Web Hosting
netcup VPS
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by netcup GmbH · www.netcup.com
Compare with Hetzner Cloud → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
netcup VPS at a glance
- Vendor
- netcup GmbH
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Not stated on the vendor’s pages as of 1 Nov 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates netcup VPS 2/5, the mean of 6 judges. netcup sells a self-managed virtual-server ladder — vServer Lite, x86, ARM64, Root Server and vGPU — from 8,26 € a month on a 12-month term (VPS 500 G12.5) to 289,46 € (RS 16000 G12.5), both including 19% VAT. how scores are made
- As of
- Vendor pages captured 1 Nov 2026; evaluated by the panel 2 Nov 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
netcup sells a self-managed virtual-server ladder — vServer Lite, x86, ARM64, Root Server and vGPU — from 8,26 € a month on a 12-month term (VPS 500 G12.5) to 289,46 € (RS 16000 G12.5), both including 19% VAT. The bench scored pricing transparency highest, clustering at 7-8 on side-by-side discounted and list prices, and performance and reliability next at 6-7 on hardware named to the generation (AMD EPYC 9645, DDR5, NVMe). Support and service was weakest at 3-4: we found no public information on phone or chat channels, hours or response times. Security and backups scored 4-6, where only customer-triggered snapshots are documented without stated retention. The judges split on sovereignty, 3-6: the skeptic credited the German entity, the appointed data protection officer and ISO 27701, while the app developer, whose captured data-centre page returned an error, recorded no documented server locations; we found no public information on a data processing agreement or subprocessors. The small-business judge scored zero on all seven criteria (weighted total 0.0, against 4.8-5.7 for the others), stating it would have to run the site itself.
Speaks for it
- Pricing transparency drew the highest scores on the bench: every tariff shows discounted and list monthly prices side by side including 19% VAT, with 12-month (−13%) and 24-month (−26%) discounts stated
- Hardware is named to the generation — AMD EPYC 9645, DDR5 RAM, NVMe storage, hardware RAID, redundant power and uplinks — and root servers carry a guaranteed minimum availability of 99.9% in the yearly average
- Block storage extends to 8 TB at 0,012 € per GB excluding VAT without fixed terms, and the 30-day money-back guarantee states its refund formula (the full base fee)
- Full root access on KVM with snapshots, image import and export, and a separately documented REST API keeps the stack portable to another host
- ISO 27001, 27701, 9001 and 14001 certificates are published with their auditors named
Held against it
- Support and service drew the lowest scores; we found no public information on phone or chat channels, hours or response times
- A captured page states that dedicated cores and the 99.9% availability guarantee are not part of the VPS tariffs, and we found no public information on what the guarantee pays when missed
- Only customer-triggered snapshots are documented for recovery, with no stated frequency or retention, and we found no public information on two-factor login to the panel
- The captured data-centre page returned a not-found error, and we found no public information on a data processing agreement or a subprocessor list
- We found no public information on setup fees or snapshot and restore charges, which keeps a three-year total from closing
Best for
- You are a developer or sysadmin who provisions servers over SSH and a documented REST API and wants full root, snapshots and image export for portability
- You size capacity for predictable peaks from stated per-tariff numbers — cores, RAM and NVMe or SSD storage
- You want monthly terms available on a published price ladder including VAT, with a documented 30-day money-back exit
- You run Linux servers and may hand maintenance, security updates, configuration and monitoring to the vendor's experts via the Managed vServer tier
Avoid if
- You need a managed website product — the captured pages describe Root Servers and VPS as self-managed, and we found no public information on one-click installs or staging
- Your tariff is an entry VPS and you depend on dedicated cores or the 99.9% availability guarantee — a captured page states both are not part of the VPS line
- You must document a data processing agreement and the subprocessor chain before signing — the captured pages list further locations in the USA and Singapore, and we found no public information on either
- You rely on the vendor for same-day restores — the captured pages describe the servers as self-managed, and only customer-triggered snapshots are documented
The scores
| Criterion | Panel median |
|---|---|
| Performance, uptime & infrastructure | 3 of 5 |
| Control panel, WordPress & developer tooling | 2.5 of 5 |
| Security, backups & recovery | 2 of 5 |
| Scaling, migration & exit | 3 of 5 |
| Support, domains & email | 1.5 of 5 |
| European sovereignty | 2.5 of 5 |
| Pricing transparency | 3.5 of 5 |
Performance, uptime & infrastructure
panel disagrees
Show reasoningHide reasoning
How this is scored
What runs the sites and how reliably: CPU, RAM and storage per tariff stated, SSD or NVMe storage, current PHP versions and how long old ones are kept, HTTP/2 or HTTP/3, server-side caching (OPcache, Redis, a page cache), a CDN, databases and their limits, resources that are guaranteed rather than shared without a stated limit, an uptime SLA with a service credit, a public status page with incident history, and redundancy of the platform. Where the data centre is located is scored under sovereignty.
