gridscale vs Hetzner

Compare gridscale and Hetzner on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), DigitalOcean, Microsoft Azure

gridscale

Germany· Cloud Computing

Needs review

Shortlist when you need a German GmbH cloud with EU/CH/AT location choice, managed Kubernetes/databases, and Hybrid Core white-label HCI. Skip when you need global hyperscaler coverage or pure lowest-cost VMs—consider Hetzner for cost-sensitive compute or AWS/Azure for worldwide breadth; use OVHcloud parent portfolio when scale across more European regions is the priority.

EU-operated (DE entity)Multi-country EU/CH locationsManaged KubernetesHybrid Core HCIBSI C5 (claimed)OVHcloud group

View listing Visit Website

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud

View listing Visit Website

Highlighted rows differ between the two products.

gridscale vs Hetzner: Snapshot
Feature	gridscale	Hetzner
Country of origin	Germany	Germany
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	gridscale GmbH, Oskar-Jäger-Straße 173, 50825 Köln (HRB 97235, Amtsgericht Cologne)	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)
Governing law	German law (GTC; English GTC for information only—German prevails)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
Hosting / residency	Customer infrastructure marketed on European Tier 3 locations (Frankfurt multi-AZ, Eichenzell, Hannover, Paderborn, Amsterdam, Gais, Lucerne, Vienna); some Hybrid Core sites partner-operated (hosttech, rhöncloud, BAIONITY, windCORES). Privacy policy also lists US-group ancillary processors: Stripe (payments), Google Analytics/GTM, Microsoft Bing Ads, Meta, LinkedIn; Mautic on-prem DE; Recruitee NL. No public claim that primary VM storage runs on AWS/GCP/Azure.	Owned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.
Summary	Cologne-based German IaaS/PaaS and Hybrid Core HCI cloud (OVHcloud group) with European locations, managed Kubernetes, and white-label private cloud options for DACH teams.	German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.
Tags	cloud iaas paas kubernetes hybrid-cloud hci german-cloud data-sovereignty api	cloud vps dedicated-servers hosting gdpr germany data-center bare-metal self-hosting iso-27001 c5 hetzner-cloud

At a glance: gridscale vs Hetzner
At a glance	gridscale	Hetzner
HQ	Cologne, Germany	Gunzenhausen, Germany
Legal entity	gridscale GmbH (HRB 97235)	Hetzner Online GmbH (HRB 6089 Ansbach)
Parent	OVHcloud (100% since Sept 2023)	Not listed
Hosting	European Tier 3 sites DE/NL/CH/AT (+ partners)	Not listed
Commercial model	B2B; trial then per-minute usage metering	Not listed
Open source	No (API/IaC clients only)	No (commercial infrastructure)
EU parks	Not listed	Nuremberg, Falkenstein (DE); Helsinki (FI)
Optional cloud regions	Not listed	Ashburn and Hillsboro (US); Singapore
Model	Not listed	IaaS / dedicated / hosting (unmanaged cloud and root)

Key capabilities: gridscale vs Hetzner
Key capabilities	gridscale	Hetzner
EU-operated (DE entity)	Yes	Yes
Multi-country EU/CH locations	Yes	Not listed
Managed Kubernetes	Yes	Not listed
Hybrid Core HCI	Yes	Not listed
BSI C5 (claimed)	Yes	Yes
OVHcloud group	Yes	Not listed
Owned DE/FI parks	Not listed	Yes
ISO 27001:2022	Not listed	Yes
Bare metal + auction	Not listed	Yes
Optional US/SG cloud	Not listed	Yes

