Hetzner vs SAP

Compare Hetzner and SAP on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Microsoft Azure

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud

View listing Visit Website

SAP

Germany· Cloud Computing

Needs review

Shortlist SAP when you need S/4HANA-class ERP breadth under a German parent entity and can fund a structured implementation. Skip when you want lightweight self-serve finance SaaS without a transformation partner. Consider Salesforce when CRM is the system of record, or a Microsoft Dynamics / Azure-centric stack when identity and productivity are already standardised on Microsoft.

EU-operatedFull ERP suiteS/4HANA CloudISO 27001 (claimed)B2B DPA published

View listing Visit Website

Highlighted rows differ between the two products.

Hetzner vs SAP: Snapshot
Feature	Hetzner	SAP
Country of origin	Germany	Germany
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	Yes
Headquarters	Germany	Germany
Legal entity	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)	SAP SE, Dietmar-Hopp-Allee 16, 69190 Walldorf (Mannheim HRB 719915)
Governing law	Not listed	German entity; order forms may name local SAP affiliates
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Owned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.	Mixed: SAP-operated data centers (including Walldorf / St. Leon-Rot, Germany) plus Enterprise Cloud Services documented on AWS, Microsoft Azure, Google Cloud Platform, or customer data centers. Product-specific subprocessor lists are primarily on My Trust Center for customers.
Summary	German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.	German-headquartered enterprise ERP suite (SAP Cloud ERP / S/4HANA) for finance, supply chain, procurement, and HR.
Tags	cloud gdpr vps dedicated-servers hosting germany data-center bare-metal self-hosting iso-27001 c5 hetzner-cloud	cloud gdpr erp enterprise s4hana

At a glance: Hetzner vs SAP
At a glance	Hetzner	SAP
HQ	Gunzenhausen, Germany	Walldorf, Germany
Legal entity	Hetzner Online GmbH (HRB 6089 Ansbach)	SAP SE (HRB 719915 Mannheim)
EU parks	Nuremberg, Falkenstein (DE); Helsinki (FI)	Not listed
Optional cloud regions	Ashburn and Hillsboro (US); Singapore	Not listed
Model	IaaS / dedicated / hosting (unmanaged cloud and root)	Not listed
Open source	No (commercial infrastructure)	No
Product focus	Not listed	Cloud ERP / S/4HANA
Commercial model	Not listed	Enterprise subscription and licences (quote-based)
Data residency regions	Not listed	Customer-selectable; Americas, Europe, Asia Pacific (incl. SAP DE sites and hyperscalers)
Compliance certs (claimed)	Not listed	ISO 27001, SOC 1/2, BSI C5, plus regional attestations via Trust Center

Key capabilities: Hetzner vs SAP
Key capabilities	Hetzner	SAP
EU-operated (DE HQ)	Yes	Yes
Owned DE/FI parks	Yes	Not listed
ISO 27001:2022	Yes	Yes
BSI C5 Type 2	Yes	Not listed
Bare metal + auction	Yes	Not listed
Optional US/SG cloud	Yes	Not listed
Full ERP suite	Not listed	Yes
S/4HANA Cloud	Not listed	Yes
B2B DPA published	Not listed	Yes

Hetzner

Dedicated root servers and Server Auction
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
Hetzner Cloud with API, networks, and apps
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Owned EU data center parks plus optional US/Singapore cloud
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
ISO 27001, BSI C5 Type 2, and console DPA
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Inclusive traffic-oriented European cloud pricing model
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

SAP

SAP S/4HANA Cloud ERP core
Public and private cloud editions cover finance, supply chain, procurement, sales, and related processes on an in-memory data model with role-based UX. Scope and extensibility differ between Public Edition (standardised) and Private Edition (closer to classic on-premises flexibility).
GROW and RISE packaging
SAP GROW targets organisations starting on standardised AI-enabled cloud ERP. RISE with SAP supports existing on-premises customers migrating toward cloud with transformation services. Packaging choice drives implementation shape more than feature marketing slides.
Integration via SAP BTP
SAP Business Technology Platform and Integration Suite provide APIs, iPaaS connectivity, and extension points to link SAP ERP with third-party and legacy systems. Expect integration projects rather than plug-and-play SMB connectors.
Selectable cloud regions and sovereign options
Customers can choose data center regions; SAP documents Americas, Europe, and Asia Pacific availability, including SAP-operated German sites and hyperscaler regions. Sovereign / regulated options (for example German IT-Grundschutz messaging for SAP-owned facilities) exist but must be contracted explicitly.
Trust Center compliance artifacts
SAP publishes ISO 27001, SOC, C5, and other certificates plus DPAs through the Trust Center and customer portals. Audit reports for specific services are often gated to customers rather than fully public PDFs.

