU	3.0
Physically & logically separated	1.0
EU-based operations & support	2.0
No critical non-EU dependencies	4.0
Ownership / ultimate parent (EU-owned?)	5.0
Controlling interest & FISA 702 risk (jurisdiction ≠ residency)	5.0
Local contracting entity & EU governance (operational model)	4.0
Independent advisory board	0.0
EU root CA / trust services	1.0
BSI C5	5.0
ISO 27001 / ISMS	4.0
IT-Grundschutz (BSI)	0.0
SecNumCloud (ANSSI)	0.0
Open standards / API portability	4.0
Service portfolio depth	1.9
Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)	4.0
Audit reports / evidence pack	4.0
Policy enforcement (guardrails)	1.0
Default deny / secure by default	4.0
Independent verification (continuous)	2.0
Blackbox exposure (ops/control plane)	2.0
Operator access exclusion (workload scope)	0.0
IaC & automation (Terraform/OpenTofu, SDKs, APIs)	4.0
Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)	2.0
Observability (logs/metrics/traces, alerting)	2.0
Limits/quotas (transparency & increase)	2.0
Reference architectures / landing zones	1.0
Unified security stack	1.5
Energieeffizienz / PUE & Zielwerte	4.0
CO₂-/Wasser-Reporting + erneuerbare Energiequellen	3.0

Scope: IaaS

Customer content in the EU: 4.0; Customer-created metadata in the EU: 3.0; Physically & logically separated: 1.0; EU-based operations & support: 2.0; No critical non-EU dependencies: 4.0; Ownership / ultimate parent (EU-owned?): 5.0; Controlling interest & FISA 702 risk (jurisdiction ≠ residency): 5.0; Local contracting entity & EU governance (operational model): 4.0; Independent advisory board: 0.0; EU root CA / trust services: 1.0; BSI C5: 5.0; ISO 27001 / ISMS: 4.0; IT-Grundschutz (BSI): 0.0; SecNumCloud (ANSSI): 0.0; Open standards / API portability: 4.0; Service portfolio depth: 1.9; Geographic footprint & redundancy (regions/AZ/DCs in EU/DE): 4.0; Audit reports / evidence pack: 4.0; Policy enforcement (guardrails): 1.0; Default deny / secure by default: 4.0; Independent verification (continuous): 2.0; Blackbox exposure (ops/control plane): 2.0; Operator access exclusion (workload scope): 0.0; IaC & automation (Terraform/OpenTofu, SDKs, APIs): 4.0; Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s): 2.0; Observability (logs/metrics/traces, alerting): 2.0; Limits/quotas (transparency & increase): 2.0; Reference architectures / landing zones: 1.0; Unified security stack: 1.5; Energieeffizienz / PUE & Zielwerte: 4.0; CO₂-/Wasser-Reporting + erneuerbare Energiequellen: 3.0

Sources / Evidence

Customer content in the EU

Europäische Cloud / EU-Standorte (DE/FI u.a.); Datenresidenz durch Wahl EU-Standorte (stated).

Customer-created metadata in the EU

Deutsche RZ + Finland. ISO 27001 für RZ. Deutsches Unternehmen, nicht CLOUD-Act-unterworfen.

Physically & logically separated

Keine separate 'Sovereign Realm'-Architektur belegt; Standard-Tenant-Isolation/Projekttrennung → TBD (Scope).

EU-based operations & support

Hetzner (DE): Betreiber eigener Rechenzentren (DE/FI) (stated); EU-only Support/Privileged Access nicht öffentlich belegt.

No critical non-EU dependencies

Deutsches Familienunternehmen (Gunzenhausen). Eigene RZ in DE/FI. Nicht CLOUD-Act-unterworfen. BfDI-Aufsicht.

Ownership / ultimate parent (EU-owned?)

Hetzner Online GmbH (DE) (stated).

Controlling interest & FISA 702 risk (jurisdiction ≠ residency)

Hetzner Online GmbH (DE/EU). Kein US-Parent; Risiko extraterritorialer US-Zugriffspflichten deutlich geringer.

Local contracting entity & EU governance (operational model)

Contracting entity: Hetzner Online GmbH (DE); Governance nach EU/DE Recht (stated).

Independent advisory board

Kein unabhängiges Advisory Board dokumentiert. Familienunternehmen.

EU root CA / trust services

Keine spezifische Dokumentation zu EU Root CA / Trust Services.

BSI C5

BSI C5 Type 2 zertifiziert (stated); Zertifikat/Report-Link verfügbar.

ISO 27001 / ISMS

ISO/IEC 27001:2022 zertifiziert; Zertifikat öffentlich verlinkt (stated).

IT-Grundschutz (BSI)

Fokus auf ISO 27001; keine IT‑Grundschutz-Zertifizierung genannt (stated).

SecNumCloud (ANSSI)

Kein SecNumCloud-Status öffentlich belegt → TBD.

Open standards / API portability

S3-kompatibles Object Storage + Terraform Provider (hcloud) (stated).

Service portfolio depth

IaaS/Hosting-Fokus (Compute, Storage, Networking); begrenzte PaaS-Breite vs. Hyperscaler (stated).

Geographic footprint & redundancy (regions/AZ/DCs in EU/DE)

Mehrere europäische Standorte/Regionen – Redundanz je Setup/Region (stated).

Audit reports / evidence pack

ISO-Zertifikat öffentlich, weitere Nachweise (z.B. C5) verlinkt (stated).

Policy enforcement (guardrails)

Policy Enforcement schwach: API-Tokens nur grob (read/read-write) je Projekt; kein fein-granulares RBAC/Org-Policy belegt.

Default deny / secure by default

Firewall: ohne Regeln werden inbound Connections blockiert; outbound ist standardmäßig erlaubt (teilweise secure-by-default).

Independent verification (continuous)

ISO/ISMS vorhanden (periodisch); keine Continuous/maschinenlesbare Verification öffentlich belegt.

Blackbox exposure (ops/control plane)

ISO 27001 für RZ. Begrenzte öffentliche Ops-Dokumentation. Self-Service-Fokus.

Operator access exclusion (workload scope)

Kein Confidential Computing-Angebot. IaaS-Fokus mit Standard-Isolation.

IaC & automation (Terraform/OpenTofu, SDKs, APIs)

Terraform Provider (hcloud) + API Docs; Automatisierung gut möglich (stated).

Everyday SDLC/DevOps (CI/CD, registry, secrets, K8s)

Kern-IaaS; DevOps-Bausteine (Registry/Secrets) nicht als integrierte Suite belegt → ggf. extern/DIY.

Observability (logs/metrics/traces, alerting)

Basis-Monitoring je Service; End-to-End Observability Suite nicht belegt → ggf. extern/DIY.

Limits/quotas (transparency & increase)

Limits im Console‑„Limits“-Tab einsehbar; Limit‑Increase per „Request change“; API Rate‑Limits dokumentiert (partial).

Reference architectures / landing zones

TBD.

Energieeffizienz / PUE & Zielwerte

Veröffentlicht durchschnittlichen PUE (z. B. Ø ~1.13) und Effizienzmaßnahmen; keine offiziellen Targets ausgewiesen. (Quelle: Hetzner Sustainability)

CO₂-/Wasser-Reporting + erneuerbare Energiequellen

100% Strom aus Wasserkraft (Angabe) + Maßnahmen (z. B. wasserfreie Kühlung); kein umfassendes Carbon/Wasser-Reporting (Scopes) in Quelle. (Quelle: Hetzner Sustainability)

Service catalog (core/security)

Expand to load the service catalog …