0 — Not a hosting product; websites or web apps cannot be run on it.
3 — Storage and a number of sites per tariff are stated and the product is described as fast; resources, PHP versions, caching and uptime are basic or not described.
5 — Resources per tariff stated (CPU or a performance class, RAM, SSD or NVMe storage), several current PHP versions selectable, HTTP/2, server-side caching or a cache plugin documented, free SSL, a stated uptime target, and a public status page.
8 — Dedicated or guaranteed resources stated per tariff, HTTP/3 and a CDN included, Redis or an object cache, PHP versions kept current with an end-of-life policy published, an uptime SLA with a service credit, a status page with incident history, and a redundant platform (replicated storage, failover) described.
10 — Infrastructure documented to the level an operator could audit: hardware generations and storage architecture named, performance measured and published with method, an SLA with credits and exclusions at 99.95 % or above, every incident on the status page with a post-mortem, and scaling without downtime documented.
The Agency Lead
Hardware is documented down to the generation — dedicated AMD EPYC 9645 cores, DDR5 RAM, NVMe or SSD storage, redundant power and uplinks, hardware RAID and a 2.5 Gbit/s network card — with a public status page. The 99.9 % minimum availability guarantee is stated for the Root Server line while the VPS page states it is not included in the VPS tariffs, and no service credit, CDN or HTTP/3 is documented, so it sits above mid-tier but well short of an auditable infrastructure story. 1 2 8
The Small-Business Owner
Every tariff spells out cores, RAM and NVMe or SSD storage, the root-server line adds dedicated AMD EPYC 9645 cores, DDR5 memory, hardware RAID, redundant power and uplinks, and a guaranteed minimum availability of 99,9 %, with a status page alongside. Solid engineering on paper, but the guarantee stops one step below the entry tariffs I would actually buy. 1 2 8
The Shop Operator
Every tariff states its cores, RAM and NVMe or SSD storage, the pages name the AMD EPYC 9645 generation with DDR5 memory, and the platform describes redundant power, redundant uplinks and hardware RAID — enough for me to size capacity before a Black Friday weekend. But the captured pages state that the 99.9 % availability guarantee and dedicated cores are reserved for the Root Servers and not included with the VPS, and I found no public information on service credits, a CDN or incident history on the status page. 1 2 8
The Freelance App Developer
Resources are stated in hard numbers per tariff — dedicated AMD EPYC 9645 cores, DDR5 RAM and NVMe storage on the Root Server line, hardware RAID and a 2.5 Gbit/s network — with redundant uplinks and power claimed, which is the level I want before I park a client's shop there. The 99.9 % availability guarantee is stated for Root Servers while a captured product page says it is not part of the VPS line, and although a public status page exists, we found no public information on a service credit, an incident history or measured performance. 1 2 8
The Data Protection Officer
Every tariff lists cores, RAM and SSD or NVMe storage, the root server line names the AMD EPYC 9645 CPU and DDR5 RAM, and the platform describes redundant uplinks, redundant power and hardware RAID. A public status page exists and root servers carry a 99,9 % guaranteed minimum availability, though the captured pages state explicitly that this guarantee, the satisfaction guarantee and dedicated cores are not included in the VPS line, and we found no public information on SLA credits, a CDN or measured performance figures. 1 2 8
The Skeptic
Hardware is named to a degree few competitors reach — AMD EPYC 9645 cores, DDR5, NVMe storage, hardware RAID, redundant power and uplinks, a 2.5 Gbit/s network card — and the root-server line carries a guaranteed minimum availability of 99.9% in the yearly average. But no captured page states what that guarantee pays when it is missed, and the VPS page itself says the guarantee and dedicated cores are not included in those tariffs; we found no public information on published incident history or measured performance. 1 2 8
Control panel, WordPress & developer tooling
panel disagrees
Show reasoningHide reasoning
How this is scored
How sites are set up and run day to day: the control panel or console, one-click installers for named CMS and shop systems, managed WordPress features (automatic core and plugin updates, staging, cloning, a search-and-replace), SSH, SFTP, Git deployment, Composer, cron jobs, a PHP version and settings per site, databases and phpMyAdmin or an equivalent, log access, a public API and command-line tool, infrastructure-as-code support, team members and roles, and client or project management for agencies. On a cloud server: images, snapshots, firewalls, private networks and the API that manages them.
