Web Hosting
Hetzner Cloud
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Hetzner Online GmbH · www.hetzner.com
Compare with netcup VPS → Compare with DigitalOcean Droplets → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Hetzner Cloud at a glance
- Vendor
- Hetzner Online GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Hetzner Cloud 2.5/5, the mean of 6 judges. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
No written verdict for this product
The panel scored Hetzner Cloud, but the summary our synthesizer wrote did not survive our own contradiction check — twice. Rather than print a paragraph we cannot stand behind, we print none. Every score, rationale and source below is unaffected; read them and draw the conclusion yourself.
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 2 of 5 |
| Control panel, WordPress & developer tooling | 3.5 of 5 |
| Security, backups & recovery | 3 of 5 |
| Scaling, migration & exit | 2 of 5 |
| Support, domains & email | 2 of 5 |
| European sovereignty | 3.5 of 5 |
Performance, uptime & infrastructure
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
There is a public status page with full incident history, a maintenance planner down to individual data-centre halls, and per-product email notifications — transparency I genuinely value. Own data centres in Falkenstein, Nuremberg and Helsinki are named, and backups and snapshots are stored in a different data centre. We found no public information on resources per tariff, PHP versions, caching, a CDN or an uptime commitment with credits, so I cannot judge what sixty client sites would actually run on. 9 13 18
The Small-Business Owner
There is a public status page with dated incidents and maintenance entries down to individual data centres, and European cloud locations in Falkenstein, Nuremberg and Helsinki are named. But we found no public information on processor, memory or storage per tariff, on caching or PHP handling, or on any uptime guarantee, so I cannot see what I am actually buying in performance terms. 9 13 3
The Shop Operator
There is a public status page with incident history and maintenance notices down to individual data centres, and the WordPress app ships with Let's Encrypt support; for a Black Friday weekend I would lean on the documented load balancers, floating IPs and volumes. But the captured pages show no CPU or RAM per tariff, no caching, no PHP versions and no uptime guarantee, so the resources underneath my shop remain invisible to me from public evidence. 3 5 9 17
The Freelance App Developer
The WordPress app image proves real sites run here, and there is a public status page with incident history, planned maintenance notices and email notification of status reports. But the captured pages state no CPU, RAM or storage figures per server type, no PHP version handling, and no uptime target or SLA, so I can't size a client's project from them. 3 9 17
The Data Protection Officer
A public status page with incident history and scheduled maintenance selectable by data centre is documented, including resolved outages and current work on core routers. We found no public information on per-tariff resources, an uptime target or an SLA with service credits, caching, PHP versions or a CDN in the captured pages. 3 9
The Skeptic
Websites demonstrably run here — a ready-to-use WordPress app with MySQL and Apache is documented — and there is a genuinely public status page with incident history, scheduled maintenance by data-centre selector and subscribable email notifications. But the product is stated to be unmanaged, and we found no public information on the captured pages about resources per tariff, any uptime target, an SLA paying a credit, or the hardware and storage architecture behind it. A real platform with named locations, and no numbers. 9 3 17 13
Control panel, WordPress & developer tooling
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
A console plus a documented REST API and a command-line tool covering servers, volumes, firewalls, private networks, load balancers and DNS is exactly the automation my team could build on, and WordPress ships as a one-click app with MySQL, Apache2 and Let's Encrypt. Projects, restricted users with permissions, and handing a cloud server or snapshot to another person's project are documented. We found no public information on staging with push to live, automatic updates with rollback, or an agency view with client billing handover — the things my WordPress maintenance day is made of. 3 5 16 17 20
The Small-Business Owner
The console, a ready WordPress image with MySQL and Apache, snapshots, cloud firewalls and a documented API with a command-line tool are all there for the technically minded. But the pages say WordPress is preinstalled and not enabled, with setup through an SSH key or root password, and we found no public information on a guided one-click flow, staging, automatic updates or an agency view — as a non-technical owner I would be lost the first day. 17 3 5 16 18 20
The Shop Operator
The Hetzner Console, a ready WordPress image including MySQL and Apache2, and a documented REST API with the hcloud command line plus Go and Python libraries covering servers, load balancers, volumes, firewalls, floating IPs and DNS give me real control as a hands-on operator. Snapshots are manageable with user permissions, and project members can be invited per project. I found no public information on staging environments, Git deployment, managed updates or agency and client-management features. 3 5 16 17 18 20
The Freelance App Developer
