netcup
A single roll-up of ownership and CLOUD Act exposure.
-
EU-Sovereign EU/EEA/Switzerland-owned and -operated, with no identified CLOUD Act exposure.
-
EU-Based This listing EU-operated, with at most minor or transient US exposure.
-
EU-Hosted EU hosting available, but a US parent or hyperscaler sub-processor creates material exposure.
-
US-Linked Operated by a US-incorporated entity, directly subject to US jurisdiction.
German budget VPS and dedicated-server host (netcup GmbH, Karlsruhe; part of Austria's founder-owned Anexia group since 2016); ISO 27001/27701; from €1.84/month.
netcup is a European service hosted in Germany, with at most minor, transient US exposure under the CLOUD Act. It is listed under Cloud & hosting.
Assessment notes
netcup GmbH (Karlsruhe, HRB 705547 Amtsgericht Mannheim, part of the Austrian founder-owned Anexia group since 2016, no US-PE or VC in the ownership chain) is ISO 27001 / 27701 / 9001 / 14001 certified with EU-primary hosting in Nuremberg, but the DPA is only generated per-customer inside the login-gated Customer Control Panel rather than published as a standalone public document, and the privacy policy names OpenAI Ireland Ltd (support chat, with an explicit USA transfer) among its sub-processors: the account-gated DPA caps the score at 4/5 per the directory's DPA-accessibility rule.
Findings
- CLOUD Act
- CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor This listing A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
-
- Ownership
- Ownership
Where ultimate control over the operating company sits.
-
EU-owned This listing EU-incorporated and EU-controlled; no significant US ownership.
-
EU HQ, US-funded EU-headquartered but US venture- or PE-controlled.
-
EU subsidiary, US parent European operating company owned by a US parent company.
-
US-owned The operating company itself is US-headquartered.
-
Other A non-EU jurisdiction. Swiss/EEA-owned vendors count as European here; the UK and others do not.
-
- Sub-processors
- — not disclosed
Verified signals
-
EU / adequacy hosting: Yes
-
EU / adequacy operator: Yes
-
No US CLOUD Act exposure: Not assessed
-
Public DPA: Yes
-
Sub-processors disclosed: No
-
Open-source clients: No
-
Third-party certification: Yes
Jump to
About netcup
netcup is a German VPS, dedicated-server, and web-hosting provider operated by netcup GmbH (Emmy-Noether-Straße 10, 76131 Karlsruhe; HRB 705547 at Amtsgericht Mannheim; VAT DE262851304; managing directors Oliver Werner and Alexander Windbichler). The company traces back to a sole proprietorship run by Felix Preuß, was incorporated as netcup GmbH in 2008, and has been part of the Austrian Anexia group since November 2016. Anexia Holding GmbH (Klagenfurt, Austria) is wholly owned by its founder, Alexander Windbichler, with no private-equity or venture-capital investor identified on the cap table; both companies stated at the time of the acquisition that netcup would keep operating its own German infrastructure as a distinct brand. netcup reports more than 200,000 customers. The product line covers vServer (Lite, x86, ARM64), Root Server dedicated hardware on AMD EPYC, a vGPU line, server-attached block and backup storage, Managed Server and Managed Cloud Cluster (netcup's own in-house virtualization platform, not a managed Kubernetes offering), web hosting, and domain registration and reselling.
For an EU-sovereignty audit the picture is mixed but net-positive. netcup holds ISO/IEC 27001 (information security), ISO/IEC 27701 (privacy information management), ISO 9001, and ISO 14001, all audited by TÜV Nord since 2023, and covering the netcup, Anexia, and DATASIX group entities together. The company operates five customer-selectable data-centre locations: Nuremberg (Germany, the flagship, marketed as fully GDPR-compliant) and Vienna (Austria) are EU; Amsterdam (Netherlands) is EU; Manassas, Virginia (USA) and Singapore are not. Customers who don't pin their order to an EU location can end up on US or Singaporean infrastructure under netcup's own brand, not through a third-party reseller. netcup's own "Digital Sovereignty" marketing page states that customer data "is not subject to laws such as the CLOUD Act or the Patriot Act," a blanket claim that sits awkwardly next to the company's own Manassas facility and is less specific than the explicit per-facility court-jurisdiction commitments some EU competitors publish; this directory records the exposure as minor rather than none on that basis. The privacy policy also names OpenAI Ireland Ltd, with an explicit transfer to the USA, as a processor for AI-assisted support chat, alongside Stripe (Ireland, with its own sub-processors in third countries) for identity checks and PayPal (Luxembourg) for payments; these touch the support and billing layer, not customer VM workloads. A Data Processing Agreement under Art. 28 GDPR is offered at no extra charge but is generated per customer inside the login-gated Customer Control Panel rather than published as a static, publicly readable document, and no standalone public sub-processor registry was found.
Pricing is the headline differentiator: the cheapest vServer Lite tier (piko) starts at €1.84/month including 19% VAT on standard monthly billing with no minimum term advertised; the standard VPS 500 line starts at roughly €5.91/month (or €0.010/hour on pure hourly billing), and Root Server dedicated hardware and vGPU instances are priced separately. Infrastructure-as-code support exists only through unofficial, community-maintained Terraform providers (not a netcup-published provider), so iac_terraform is recorded as false. Best fit: indie developers, small SaaS builders, and prosumers who want low-cost, German-branded infrastructure with EU location pinning and don't need enterprise-grade compliance certifications such as BSI C5 or SecNumCloud. Procurement-grade buyers needing a stricter EU-only compliance posture should prefer Hetzner, OVHcloud, Scaleway, or STACKIT, listed above in this category.
Sub-processor map · not disclosed
Frameworks & certifications
Capability matrix
Table 1Capabilities of netcup
Integration & access
Compliance & governance
Pricing & tiers
Public documents
Alternatives in this category
-
Finland · $5/moEU-HostedCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material This listing US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
-
Italy · €1.99/moEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: No Open source: No -
-
SwedenEU-SovereignCLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
-
None This listing EU operator, no US parent, no US sub-processors of note.
-
Minor A transient US sub-processor (CDN, maps); data at rest stays in the EU.
-
Material US parent, or a core sub-processor is a US-owned hyperscaler.
-
Direct The operator itself is US-incorporated.
Public DPA: Yes Sub-processors: Yes Open source: No -
| Product | Sovereignty | CLOUD Act | Signals | From |
|---|---|---|---|---|
Aiven
Finland
|
EU-Hosted | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
$5/mo |
Aruba Cloud
Italy
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: No
Open source: No
|
€1.99/mo |
Cleura
Sweden
|
EU-Sovereign | CLOUD Act exposure
How exposed customer data is to US authorities under the CLOUD Act (Clarifying Lawful Overseas Use of Data Act).
|
Public DPA: Yes
Sub-processors: Yes
Open source: No
|
— |