0 — No documented way to deploy or manage a website on the product.
3 — A control panel with FTP access and a one-click installer for WordPress; SSH, staging, Git, an API and roles are basic or not described.
5 — A control panel with installers for several named CMS, SSH and SFTP, cron jobs, PHP version per site, databases with a web admin, a staging copy or snapshots, team members with access rights, and log files available — or, for a cloud server, a console with images, snapshots, a firewall and a documented API.
8 — Managed WordPress or app tooling (automatic updates with rollback, one-click staging and push to live, cloning), Git deployment and Composer documented, a public REST API and CLI covering sites, databases, domains and backups, granular roles per project, and an agency view with client projects, transfer of ownership and white-label or reseller options.
10 — A platform that scales across an agency or a development team: everything in the panel available through a versioned API, CLI and an infrastructure-as-code provider, preview environments per branch, audit logs of every change, SSO for the team, and projects that can be handed to the client with billing transferred.
The Agency Lead
The Server Control Panel covers start/stop, preconfigured images, snapshots with image import and export, a remote console, SSH with full root access and an API — a proper raw-server toolkit. We found no public information on staging, one-click CMS installs, team roles or client handover, so for my sixty WordPress and TYPO3 sites we would build and staff that entire layer ourselves. 1 2
The Small-Business Owner
For a server product this is what I would expect: a Server Control Panel for start, stop, reboot, snapshots, a VNC console and traffic statistics, full root access, image import and export, and a documented REST API. I found no public information on one-click WordPress installs, staging copies or database administration in a panel — on this product I would have to run the site myself, which is exactly what I cannot do. 1 2 3
The Shop Operator
The Server Control Panel covers start, stop and reboot, image deployment, snapshots, a VNC console and SSH, with a documented REST API, image import and export and full root access — a proper server console for a shop sysadmin. I found no public information on firewalls, private networks, or managed app tooling such as staging environments or CMS installers. 1 2 3
The Freelance App Developer
For someone who sets servers up from scripts rather than by clicking, this is workable: full root access over SSH, a panel that starts, stops and reboots, mounts images, takes snapshots and opens a VNC console, image import and export, a REST API with its own documentation page, and an optional managed Linux tier. We found no public information on a command-line tool, team roles, or a firewall managed through the panel. 1 2 3
The Data Protection Officer
The Server Control Panel covers start, stop and reboot, image deployment, snapshots, a VNC console, traffic statistics and SSH with full root access, and an API with remote console is advertised and separately documented. We found no public information on staging environments, Git deployment, team roles or client and agency management — this is a self-managed server, and the site operations tooling sits with the customer. 1 2
The Skeptic
The Server Control Panel documents start, stop and reboot, images, snapshots, traffic statistics, a VNC remote console and SSH, with a documented REST API, image import and export, and full root access; a managed tier hands maintenance, security updates and monitoring to the vendor's experts. We found no public information on firewalls, private networks, team roles, or any agency or client view. 1 2 3
Security, backups & recovery
panel disagrees
Show reasoningHide reasoning
How this is scored
How the sites are protected and how fast they come back: isolation between customers (containers, separate PHP processes, chroot), free SSL with automatic renewal, a web application firewall, malware scanning and cleanup, DDoS protection, two-factor login to the panel, brute-force protection, backup frequency and retention, off-site or geo-redundant backup copies, self-service restore of files and databases from a point in time, restore of single sites or tables, security updates handled by the vendor on managed tariffs, and security certifications (ISO 27001, BSI C5, SOC 2) with their scope.