This is how I like to work: a versioned REST API plus the hcloud CLI covering servers, load balancers, volumes, firewalls, floating IPs, placement groups and DNS, with Go and Python libraries alongside, and root login by SSH key or password documented on the WordPress app — I can script a whole client stack from that. Below the top because Git deployment, Composer and staging flows are not documented on the captured pages, roles only appear as "restricted users and users with role above that", and there is no agency or white-label view. Server, Storage Box and domain transfers between accounts are documented, which is what I need to hand a project to a client. 5 16 17 18 20
The Data Protection Officer
The console deploys one-click apps including a ready-to-use WordPress with MySQL and Apache, alongside Coolify, Docker CE and GitLab CE, and covers snapshots, firewalls, volumes, private networks and placement groups. A documented API for servers, load balancers, volumes, firewalls, floating IPs, placement groups and DNS comes with the hcloud command line tool and Go and Python libraries, plus separate APIs for dedicated servers and storage boxes. Projects support member invitations with role-based permissions over backups and snapshots, and servers, snapshots, storage boxes and domains can be transferred to other customers; we found no public information on managed automatic updates, staging environments or Git deployment. 3 5 17 18 20
The Skeptic
A documented console, a REST API covering servers, load balancers, volumes, firewalls, floating IPs and DNS, plus a command-line tool and Go and Python libraries — tooling you can script, not just click. One-click apps including WordPress, snapshots movable between projects, snapshot protection, restricted project members and token-based transfers complete a solid picture. We found no public information on staging copies, Git deployment workflows, audit logs or single sign-on, which keeps it below the top tier. 5 16 3 17 18 20
Security, backups & recovery
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
Daily backups with seven slots per server, manual snapshots that never auto-delete and survive server deletion, restore by rebuild or as a duplicate server, cloud firewalls and free certificates via Let's Encrypt are documented, and snapshots sit in a different location. Restores are whole-server only, and we found no public information on point-in-time restore of single files, databases or tables, on malware scanning or cleanup, a web application firewall, two-factor login, or an ISO 27001-type certification. One page also describes these cloud servers as unmanaged products with backup setup the customer's responsibility, so my staff own that discipline. 4 13 17 18 19
The Small-Business Owner
Backups are toggleable per server, run daily into seven slots, are stored encrypted — one page states fourteen days' retention while another describes automatic deletion of the oldest copy when the slots fill — and I could rebuild a whole server from a backup or snapshot myself, with cloud firewalls and a yearly TÜV Rheinland audit of the technical measures also documented. The product is stated to be unmanaged, meaning I set up and answer for the backups myself, and we found no public information on malware scanning, two-factor login, DDoS protection or single-file restore — nobody here would restore a broken WordPress site for me. 4 18 13 19 17
The Shop Operator
Daily encrypted backups kept 14 days with seven slots per server, on-demand snapshots that survive server deletion, restore to any location by rebuilding the server, cloud firewalls and technical measures audited yearly by TÜV Rheinland are documented. For my worst case the picture is thinner: only whole-disk restore is described, not a restore of single files, databases or tables within the hour, and a data-protection page tells cloud customers that backups are theirs to set up on these unmanaged servers. I found no public information on malware scanning, a web application firewall, DDoS protection or two-factor login. 4 13 17 18 19
The Freelance App Developer
Backups are opt-in per server — the data-protection documentation says cloud servers are unmanaged and setting up backups is the customer's responsibility — with daily copies into seven rotating slots, on-demand snapshots (thirty across all projects, protectable against deletion, kept until I delete them), restore by rebuild or duplicate into any location, and Cloud Firewalls documented; copies land in a different data centre or location. The captured pages give different figures for retention (fourteen days encrypted on the data-protection page, seven rotating slots in the backup documentation), restore is whole-image only, and we found no public information on two-factor login, malware scanning, a web application firewall or ISO 27001 certification; the technical and organizational measures are audited annually by TÜV Rheinland. 4 13 18 19
The Data Protection Officer
Daily encrypted server backups with 14-day retention across seven slots, manual snapshots that survive server deletion, restore by rebuilding the server or creating a duplicate in any location, and cloud firewalls are documented, and the technical and organisational measures are audited annually by TÜV Rheinland. The vendor states that cloud servers are unmanaged products and that setting up backups is the customer's responsibility, and restore is at the level of the whole server rather than single files or databases. We found no public information on a web application firewall, malware scanning or cleanup, DDoS protection, two-factor login to the panel, or an ISO 27001 or BSI C5 certification. 4 13 18 19
The Skeptic
Daily automated backups with seven slots per server, fourteen-day encrypted retention, and on-demand snapshots that survive server deletion and land in a different location — but note the small print: attached volumes are excluded from backups and snapshots, and the vendor recommends powering the server off to get a consistent copy. Restore is rebuild-or-duplicate of the whole server; we found no public information on point-in-time, single-file or single-database recovery, a web application firewall, malware scanning, panel two-factor login or a hosting certification. The vendor is blunt that cloud servers are unmanaged and backups are the customer's responsibility, which I respect and count accordingly. 4 18 13 19 17
