Hetzner vs Open Telekom Cloud

Compare Hetzner and Open Telekom Cloud on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Google Cloud Platform, Microsoft Azure

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud

View listing Visit Website

Open Telekom Cloud

Germany· Cloud Computing

Needs review

Shortlist when you need a German Telekom/T-Systems OpenStack public cloud with DE/NL/CH regions and a strong BSI C5/ISO/TISAX package for regulated or public-sector workloads. Skip when you need hyperscaler global PaaS breadth or pure self-hosted OpenStack—consider OVHcloud, Scaleway, or AWS/Azure for those cases.

EU-operated (T-Systems)OpenStack public IaaSBSI C5 Type II (claimed)DE / NL / CH regionsGPU + ModelArts AIPay-as-you-go

View listing Visit Website

Highlighted rows differ between the two products.

Hetzner vs Open Telekom Cloud: Snapshot
Feature	Hetzner	Open Telekom Cloud
Country of origin	Germany	Germany
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Germany
Legal entity	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)	T-Systems International GmbH (Deutsche Telekom group); product marketed as T Cloud Public / Open Telekom Cloud
Governing law	Not listed	German / EU law for the cloud service (confirm contract)
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Low
Hosting / residency	Owned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.	Primary: Telekom/T-Systems twin-core data centers in Germany (Biere/Magdeburg), Netherlands (Amsterdam region), and Switzerland (Bern/Zollikofen). No public indication that AWS, Azure, or GCP is the primary IaaS host. Backups/DR via platform multi-AZ services. Full public subprocessor table not found—request DPA annex. Historical Huawei technology partnership is supply-chain diligence, not US-cloud hosting.
Summary	German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.	Deutsche Telekom / T-Systems sovereign European public cloud (now marketed as T Cloud Public): OpenStack-based IaaS and platform services in Germany, Netherlands, and Swiss regions with BSI C5, ISO, and SOC attestations.
Tags	cloud gdpr germany vps dedicated-servers hosting data-center bare-metal self-hosting iso-27001 c5 hetzner-cloud	cloud gdpr germany iaas openstack sovereign-cloud t-systems deutsche-telekom enterprise bsi-c5

At a glance: Hetzner vs Open Telekom Cloud
At a glance	Hetzner	Open Telekom Cloud
HQ	Gunzenhausen, Germany	Not listed
Legal entity	Hetzner Online GmbH (HRB 6089 Ansbach)	Not listed
EU parks	Nuremberg, Falkenstein (DE); Helsinki (FI)	Not listed
Optional cloud regions	Ashburn and Hillsboro (US); Singapore	Not listed
Model	IaaS / dedicated / hosting (unmanaged cloud and root)	Not listed
Open source	No (commercial infrastructure)	Not listed
HQ / operator	Not listed	Germany — T-Systems / Deutsche Telekom
Current brand	Not listed	T Cloud Public (formerly Open Telekom Cloud)
Platform	Not listed	OpenStack-based public cloud
Regions	Not listed	Germany (Biere/Magdeburg), Netherlands, Switzerland
Commercial model	Not listed	Pay-as-you-go (+ optional discounts/reservations)
Self-host	Not listed	No — managed public cloud

Key capabilities: Hetzner vs Open Telekom Cloud
Key capabilities	Hetzner	Open Telekom Cloud
EU-operated (DE HQ)	Yes	Yes
Owned DE/FI parks	Yes	Not listed
ISO 27001:2022	Yes	Not listed
BSI C5 Type 2	Yes	Yes
Bare metal + auction	Yes	Not listed
Optional US/SG cloud	Yes	Not listed
OpenStack public IaaS	Not listed	Yes
DE / NL / CH regions	Not listed	Yes
GPU + ModelArts AI	Not listed	Yes
Pay-as-you-go	Not listed	Yes

Hetzner

Dedicated root servers and Server Auction
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
Hetzner Cloud with API, networks, and apps
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Owned EU data center parks plus optional US/Singapore cloud
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
ISO 27001, BSI C5 Type 2, and console DPA
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Inclusive traffic-oriented European cloud pricing model
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