Assurance & compliance: Hetzner vs SAP
Assurance & compliance	Hetzner	SAP
Independent security / no-logs audit	Not applicable Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.	Not applicable ERP suite; not a no-logs privacy network product. Rely on SOC/ISO/C5 attestations instead.
ISO 27001	Verified ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.	Vendor claimed Trust Center lists ISO 27001 certificates for cloud services and publishes certificate finder entries (e.g. Central / Enterprise Cloud Services).
SOC 2 / SOC 3	Not found Hetzner states focus on ISO 27001 rather than SOC 2 for international market.	Vendor claimed SOC 1 and SOC 2 reports described on Trust Center; many reports customer-gated via SAP for Me / My Trust Center.
GDPR / EU data protection	Vendor claimed German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.	Vendor claimed EU parent entity; Trust Center privacy pages and DPAs reference GDPR processing terms.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.	Partial German SAP SE parent with no known US parent, but Enterprise Cloud Services explicitly include AWS, Azure, and GCP paths. Medium exposure for hyperscaler-backed tenants. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.	Vendor claimed SAP states it signs DPAs; Trust Center hosts Data Processing Agreement documents for cloud, support, and professional services.
EU AI Act	Not applicable Infrastructure hosting, not an AI system product.	Partial SAP publishes EU AI Act governance materials for Joule Agents and AI features; customer still must assess in-scope AI uses.
BSI C5 (cloud)	Verified Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).	Not listed
KRITIS / section 8a BSIG	Vendor claimed Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.	Not listed
BSI C5	Not listed	Vendor claimed Trust Center lists Cloud Computing Compliance Controls Catalogue (C5) audit reports among EU regional offerings.

Considerations & known limitations: Hetzner vs SAP
Considerations & known limitations	Hetzner	SAP
Optional US and Singapore cloud regions	Medium Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.	Not listed
Unmanaged cloud and dedicated servers	Medium You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.	Not listed
Narrower managed-service catalog vs hyperscalers	Low Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.	Not listed
ISO scope is DE/FI parks	Low Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.	Not listed
Hyperscaler hosting is common	Not listed	Medium Even with a German parent, many cloud tenants run on AWS, Azure, or GCP. EU region selection does not remove US-group infrastructure operators from the path. Confirm contracted region and subprocessors.
Heavy implementation programmes	Not listed	Medium S/4HANA and RISE projects typically need partners, data migration, and process redesign. Poor fit if you expected self-serve SaaS onboarding.
Detailed subprocessor lists often customer-gated	Not listed	Low Public pages confirm lists exist on My Trust Center, but a full anonymous dump was not available in this research pass. Request the list for your exact cloud service before security sign-off.
Catalog category is Cloud Computing, not ERP	Not listed	Low EuropeanStack has no dedicated ERP category yet. This entry is filed under Cloud Computing as the closest existing slug.

Fit

Hetzner

Best fit when

Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
Policies that forbid any US subsidiary, US colocation, or optional US region at group level
Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.

SAP

Best fit when

Midsize to large enterprises consolidating finance, supply chain, and procurement on one ERP
Organisations that need deep industry process templates and multi-country localisation
Buyers that require a German / EU parent contracting entity plus formal Trust Center attestations
Existing SAP ECC customers planning a RISE or S/4HANA transformation
Teams with budget for partner-led implementation rather than pure self-serve SaaS

Poor fit when

Startups or SMBs needing only simple invoicing without ERP programme overhead
Buyers that require a guaranteed EU-only, non-hyperscaler hosting path without reading the contract region
Teams seeking an open-source ERP they can fork and fully self-operate without vendor lock-in
CRM-first organisations where Salesforce-class customer platforms are the real system of record

Consider instead when

When: Your primary system of record is CRM and revenue operations, not manufacturing or complex finance
Consider: Salesforce
Stronger CRM depth; US parent and different compliance posture.
When: You already standardise on Microsoft identity, M365, and Azure and want ERP in that estate
Consider: Microsoft 365 / Azure-centric Dynamics stacks
Compare total cost of identity + productivity + ERP under one US vendor.
When: You need a smaller European mid-market ERP without S/4HANA transformation scope
Consider: Evaluate EU mid-market ERP vendors outside this catalog (no peer ERP slug listed yet)
Catalog currently lacks a direct European ERP alternative entry.

Open questions for due diligence

Hetzner

Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?

SAP

Which exact cloud service and region would this buyer contract (Public Edition vs Private Edition vs RISE on which hyperscaler)?
Will the order form be with SAP SE or a local affiliate, and which governing law clause applies?
Can the vendor provide the current subprocessor list and SOC/C5 reports for the specific service code without an existing customer login?