Scaling, migration & exit
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
Handovers are documented: a cloud server moves to another person's project, domains transfer via a token valid seven days, storage boxes move between shared projects, and a backup or snapshot rebuilds into a server in any location — genuinely useful when I hand a finished project to a client. Volumes and load balancers in the API give growth headroom. We found no public information on changing tariffs without a migration, a migration service from another host, complete export of data, or the cancellation terms. 3 18 20
The Small-Business Owner
Moving things around is genuinely documented: cloud servers between projects, domains by a transfer token valid for seven days, storage boxes and rack space, and a backup can rebuild the server in any location, with volumes bookable separately. But we found no public information on tariff limits, a migration service from my old host, export of mail, cancellation periods or what happens to my data after the contract ends. 20 18 3
The Shop Operator
Backups and snapshots can create a server in any location, so growth or a move is at least technically open, and limits such as seven backup slots per server and thirty snapshots are published. Domains transfer out by token valid seven days, cloud servers move between projects, and the vendor will manually transfer domain registrations only as a goodwill gesture, with the data left for me to move. I found no public information on tariff changes without a migration, a migration service from another host, full export or cancellation terms. 3 4 18 20
The Freelance App Developer
Portability is genuinely documented: a backup or snapshot can create a new server in any location, snapshots move between projects, and there are documented transfers for cloud servers, Storage Boxes, rack space and domains (domain tokens valid seven days). What the captured pages don't show is tariff up- or downgrades, a migration service in from another host, the cancellation period, or per-tariff limits — the only numeric limits I found (seven backup slots, thirty snapshots) describe the backup system, not the tariffs. 4 18 20
The Data Protection Officer
The servers run standard open stacks such as WordPress with MySQL and Apache under full root access, snapshots and backups restore to any location and move between projects, and domain transfer out is documented via a token valid for 7 days, with servers, storage boxes and rack space transferable between customers. We found no public information on cancellation periods, deletion of data after the contract ends, a migration service from another host, or scaling resources without moving the server. 17 18 20 21
The Skeptic
A snapshot can be turned into a new server in any location, and token-based transfers of cloud servers, domains, storage boxes and rack space between customers are documented — real doors, though the domain move is stated as registrations only with the data left to move yourself, and a vSwitch is documented as not transferable at all. Beyond that we found no public information on the captured pages about resizing a server in place, tariff and resource limits, a migration service from another host, or cancellation and data-deletion terms. The exit hinges entirely on you building your own images. 18 20 4
Support, domains & email
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
Support opening hours are documented, a community forum exists, and customers can subscribe to status email notifications; mailboxes in the konsoleH panel offer configurable storage and per-email size limits, forwarding copies, per-mailbox spam filters over global black- and whitelists, retention settings and webmail — a solid mail feature set for client addresses. We found no public information on support channels such as phone or chat, response times, help with hacked or broken sites, or an agency and partner programme. 5 9 15 23
The Small-Business Owner
Mailboxes are documented in welcome detail — webmail, per-mailbox spam filters and blacklists, storage limits, password resets — with DNS manageable through the API and email notifications for status reports. But for someone who needs a German speaker on the phone the same day, we found no public information on phone or chat support, on hours, languages or response times; the captured pages show a community forum and the existence of an opening-hours page, nothing more. 23 5 15 9
The Shop Operator
Mailboxes are documented in real detail — storage and per-email limits, spam filtering with per-mailbox overrides, webmail, forwarding and retention settings for spam and trash — and a Support Team opening-hours page, help centre, community forum and status page exist, with domains transferable in the same account. What decides it for a shop: response times, phone or chat channels and technical depth for a shop system or a hacked site are not shown on the captured pages. 5 15 20 23
The Freelance App Developer
The help documentation is broad, there is a community forum, and mailbox features are documented in real depth — storage and per-email size limits, spam filters with per-mailbox overrides, retention settings, forwarding copies, expiration dates — with domains and DNS manageable in the same account world. The gap is the humans: a documentation page titled "Support Team opening hours" exists, but the captured pages don't state the hours, the phone or chat channels, or any response times. 5 15 23
The Data Protection Officer