gridscale

Panel + API + Terraform provisioning
Deploy VMs with attached storage in seconds via the control panel or automate with the REST API and common IaC clients (Terraform, Packer). Built for teams that want both click-ops and git-ops without a hyperscaler control-plane learning curve.
Managed Kubernetes, databases, and load balancers
PaaS layers cover managed Kubernetes orchestration plus fully managed databases with audit logs and automatic backups, and managed load balancers for traffic distribution—so app teams avoid running the full stack themselves.
S3-compatible object storage and Rocket NVMe storage
Object storage follows S3-style APIs for backups, archives, and unstructured data, with region choice called out for GDPR-oriented placement. Rocket Storage targets high-IOPS NVMe workloads; not every Hybrid Core location exposes object storage—check the data-center matrix.
Per-minute GPU bare-metal for AI/ML
GPU instances are marketed as dedicated bare-metal performance for AI/ML and data science, with CPU, RAM, and storage included and usage billed by the minute rather than only long-term reserved shapes.
Hybrid Core Concierge HCI and white-label cloud
Fully managed hyperconverged packages combine hardware delivery, installation, remote operations, white-label branding/SAML options, and access to the wider gridscale location ecosystem—aimed at enterprises and hosters building private or partner clouds.

Hetzner

Dedicated root servers and Server Auction
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
Hetzner Cloud with API, networks, and apps
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Owned EU data center parks plus optional US/Singapore cloud
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
ISO 27001, BSI C5 Type 2, and console DPA
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Inclusive traffic-oriented European cloud pricing model
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

Assurance & compliance: gridscale vs Hetzner
Assurance & compliance	gridscale	Hetzner
Independent security / no-logs audit	Not applicable IaaS/PaaS provider—not a no-logs VPN product. Request penetration-test or SOC-style reports under NDA if required.	Not applicable Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.
ISO 27001	Vendor claimed Vendor compliance pages and chronology claim ISO/IEC 27001; obtain current certificate for verification.	Verified ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.
ISO 27017 (cloud security)	Vendor claimed Compliance page links a certificate PDF download; treat as vendor-published evidence until auditor validates.	Not listed
ISO 27018 (cloud PII)	Vendor claimed Claimed on compliance/about materials; request current scope.	Not listed
SOC 2 / SOC 3	Not found No public SOC 2 found; vendor promotes ISAE 3402 SOC 1 Type 2 instead (different standard).	Not found Hetzner states focus on ISO 27001 rather than SOC 2 for international market.
ISAE 3402 SOC 1 Type 2	Vendor claimed About chronology highlights successful ISAE 3402 SOC 1 Type 2 (incl. January 2025 call-out). Request full report.	Not listed
BSI C5	Vendor claimed Prominently listed on compliance pages; About chronology pairs C5 with January 2025 certification success. Request current attestation.	Verified Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).
GDPR / EU data protection	Vendor claimed German controller (gridscale GmbH); European location marketing; privacy policy under DS-GVO. Confirm DPA and location selection for your processing.	Vendor claimed German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.
US CLOUD Act exposure (indicative)	Partial EU entity, no known US parent (OVHcloud France owns group). Customer hosting marketed in EU/CH/AT. Partial because privacy recipient list includes US-group Stripe, Google Analytics/GTM, Microsoft, Meta, LinkedIn for payments/marketing. Not legal advice.	Partial EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.
Data processing agreement (B2B)	Vendor claimed GTC §14.2 requires a separate order-processing contract when gridscale processes personal data for the customer, finalised at latest on contract conclusion. Execute AV/DPA—do not rely on website privacy alone.	Vendor claimed Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.
EU AI Act	Not applicable Infrastructure cloud; not an AI system product. GPU capacity may host customer AI workloads under shared-responsibility model.	Not applicable Infrastructure hosting, not an AI system product.
Trusted Cloud (DE)	Vendor claimed Compliance page links Trusted Cloud service listing; verify current entry on trusted-cloud.de.	Not listed
KRITIS / section 8a BSIG	Not listed	Vendor claimed Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.