Open Telekom Cloud

OpenStack public cloud with Elastic Cloud Server and GPUs
Self-service IaaS on OpenStack: Elastic Cloud Server flavors from general-purpose to GPU shapes for AI/ML and graphics, plus Dedicated Host and Bare Metal where the region supports them. Provision via console, API, or automation; Auto Scaling for metric-driven capacity. Suited to production VMs and hybrid patterns that need European operator control rather than a thin VPS plan.
Multi-AZ object, block, and file storage in EU regions
Object Storage Service provides S3-compatible multi-AZ object storage; Elastic Volume Service attaches block disks with snapshots; Scalable File Service offers NFS shared filesystems. Cloud Backup and Recovery and related services back up VMs and volumes into platform object storage. Pin workloads to DE, NL, or Swiss regions according to residency policy.
VPC networking, Direct Connect, and security services
Virtual Private Cloud isolation, Elastic Load Balancer, VPN, NAT, Enterprise Router, and Direct Connect for high-bandwidth hybrid links. Security stack includes Anti-DDoS, WAF, Cloud Firewall, Host Security Service, and Key Management Service with bring-your-own-key options—useful for regulated network architectures without leaving Telekom-operated regions.
Cloud Container Engine and managed data services
Cloud Container Engine runs Kubernetes-managed clusters and images; companion services cover container instances and registries. Relational Database Service supports MySQL, PostgreSQL, and Microsoft SQL with HA and backup patterns; document, cache (Redis-class), MapReduce, and search services extend the data plane. Service availability differs between DE and NL—check the regional matrix before design freezes.
ModelArts and sovereign AI positioning
ModelArts provides an end-to-end AI development path (data prep, training, deployment) on European infrastructure, with GPU-backed instances for training and inference. Aimed at teams that want model and training-data residency under the same European operator as their IaaS—confirm which AI services exist in your chosen region (several AI offerings are DE-focused).
Twin-core European data centers (DE, NL, CH)
Published regions: twin-core Germany (Biere/Magdeburg), Netherlands (Amsterdam area), and Switzerland (Bern/Zollikofen) for Swiss data residency. Vendor claims geo-redundant twin-core design, high availability targets, and renewable-powered German facilities. Not a global multi-continent footprint—by design for European sovereignty shortlists.

Assurance & compliance: Hetzner vs Open Telekom Cloud
Assurance & compliance	Hetzner	Open Telekom Cloud
Independent security / no-logs audit	Not applicable Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.	Not applicable IaaS platform—not a no-logs consumer VPN. Independent assurance is via ISO/SOC/C5-style audits rather than a no-logs report.
ISO 27001	Verified ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.	Vendor claimed Vendor certifications page links ISO/IEC 27001 umbrella certificate PDF for download; re-verify serial/date in procurement.
SOC 2 / SOC 3	Not found Hetzner states focus on ISO 27001 rather than SOC 2 for international market.	Vendor claimed SOC 2 Type II (request report); SOC 3 public PDF linked on certifications page. SOC 1 Type II also claimed.
GDPR / EU data protection	Vendor claimed German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.	Vendor claimed EU operator, EU/CH regions, ISO 27018/27701 claims, DPA language on marketing pages—confirm signed DPA for your entity.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.	Partial German Telekom/T-Systems operator, no known US parent of the cloud business, primary hosting on Telekom EU/CH data centers (not AWS/GCP/Azure). Not a legal clearance of zero extraterritorial risk. Historical Huawei tech partnership is separate supply-chain diligence. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.	Vendor claimed Vendor GDPR pages state DPA, TOMs, and audit reports available for B2B; obtain current signed pack—not fully self-serve public template verified here.
EU AI Act	Not applicable Infrastructure hosting, not an AI system product.	Partial Platform offers AI services (ModelArts) that may fall under customer AI Act obligations; OTC itself is infrastructure—not an automated high-risk AI system assessment by EuropeanStack.
BSI C5 (cloud)	Verified Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).	Vendor claimed Vendor claims BSI C5:2020 Type II (ISAE 3000); detailed report typically on request via audit-reports download flow.
KRITIS / section 8a BSIG	Vendor claimed Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.	Not listed
ISO/IEC 27017 (cloud security)	Not listed	Vendor claimed Claimed with downloadable attestation PDF on certifications page.
ISO/IEC 27018 (cloud PII)	Not listed	Vendor claimed Claimed with downloadable attestation PDF on certifications page.
TISAX Level 3	Not listed	Vendor claimed Vendor states TISAX Level 3 for Germany and Netherlands regions.