0 — No backups and no security measures described, and the customer is told to secure the site entirely on their own.
3 — Free SSL and some backup exist; frequency, retention, restore and the security measures are basic or not described.
5 — Free SSL with automatic renewal, daily backups with a stated retention, restore by the customer in the panel, account isolation described, DDoS protection, two-factor login to the panel, and malware scanning or a firewall offered.
8 — Backups several times a day or on demand with retention of 14 days or more, stored in a second location, point-in-time restore of single files, databases or sites, a web application firewall and malware cleanup included, isolation per site stated, and an ISO 27001 or equivalent certification of the hosting operation published.
10 — Recovery that can be evidenced: backup and restore times stated and tested, immutable or off-provider backups, recovery objectives (RPO and RTO) published, a security incident process and disclosure policy, certifications with their scope and audit reports available, and penetration test results or a bug bounty programme.
The Agency Lead
DDoS protection, KVM-based isolation, hardware RAID and ISO 27001 plus ISO 27701 certifications with named auditors and annual audits are published, and snapshots with image import and export give a recovery path. Backup frequency and retention, point-in-time restore, two-factor login and malware or firewall services are not described on the captured pages, which for me is the difference between a snapshot and a restore I can hand a client. 1 2 6
The Small-Business Owner
DDoS protection is included, snapshots with image import and export exist, and the vendor publishes ISO 27001, ISO 27701, ISO 9001 and ISO 14001 certificates validated yearly. I found no public information on backup frequency, retention, a self-service restore, malware cleanup or a web application firewall — as someone who needs a backup the support can restore the same day, that decides it for me. 1 2 6
The Shop Operator
DDoS protection is included and ISO 27001, 27701, 9001 and 14001 with annual TÜV Nord audits and downloadable certificates are published, which speaks for the operation itself. For my worst case — getting yesterday's database back within the hour — only snapshots are documented with no stated frequency, retention or self-service point-in-time restore, and I found no public information on SSL certificates, malware scanning or a web application firewall; the servers are described as self-managed products. 1 2 6 8
The Freelance App Developer
DDoS protection is included on every vServer, isolation comes from KVM with the customer holding full root, and snapshots give me a rollback path I trigger myself. The operation is ISO 27001 certified since 2023 with annual TÜV Nord validation, plus ISO 27701, and the certificates are downloadable; we found no public information on two-factor login to the panel, backup retention or malware scanning. 1 2 6
The Data Protection Officer
ISO 27001 and ISO 27701 have been certified since 2023 with annual validation by TÜV Nord, DDoS protection is included, and the KVM basis with hardware RAID provides virtualization isolation, plus customer-created snapshots. However, the products are self-managed, and we found no public information on a backup service with stated frequency or retention, restore procedures, SSL, a web application firewall or two-factor login to the panel. 1 2 6
The Skeptic
Snapshots and image export give the customer a self-service restore point, DDoS protection is included, and the ISO 27001 and ISO 27701 certificates are published with their auditors and yearly validation. What I could not find anywhere: how long a snapshot is kept and where it is stored, and we found no public information on two-factor login to the panel or on malware scanning and cleanup. 1 2 6
Scaling, migration & exit
panel disagrees
Show reasoningHide reasoning
How this is scored
What it takes to grow and what it takes to leave: tariff changes up and down without a migration, resource limits stated rather than "unlimited" with a fair-use clause, add-on resources, the path from shared hosting to a server or cluster within the same vendor, a free or paid migration service from another host, standard tooling that runs elsewhere (no proprietary stack lock-in), full export of files, databases and mailboxes, domain transfer out without a fee, cancellation periods and minimum terms, and the deletion of data after the contract ends.
0 — Data cannot be taken out and the contract cannot be cancelled on stated terms.
3 — A tariff upgrade exists and files can be downloaded by FTP; limits, migration in, export and exit terms are basic or not described.
5 — Tariff upgrades and downgrades in the panel, the main limits per tariff stated (storage, sites, databases, mailboxes, inodes or processes), a migration service or guide from another host, files and databases exportable with standard tools, domain transfer out documented, and the cancellation period stated.
8 — Resources scalable without moving the site, a documented path from hosting to a server or cluster at the same vendor, a free migration service with its scope stated, every limit including fair use published, monthly terms available, full export including mail, and deletion of data after termination with its deadline stated.
10 — Growth and exit with no friction: scaling on demand without downtime, everything built on open standard tooling with no proprietary lock-in, a complete export in a format another host imports, migration out supported, and cancellation, data return and deletion documented with deadlines.
The Agency Lead
Monthly terms are available, block storage scales on demand at a published 0.012 € per GB per month without fixed terms up to 8 TB, images can be exported and imported, and there is a documented ladder from VPS through Root Server and vGPU variants. A migration service, domain transfer out and post-termination data deletion terms are not documented on the captured pages. 1 2
The Small-Business Owner
The tariff ladder runs from a small two-core, four-gigabyte server up to twenty-four dedicated cores, storage grows with Local Block Storage at 0,012 € plus VAT per GB with no fixed term, monthly terms are available and a 30-day money-back guarantee states the refund in full. Image export and full root access mean my files sit in standard form, but I found no public information on a migration service in, domain transfer out or the cancellation details. 1 2
The Shop Operator
Cores, RAM and storage are stated for every tariff from two vCores up to twenty-four dedicated cores, block storage extends by the gigabyte to up to eight terabytes without a fixed term at a published per-gigabyte price, and terms of 1, 12 or 24 months with a 30-day money-back guarantee plus image export are documented. I found no public information on changing tariffs without a move, a migration service from another host, domain transfer out, or when data is deleted after cancellation. 1 2
The Freelance App Developer
Growing is honest and scriptable: contract terms of 1, 12 or 24 months, block storage expandable to 8 TB at 0,012 € plus VAT per GB without fixed terms, limits per tariff stated in numbers, and KVM images I can import and export so the whole stack runs anywhere else if the client moves. We found no public information on a migration service, fair-use detail on the traffic flatrate, or the deletion of data after termination. 1 2
The Data Protection Officer
A tariff ladder runs from vServer Lite through ARM64 and x86 to root servers, local block storage expands up to 8 TB at 0,012 € excluding VAT per GB without fixed terms, monthly terms are available, and image import and export gives a standard way out. We found no public information on a migration service from another host, domain transfer out, or the deletion of data after the contract ends. 1 2
The Skeptic
Block storage extends a server up to 8 TB at 0,012 € per GB net without fixed terms, the ladder runs from vServer Lite through x86 and ARM64 to root servers and vGPU at the same vendor, and monthly terms plus a 30-day money-back guarantee with the refund formula spelled out (the full base fee, monthly price times billing period) make leaving cheap. Full root on KVM with image export means the stack runs elsewhere; we found no public information on a migration service in, or on when data is deleted after termination. 1 2
Support, domains & email
panel disagrees
Show reasoningHide reasoning
How this is scored
Who helps and what comes with the hosting: support channels (phone, chat, ticket, email), hours and languages, response times stated or guaranteed, technical depth (WordPress or server experts, help with a hacked site), a help centre and documentation, a premium or managed support option, an agency or partner programme, and the domains, SSL certificates and mailboxes included or bookable in the same account, with their DNS management and mail features (IMAP, webmail, spam filter, mailbox size).
0 — No support offered beyond a community forum and no domain or email service.
3 — Email or ticket support and a help centre; hours, language, response times and domain and mailbox features are basic or not described.
5 — Support by phone or chat and ticket in the customer's language with hours stated, a searchable help centre, domains and mailboxes bookable in the same account with DNS management, and webmail with a spam filter.
8 — Support around the clock by people with stated technical expertise, response times stated per channel, help with hacked or broken sites, a premium support or managed service tier, an agency or partner programme with its benefits stated, and mailboxes with stated size, aliases and server-side filtering.
10 — Support with guarantees: response times contractually bound in an SLA, a named contact or account manager for business customers, proactive incident notifications, support satisfaction or response figures published, and every included service (domains, DNS, mail, certificates) documented with its limits.
The Agency Lead
A help centre, vServer FAQs and a control-panel contact form are documented, and a managed vServer tier adds server maintenance, security updates, configuration and monitoring by their experts, which is a genuine managed option. Support hours, languages, response times, and any domain or mailbox service in the same account are not described on the captured pages, so I cannot judge who picks up the phone at 2 a.m. when a shop is down. 1 4 7
The Small-Business Owner
The captured pages show a help centre, a vServer FAQ and a Managed vServer variant in which netcup's experts take over maintenance, security updates, configuration and monitoring. Beyond that I found no public information on phone, chat or ticket channels, hours, response times, or domains and mailboxes in the same account — with twelve staff and twelve mailboxes, a documented German phone number is the thing I look for first. 1 7
The Shop Operator
A help centre with vServer FAQs exists, GDPR requests run through the control panel contact form, and a managed vServer tier with expert maintenance, security updates, configuration and monitoring is offered for Linux. I found no public information on phone or chat channels with their hours, guaranteed response times, or domains and mailboxes bookable in the same account. 1 4 7
The Freelance App Developer
There is a vServer FAQ, a help centre, expert maintenance bundled with the Managed vServer tier, and GDPR requests routed through a contact form in the Customer Control Panel. We found no public information on support channels with stated hours or response times, or on domains and mailboxes bookable in the same account. 1 4 7
The Data Protection Officer
A help centre, vServer FAQs and a contact form in the Customer Control Panel are documented, and the managed vServer option adds maintenance, security updates and monitoring by the vendor's experts for Linux. We found no public information on support hours, channels such as phone or chat, response times, or on domains, SSL certificates and mailboxes bookable in the same account. 1 4 7
The Skeptic
The captured pages show a help centre, FAQs and a contact form inside the customer panel, plus a managed tier whose experts handle maintenance, security updates and monitoring; a public status page exists. We found no public information on phone or chat channels, hours, languages or response times — and none on domains or mailboxes in this account. 1 4 7
European sovereignty
panel opinion
panel disagrees
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where the servers, backups and support sit, and who the subprocessors are (data centre operator, CDN, DNS, mail filtering, support and payment tools). Independently sourced by the sovereignty pipeline; a host stores everything the customer's sites collect, so the whole chain counts, including where backups are kept and which non-EU group company can reach the data.
0 — Non-EU vendor and contracting entity, data centre location unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but the data centre location is unstated or non-EU and the subprocessors are not listed.
5 — EU data centres available and an EU contracting entity or EU representative, but parts of the chain (parent company, CDN, mail filtering, support, payment) run through non-EU providers without a stated safeguard.
8 — EU data centres named by location, EU contracting entity and parent, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, BSI C5) stated for the data centres.
10 — Sovereign end to end and evidenced: European ownership, entity, own data centres and every subprocessor, backups in the EU, no non-EU group access, data export and deletion documented, and certifications published with their scope rather than implied.
The Agency Lead
The vendor is described as a German company under the Austrian Anexia group with server locations in Nuremberg, Vienna and Amsterdam alongside non-EU sites, the captured GDPR page shows an appointed data protection officer and Article 15 access, and ISO 27001 and ISO 27701 certificates are downloadable. A data processing agreement, a subprocessor list with locations and backup locations are not documented on the captured pages, so the chain is only proven at the ends. 4 6
The Small-Business Owner
netcup GmbH is registered in Karlsruhe, Germany and part of the Austrian Anexia group, publishes a GDPR page with an appointed data protection officer and an access-request channel through the customer panel, and holds ISO 27001 and ISO 27701 certifications. The captured data-centre page itself returned a not-found notice, and I found no public information on a published data processing agreement or a list of subprocessors, so the chain beyond the German company stays open. 4 5 6
The Shop Operator
The sourcing note describes a German company in Karlsruhe within the Austrian Anexia group with server locations in Nuremberg, Vienna and Amsterdam alongside locations in the USA and Singapore, while the captured data centre page itself returned an error. A data protection officer, Article 15 access rights and ISO 27701 are documented, but I found no public information on a data processing agreement, the subprocessor chain, or where backups are stored. 4 5 6
The Freelance App Developer
The privacy side is documented in German: a data protection officer is appointed, Article 15 access runs through the Customer Control Panel, and an ISO 27701 certification is published with downloadable certificates. The captured data-centre page returned an error, so the pages we read show no server locations, and we found no public information on subprocessors or a data processing agreement. 4 5 6
The Data Protection Officer
The vendor describes itself as netcup GmbH of Karlsruhe with virtual servers in Nuremberg, Vienna and Amsterdam, a data protection officer has been appointed, Article 15 access requests are handled through the panel, and ISO 27001 plus ISO 27701 certificates are published for download with annual audits. But the captured data centre page itself did not load, the vendor also operates locations in the USA and Singapore, and we found no public information on a published data processing agreement or a subprocessor list — the exact chain my clients need before signing is not documented. 4 5 6
The Skeptic
The vendor line names a German contracting entity (netcup GmbH, registered at the Mannheim court, seat in Karlsruhe) under the Austrian Anexia group, with servers in Nuremberg, Vienna and Amsterdam alongside locations in the USA and Singapore; a data protection officer and GDPR access rights are documented, as are ISO certifications with their auditors. We found no public information on a published data processing agreement or on the subprocessors in the chain, and the data-centre page we captured returned a "page not found" error. 4 5 6
Pricing transparency
panel disagrees
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real cost over the contract from public pages alone: the price per tariff for the first term and on renewal, minimum term and how the price depends on it, setup fees, what is included (domains, mailboxes, SSL, backups, restores, migration), what costs extra (additional PHP versions or extended support, more backups, a restore, premium support, staging, CDN), traffic or resource overage, VAT treatment, and the cancellation terms.
0 — No public prices at all; every customer is a sales call.
3 — A starting price is shown, but the renewal price, minimum term or what is included is unclear.
5 — Tariffs are public with their monthly price and main inclusions, the minimum term stated, but at least one commonly needed piece (the renewal price after an introductory offer, setup fee, restores, extra backups, extended PHP support) is unpriced or hard to find.
8 — Every tariff priced with the price for the first term and on renewal side by side, the minimum term and setup fee stated, add-ons priced, overage handling stated, and VAT treatment for business customers stated.
10 — Complete price computability: the cost over three years derivable for a given tariff and set of add-ons, with every setup, restore, support and migration fee and the cancellation and data-return terms published.