A searchable documentation centre, a community forum, email notifications for product status reports and a documented topic on support opening hours exist, and mailboxes are documented with configurable storage and per-email size and count limits, per-mailbox spam filtering, forwarding to additional addresses, retention settings and webmail, alongside domain handling. We found no public information on support channels such as phone or chat with stated hours, response times, help with hacked sites, a premium support tier or a partner programme. 5 9 15 20 23
The Skeptic
A help centre, a community forum, a status page with email subscriptions and a documented support-team opening-hours page exist, and the managed-side mailboxes come with configurable storage and email-count limits, per-mailbox spam filters, retention settings and webmail. What we did not find on the captured pages: the support channels themselves, any stated response times, technical-depth promises or a partner programme. Documentation is not a promise of help. 15 5 9 23
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
Cloud locations Falkenstein, Nuremberg and Helsinki run in Hetzner's own data centres under the German Hetzner Online GmbH, with a published data processing agreement and subprocessor list, an annual TÜV Rheinland audit of the technical measures, EU-only processing of customer master and billing data, and backups remaining in the EU for EU locations. Authority requests for the German sites are accepted only from German courts, Finnish for Helsinki, with no direct US or Singapore authority access to EU server data; server data reaches a third country only if the customer actively picks the US or Singapore location, and the vendor states this openly. We found no public information on data-centre certifications such as ISO 27001 or BSI C5, and the subprocessor locations themselves are not shown. 11 13
The Small-Business Owner
This is the strongest part for a German small business: Hetzner Online GmbH in Gunzenhausen as the contracting partner, cloud locations in Falkenstein, Nuremberg and Helsinki, backups and customer data staying in the EU for EU locations, a published data processing agreement under Article 28, a public list of subcontractors, and only German or Finnish authorities accepted for the European data centres. What keeps it off the top marks: the subcontractor list's own locations and certifications such as ISO 27001 are not shown on the captured pages — the pages document an annual TÜV Rheinland audit of the technical measures instead — and the customer can actively choose US or Singapore locations for the server data. 11 13 9
The Shop Operator
The chain is provably European where I need it: Hetzner Online GmbH in Gunzenhausen stays the contracting entity even for the optional US and Singapore locations, the EU cloud locations Falkenstein, Nürnberg and Helsinki run in the company's own data centres, master and billing data stay in the EU, and with an EU location the backups stay in the EU too. A subprocessor list, an Art. 28 data processing agreement and technical measures audited annually by TÜV Rheinland are published, and only German or Finnish authorities with a valid court order reach the EU data centres. What I did not find: ISO 27001 or BSI C5 certification with its scope on the captured pages. 9 11 13 18 19
The Freelance App Developer
A strong chain: Hetzner Online GmbH in Gunzenhausen is the contracting entity, EU locations are named (Falkenstein, Nürnberg, Helsinki) in own data centres, master and billing data stay in the EU, backups stay in the EU for EU locations, an Art. 28 GDPR data processing agreement and a subprocessor list are published, the technical and organizational measures are audited annually by TÜV Rheinland, and only German or Finnish authorities with a valid court order are accepted for those data centres. Held below the top because US and Singapore locations place server data in third-country data centres run by group subsidiaries when the customer chooses them, and we found no public information on ISO 27001 or BSI C5 certification for the data centres. 11 13
The Data Protection Officer
The contracting entity is Hetzner Online GmbH in Gunzenhausen with its own data centres in Falkenstein, Nürnberg and Helsinki; customer, contract and billing data are processed exclusively in the EU, backups stay in the EU when an EU location is chosen, and authority requests for the German sites are accepted only from German courts with a valid order and for Helsinki only from Finnish ones. An Article 28 data processing agreement is published in German and English together with a subprocessor list, master data are not passed to the US subsidiary, only data a customer actively stores on a US or Singapore server reaches those countries, and US or Singaporean authorities have no direct access to EU server contents. The subprocessor list is published without the subprocessors' locations on the pages we read, and we found no public information on an ISO 27001 or BSI C5 certification for the data centres, though an annual TÜV Rheinland audit of the technical and organisational measures is documented with the report available to customers who concluded the agreement. 11 13
The Skeptic
German contracting entity in Gunzenhausen, own data centres named in Falkenstein, Nuremberg and Helsinki, customer master and billing data processed exclusively in the EU, backups of EU-located products staying in the EU, and a plain answer to my favourite question: only German courts for the German data centres, Finnish for Helsinki, and no direct access by US or Singaporean authorities to server contents in the EU. An Article 28 data processing agreement is published and signable in the account with a linked subprocessor list, and the technical and organisational measures are audited annually by TÜV Rheinland. What holds it back: the parent behind Hetzner Online GmbH is not stated on the captured pages, subprocessor locations are not given, and deliberately choosing a US or Singapore location puts the server data in a third country — a documented, opt-in risk. 13 11
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
The only pricing statement we found is a pointer to the info box on the cloud product page, and the sole billing figure anywhere is a notice about one-time billing of outstanding amounts below €10. We found no public information on tariff figures, minimum terms, renewal prices, setup fees or the cost of the backup add-on — for budgeting sixty client sites I could not compute even one server's yearly cost from what is published here. 4 9
The Small-Business Owner
The only pricing statement captured points me to the info boxes on the cloud product page, and we found no public information on actual tariff prices, what is included, minimum terms or VAT treatment in these captures. A billing notice about charging outstanding amounts below €10 confirms postpaid invoicing, but I cannot verify from these pages that the invoice will match a price on the website — for me that is the bare minimum and it is not met here. 4 9 1
The Shop Operator
The captured pages show no prices; the documentation only points to a pricing info box on hetzner.com/cloud, and a billing notice about amounts below €10 is the closest thing to cost information I found. I found no public information on renewal terms, what backups, snapshots or restores cost, add-on pricing or VAT treatment, so for a shop with seasonal spikes I cannot budget a year from what was captured. 4 9
The Freelance App Developer
The only pricing evidence captured is a pointer — pricing info sits in the info box on hetzner.com/cloud — and the captured pages show no price, term, renewal, setup fee, add-on or VAT figure, so I cannot compute a client's three-year cost from them. 1 4
The Data Protection Officer
The cloud documentation directs buyers to pricing in the info boxes on the cloud page, yet the captured pages contain no tariff price, minimum term, setup fee, included services, add-on cost or VAT treatment. We found no public information on renewal prices or cancellation terms in the pages we read. 1 4
The Skeptic
The captured documentation says pricing information sits in the info box on the vendor's cloud page and states no prices itself, and no tariff price, renewal price, minimum term, setup fee, VAT treatment or price for the backup feature ever appears in what we captured. The only figure resembling billing is a notice that outstanding amounts below €10 are billed in a one-time run. A buyer cannot compute the first month's cost, let alone three years, from the captured pages. 4 1 9
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined ⚠ unverified | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Hetzner Cloud
Is Hetzner Cloud European?
Yes. whats-best.ai classifies Hetzner Cloud as EU-Made.
Where does Hetzner Cloud store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does Hetzner Cloud have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Hetzner Cloud?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Hetzner Cloud alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity, Hosting location, Hosting options, Data processing agreement. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 75 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 27 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 19 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 15 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 12 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 hosting facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 8 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 data fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
- The panel’s written verdict is withheld: our own re-read found claims in it that the evidence does not carry, and a second synthesis did not fix them. The scores and the material below are unaffected. Know more? Tell us
Sources (24)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (cloud servers, with pricing) www.hetzner.com Checked 1 Nov 2026 Details →
- 2 Features page (European cloud) www.hetzner.com Checked 1 Nov 2026 Details →
- 3 Documentation (cloud) docs.hetzner.com Checked 1 Nov 2026 Details →
- 4 Documentation (backups and snapshots) docs.hetzner.com Checked 1 Nov 2026 Details →
- 5 API documentation docs.hetzner.cloud Checked 1 Nov 2026 Details →
- 6 Company page (data centres) www.hetzner.com Checked 1 Nov 2026 Details →
- 7 Security / trust page (certification) www.hetzner.com Checked 1 Nov 2026 Details →
- 8 Support page www.hetzner.com Checked 1 Nov 2026 Details →
- 9 Status page status.hetzner.com Checked 1 Nov 2026 Details →
- 10 Legal notice www.hetzner.com Checked 1 Nov 2026 Details →
- 11 Privacy policy www.hetzner.com Checked 1 Nov 2026 Details →
- 12 Terms of service www.hetzner.com Checked 1 Nov 2026 Details →
- 13 Documentation (data protection and DPA) docs.hetzner.com Checked 1 Nov 2026 Details →
- 14 Performance, uptime & infrastructure — found from sitemap www.hetzner.com Checked 1 Nov 2026 Details →
- 15 Performance, uptime & infrastructure — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 16 Control panel, WordPress & developer tooling — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 17 Control panel, WordPress & developer tooling — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 18 Security, backups & recovery — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 19 Security, backups & recovery — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 20 Scaling, migration & exit — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 21 Scaling, migration & exit — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 22 Support, domains & email — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 23 Support, domains & email — found from sitemap docs.hetzner.com Checked 1 Nov 2026 Details →
- 24 Self-hosting / on-premises installation docs — found from the homepage www.hetzner.com Checked 1 Nov 2026 Details →