Considerations & known limitations: Hetzner vs Open Telekom Cloud
Considerations & known limitations	Hetzner	Open Telekom Cloud
Optional US and Singapore cloud regions	Medium Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.	Not listed
Unmanaged cloud and dedicated servers	Medium You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.	Not listed
Narrower managed-service catalog vs hyperscalers	Low Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.	Not listed
ISO scope is DE/FI parks	Low Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.	Not listed
Historical Huawei technology partnership	Not listed	Medium Platform launched with Huawei hardware/software partnership; residual stack components may still matter for sensitive public-sector RFPs. T-Systems states independent operation. Review supply-chain docs under NDA.
Service catalog differs by region	Not listed	Medium Several services (e.g. ModelArts, bare metal, some database/analytics SKUs) are unavailable in NL or limited to DE. Design against the live regional matrix, not the full marketing list.
Limited public subprocessor table	Not listed	Low Unlike some SaaS vendors, a complete public subprocessor inventory was not found on marketing pages. Request DPA annex and subcontractor list before high-assurance processing.
Smaller global ecosystem than AWS/Azure/GCP	Not listed	Low Expect fewer regions, fewer proprietary PaaS services, and a smaller marketplace than US hyperscalers. Migration tools and partner ecosystem exist but differ in depth.
Brand transition OTC → T Cloud Public	Not listed	Low Documentation, console URLs, and community still mix Open Telekom Cloud and T Cloud Public names. Factor rebrand into runbooks and vendor risk registers.

Fit

Hetzner

Best fit when

Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
Policies that forbid any US subsidiary, US colocation, or optional US region at group level
Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.

Open Telekom Cloud

Best fit when

German public sector and regulated buyers needing Telekom-group operator plus BSI C5 / ISO package
Enterprises pinning workloads to DE, NL, or Swiss twin-core regions under GDPR (and Swiss DSG where relevant)
Teams wanting OpenStack-based IaaS with ECS, object/block storage, VPC, and Kubernetes (CCE) without US hyperscaler residency defaults
AI/ML projects that require GPU capacity and ModelArts-class tooling with European data residency messaging
Hybrid architectures using Direct Connect / VPN into Telekom data centers with 24/7 European support expectations

Poor fit when

Workloads that require dozens of global regions or deep proprietary hyperscaler PaaS catalogs
Buyers seeking a free self-hosted OpenStack distribution rather than a commercial public cloud
Teams that need every service in every region—several AI, bare-metal, and data services are DE-only or limited
Organisations that reject any non-European technology supply chain without further review (historical Huawei partnership)

Consider instead when

When: You need extensive bare-metal catalogs and a very large multi-country EU footprint
Consider: OVHcloud
Different operator (France) and product packaging; compare bare-metal and region maps.
When: You prefer developer-centric European cloud packaging outside the Telekom stack
Consider: Scaleway or Exoscale
Scaleway for FR/NL-oriented developer UX; Exoscale for Swiss multi-zone IaaS + managed K8s.
When: You need global regions, marketplace depth, or proprietary PaaS only hyperscalers provide
Consider: AWS, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and multi-region complexity in exchange for breadth.
When: You want German-market hosting adjacency with a different commercial/product mix
Consider: IONOS
Often compared for German buyers; validate IaaS depth vs OTC enterprise cloud features.

Open questions for due diligence

Hetzner

Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?

Open Telekom Cloud

Will T-Systems provide the current full subprocessor/subcontractor list and signed DPA annex for our legal entity and region?
What is the residual Huawei (or other non-EU) component inventory for the regions we will use, and is it acceptable under our procurement policy?
Which services in our target architecture are available in DE vs NL vs Swiss regions with which SLAs?
Can we obtain current C5 Type II and SOC 2 reports (not only marketing claims and SOC 3 summary) under NDA?
For AI workloads, which ModelArts/GPU SKUs and data paths apply, and how do they map to our EU AI Act role?