Considerations & known limitations: gridscale vs Hetzner
Considerations & known limitations	gridscale	Hetzner
Parent-group integration after OVHcloud acquisition	Medium 100% OVHcloud ownership since 2023 may change roadmap, tooling, support model, or cross-entity data flows over time. Confirm entity, subcontractors, and exit terms for your contract generation.	Not listed
Partner-operated Hybrid Core locations	Medium Some sites are operated with partners (hosttech, rhöncloud, BAIONITY, windCORES, etc.). Capability matrices differ (for example object storage not everywhere). Map exact location codes to SLA and subprocessor wording.	Not listed
US-group ancillary processors (account/marketing)	Medium Privacy policy lists Stripe, Google Analytics/GTM, Microsoft Bing Ads, Meta, and LinkedIn. Material for DPIAs even when VM disks stay in EU halls. Ask which tools touch production account identities versus marketing only.	Not listed
Certifications need current attestation packs	Low BSI C5, ISAE 3402, and ISO claims are vendor-published. Production security reviews should obtain dated reports rather than relying on marketing badges alone.	Not listed
Narrower global footprint than hyperscalers	Low Location set is European-weighted. Unsuitable as a drop-in for multi-continent latency or hyperscaler-only services (global CDN marketplaces, specialized managed services).	Not listed
Optional US and Singapore cloud regions	Not listed	Medium Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.
Unmanaged cloud and dedicated servers	Not listed	Medium You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.
Narrower managed-service catalog vs hyperscalers	Not listed	Low Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.
ISO scope is DE/FI parks	Not listed	Low Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.

Fit

gridscale

Best fit when

DACH mid-market teams wanting German contracting plus managed PaaS (Kubernetes, databases, load balancers)
MSPs and hosters needing white-label branding, multi-tenant accounts, and optional Hybrid Core hardware
Workloads that must pick DE/NL/CH/AT regions with Tier 3 marketing claims and green-energy positioning
AI/ML or data-science jobs that need GPU bare-metal with per-minute metering
Buyers who value panel + API/Terraform over hyperscaler IAM sprawl

Poor fit when

Global multi-region applications that need hyperscaler edge, marketplace services, or non-European regions
Teams optimising only for lowest bare VM or dedicated-server unit cost (evaluate Hetzner first)
Buyers requiring public SOC 2 Type II specifically rather than ISAE 3402 SOC 1 Type 2 / BSI C5 packs
Organisations that forbid any US-group ancillary processors (Stripe/Google marketing tools appear in the privacy recipient list)

Consider instead when

When: You need the broader European hyperscale portfolio and more regions under one group brand
Consider: OVHcloud
OVHcloud is the parent group; gridscale stays the HCI/panel-focused product line
When: Cost-sensitive VMs or dedicated servers dominate and you do not need Hybrid Core white-label
Consider: Hetzner
Hetzner typically wins raw price/performance for simple compute
When: France-centric developer cloud with different location and product skew
Consider: Scaleway
Compare ARM options and FR footprint versus gridscale DACH Hybrid Core
When: Swiss-rooted EU cloud positioning is the primary evaluation criterion
Consider: Exoscale
Still compare DE/CH site maps and managed service depth side by side
When: You need worldwide regions, marketplace depth, or US-public-sector cloud programmes
Consider: Amazon Web Services (AWS) or Microsoft Azure
Trade EU-entity simplicity for hyperscaler breadth and US ownership path

Hetzner

Best fit when

Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
Policies that forbid any US subsidiary, US colocation, or optional US region at group level
Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.

Open questions for due diligence

gridscale

Will gridscale execute your template AV/DPA and attach a location-specific subprocessor list for the regions you enable?
What is the current scope and report date for BSI C5 and ISAE 3402 SOC 1 Type 2 covering the services you will buy?
Which privacy-policy third parties process production account/identity data versus website marketing only?
How are OVHcloud group affiliates involved in support, billing, or platform operations for gridscale customers post-acquisition?
For Hybrid Core partner sites, who is the data-center operator of record and what audit rights apply?

Hetzner

Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?