Hetzner
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign This listing EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
Hetzner Online GmbH
Family-founded German hyperscaler alternative (1997), EU DCs in Falkenstein, Nuremberg, Helsinki; ISO 27001 + BSI C5 Type 2; from €5.49/month.
Hetzner is an EU-owned service hosted in Germany, with no identified CLOUD Act exposure. It is listed under Cloud & hosting.
Assessment notes
Hetzner Online GmbH (Gunzenhausen, family-founded by Martin Hetzner in 1997, fully private and German-controlled) is the directory's reference EU hyperscaler alternative: ISO 27001 + BSI C5 Type 2 certified, customer infrastructure can be pinned to EU-only data centres in Falkenstein, Nuremberg, or Helsinki, the company explicitly accepts authority access only from German or Finnish courts for those facilities, and the on-account DPA is freely available with sub-processors named publicly: EU-owned, EU-hosted, with no CLOUD Act exposure for EU-region customers.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- 1 · 0 US
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Yes
-
Public DPA: Yes
-
Sub-processors disclosed: Yes
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About Hetzner
Hetzner Online GmbH is the reference EU hyperscaler alternative on this directory and the most-cited "EU-incorporated EU-controlled" hosting provider in the broader sovereignty conversation. Founded in 1997 by Martin Hetzner and still family-controlled, the company operates from Industriestr. 25, 91710 Gunzenhausen, Germany, with a Data Protection Officer reachable at data-protection@hetzner.com. The product surface covers dedicated servers (EX/AX/RX/SX/GPU lines), cloud servers, web hosting, managed servers, object storage, storage boxes, Storage Share (Nextcloud), DNS, SSL, load balancers, and domain registration. Pricing from €5.49 per month for small cloud VMs, with cloud-cost benchmarks claimed at 10–12× cheaper than AWS / Azure / GCP for comparable configurations.
For procurement-grade EU buyers the compliance posture is the strongest in this directory. Hetzner is ISO/IEC 27001:2022 certified (certificate issued by SOCOTEC Certification Deutschland, which replaced TÜV Rheinland as the certification body) and holds BSI C5 Type 2 (the German government's cloud-security catalogue) alongside the "Bayerns Best 50" and ECO Awards. The privacy policy (last updated 16 Apr 2025) commits that customer data for non-cloud products is processed and stored "exclusively within the EU," that EU-region cloud customers' data stays in Europe, and (most importantly for CLOUD Act analysis) that Hetzner only accepts authority requests for the Falkenstein and Nuremberg facilities from German authorities and courts, and for the Helsinki facility from Finnish authorities and courts. US and Singapore data centres exist (Oregon, Virginia, Singapore) and require international legal cooperation before EU-stored customer data can be accessed; customers fully control which region their workload runs in.
The US-resident sub-processors that appear on Hetzner's privacy policy, Kapa.ai (US, AI chatbot on the corporate website), OpenAI OpCo LLC (US) and Google Analytics (US, marketing-site analytics), touch the hetzner.com marketing surface, not customer workloads. Other named sub-processors are EU (Brevo DE, Computop Paygate DE, Rexx Systems DE, iDenfy LT, Intrum DE). The DPA / AVV can be concluded directly inside the customer account with a checkbox, no handwritten signature required, and Hetzner explicitly states that customer master data (payment details, etc.) is not shared with overseas subsidiaries. Best fit: every EU procurement-grade buyer in this directory who controls their own hosting choice; Hetzner is also the named hosting provider for Plausible, Pirsch, GoatCounter, and the recommended self-host target for Matomo, Plausible, Tripetto SDK, and others.
Sub-processor map · 1
-
Hetzner Finland Oy EUFinland
Building rental and technical support for the Finland (Helsinki) region (Hetzner group entity)
| Vendor | Country | Purpose | Owner |
|---|---|---|---|
| Hetzner Finland Oy | Finland | Building rental and technical support for the Finland (Helsinki) region (Hetzner group entity) | EU |
Source: the vendor’s published sub-processor list, read 26 Aug 2026.
Frameworks & certifications
Capability matrix
Table 2Capabilities of Hetzner
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |