Aruba Cloud vs Hetzner

IaaS/PaaS provider—not a no-logs consumer VPN. Request customer audit rights / SOC reports under NDA if needed.

Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.

Vendor publishes ISO 27001 certificate PDF and states ISO 27001 family as a security pillar; also claims 27017/27018/27035. Re-verify cert scope and validity dates in procurement.

ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.

Public SOC 2/3 report not found on product pages. Vendor publishes ISAE 3402 report PDF instead—request current assurance package.

Hetzner states focus on ISO 27001 rather than SOC 2 for international market.

Certificate/report PDF linked from data-protection resources page.

EU/Italian entity; services designed under GDPR; CISPE Code of Conduct claimed; processor terms in cloud T&Cs.

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.

Italian entity, no known US parent, primary hosting on Aruba-owned EU DCs—not on AWS/GCP/Azure by default. Residual uncertainty: subprocessor list only on request; partner DCs include UK; optional multi-cloud/hybrid to hyperscalers. Indicative only—not legal advice.

EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.

Cloud/data-centre T&Cs Art. 21 appoint Aruba as processor/sub-processor for applicable services; subprocessors available on request with change notice. Confirm signed pack for your SKUs.

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Vendor states CISPE Code of Conduct compliance on product and sovereignty pages.

Vendor claims infrastructure up to ACN AI3 and services up to QC3 for public administration. Confirm which products are in scope for your project.

Infrastructure provider; Framework AI tool exists as optional capability with customer-responsibility language—not an AI product evaluation.

Infrastructure hosting, not an AI system product.

Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).

Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.

T&Cs say the updated subprocessor list is available on request, not as a public transparency page. Procurement should obtain the current list, countries, and change process before go-live.

European network includes partner sites and a UK zone. Residency and latency goals require explicit region selection—not assumptions from marketing 'sovereign cloud' language alone.

Default terms state Aruba does not back up customer data unless a backup service is purchased; customers administer OS, apps, and credentials under shared responsibility.

OpenStack + VMware + bare metal + K8s cover classic IaaS/private cloud well, but teams expecting AWS/Azure-class managed service density will hit catalog limits.

ISO/ISAE/ACN claims are vendor-published; map each cert to exact products, locations, and expiry before relying on them in a risk register.

Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.

You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.

Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.

Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.