The Agency Lead
Every tariff is listed with the discounted and the regular monthly price side by side including 19 % VAT, terms of one, twelve (−13 %) or twenty-four (−26 %) months are stated, block storage is priced per gigabyte, traffic is included and a 30-day money-back guarantee covers the full base fee — the year-three cost is visible, which is exactly what I need per client site. Setup fees, cancellation fine print and any restore or support fees are not stated on these pages. 1 2
The Small-Business Owner
Every tariff shows the discounted monthly price for the twelve-month term next to the regular price, both including 19 % VAT, with one-, twelve- and twenty-four-month terms at minus 13 and minus 26 per cent, and add-on storage is priced per gigabyte plus VAT with the rounding stated. The money-back terms spell out exactly what comes back. I found no public information on setup fees or the cost of snapshots and restores, which keeps the invoice from being fully computable before I buy. 1 2
The Shop Operator
All tariffs from the VPS 500 to the RS 16000 show the regular and the discounted monthly price side by side including 19 % VAT, with the 1-, 12- and 24-month terms and their 13 and 26 percent discounts stated, traffic included, and block storage at a published per-gigabyte price. I found no public information on setup fees, snapshot or restore charges, or how VAT is handled for business customers outside Germany. 1 2
The Freelance App Developer
Every tariff shows the regular and the term-discounted monthly price side by side including 19 % VAT, with 1, 12 and 24-month terms at −13 % and −26 %, and the captured add-on, block storage, is priced at 0,012 € plus VAT per GB. Traffic is included; we found no public information on setup fees, and the only exit cost documented is the 30-day money-back guarantee refunding the base fee. 1 2
The Data Protection Officer
All sixteen VPS and root server tariffs show the discounted monthly price and the list price side by side including 19 % VAT, terms of 1, 12 and 24 months carry stated discounts of −13 % and −26 %, block storage is priced at 0,012 € excluding VAT per GB per month, a VAT selector is shown, traffic is included, and a 30-day money-back guarantee refunds the full base fee. We found no public information on setup fees, charges for restores or premium support, or the cancellation and data-return terms, which keeps the three-year total from being fully computable. 1 2
The Skeptic
Every tariff shows the discounted and the list monthly price side by side including 19% VAT, the term mechanic is explicit (1 month, 12 months −13%, 24 months −26%), block storage is priced per GB net with its rounding rule, traffic is included, and the 30-day money-back terms state the refund formula outright. We found no public information on setup fees or on what snapshots and other add-ons cost, which keeps a three-year computation from closing cleanly. 1 2
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined | — | uncited Report an error |
| Hosting options | Not determined | — | uncited Report an error |
| Open source | Not determined | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about netcup VPS
Is netcup VPS European?
Yes. whats-best.ai classifies netcup VPS as EU-Made.
Where does netcup VPS store data?
Not stated on the vendor’s pages as of 1 Nov 2026.
Does netcup VPS have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to netcup VPS?
As of 2 Nov 2026, the panel rates Kinsta (3.5/5), Raidboxes (3/5) and Infomaniak Web Hosting (3/5) highest among the other 14 Web Hosting products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Raidboxes (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: netcup VPS alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 1 Nov 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 5 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
Sources (8)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage (VPS, with pricing) www.netcup.com Checked 1 Nov 2026 Details →
- 2 Features page (root servers) www.netcup.com Checked 1 Nov 2026 Details →
- 3 API documentation www.netcup.com Checked 1 Nov 2026 Details →
- 4 Documentation (GDPR) www.netcup.com Checked 1 Nov 2026 Details →
- 5 Company page (data centres) www.netcup.com Checked 1 Nov 2026 Details →
- 6 Security / trust page (certifications) www.netcup.com Checked 1 Nov 2026 Details →
- 7 Help centre www.netcup.com Checked 1 Nov 2026 Details →
- 8 Status page www.netcup-status.de Checked 1 Nov 2026 Details →