Cyso Cloud vs Hetzner Object Storage

Security measures and pen-testing philosophy are described; no public independent no-logs or IaaS audit report found beyond ISMS certs.

IaaS object store, not a no-logs VPN. Company publishes ISO 27001, BSI C5 Type 2, and annual TOM review instead.

Vendor publishes ISO/IEC 27001 certificate PDF via Trust Centre / certifications (listed expiry into 2028). Not re-checked on an independent registry for this draft.

Public ISO/IEC 27001:2022 certificate (SOCOTEC) for the ISMS covering Nuremberg, Falkenstein, and Helsinki parks. Confirm attested scope includes this SKU with your auditor.

Certifications page explains SOC 2 Type II generally; no clear statement that Cyso currently holds a published SOC 2 report.

Hetzner states it focuses on ISO 27001 rather than SOC 2.

EU legal entity; AMS/FRA residency claims; Trust Centre GDPR section. Obtain DPA and TOMs for controller/processor mapping.

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data stored in buckets.

EuropeanStack assessment: EU entity, no known US parent, primary IaaS claimed on self-operated NL/DE hardware (not AWS/GCP/Azure). Partial because no full public subprocessor schedule and ancillary SaaS (e.g. PostHog analytics, Atlassian-linked status) may involve non-EU providers. Not legal advice.

EU entity, no known US parent, Object Storage has no US region and no US-group storage backend. Group still includes Hetzner US LLC for other products. Not legal advice.

Marketing (e.g. Azure alternative pages) states Cyso signs a DPA under Dutch law; confirm current template and subprocessor annex in contracting.

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Vendor publishes NEN 7510 certificate PDF on certifications/Trust Centre pages.

IaaS/infrastructure platform, not an AI system product.

Object storage infrastructure, not an AI system product.

Vendor publishes a BSI C5 Type 2 attestation PDF for cloud services. Confirm whether Object Storage is inside the attested cloud-service scope.

Production public cloud is AMS and FRA today. Multi-continent latency, in-country residency outside NL/DE, or extensive multi-region DR across Europe may require another provider or private cloud.

Official FAQs state no standard server-side encryption at rest; TLS in transit and client-side/SSE-C patterns are recommended. Regulated designs must implement key management outside default storage behaviour.

Primary hosting path is vendor-operated EU hardware, but privacy materials list third parties without a dedicated live subprocessor register for all ancillary processing. Request the schedule under NDA or DPA annex.

ISO 27001 and NEN 7510 are claimed with certificate PDFs on Cyso sites; this draft did not independently verify registry entries. Treat as claimed until audit pack is reviewed.

Fewer managed PaaS services and marketplace options than AWS/Azure/GCP. Expect to run more of the stack yourself on OpenStack/Kubernetes.

Supported-actions list omits website hosting, notifications, inventory, replication, custom domains, SSE-KMS, and more. CopyObject may fail even in one location. Apps that assume full AWS S3 will break.

Standard HDD only, no archive or flash classes. Hetzner says it is a poor fit for high-frequency small objects, low-latency apps, and large-scale public HTTP. Plan a CDN or different storage for those cases.

Objects are not encrypted at rest unless you use SSE-C and keep the key. Lost keys are unrecoverable. SSE-C copy is unsupported.

A bucket lives in one DC. There is no first-party cross-location replication. You must build DR yourself if one park outage is unacceptable.

Vendor docs describe cluster growth, bucket migrations, and temporary concurrency or upload limits (including 503 in Nuremberg under load). Shared tenancy can affect latency.

This SKU is EU-only, but Hetzner Online GmbH has US and Singapore subsidiaries for other Cloud locations. Zero-US-footprint procurement may still reject the vendor.