Hetzner vs Seeweb

Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.

IaaS/data-center provider—not a consumer no-logs VPN. Assurance is via ISO/ISMS and sector qualifications rather than a no-logs report.

ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.

Vendor certifications page: ISO/IEC 27001:2022, AXE REGISTER cert IT18-27702D, valid until 28 Nov 2027; locations Milan & Frosinone. Re-verify serial in procurement.

Hetzner states focus on ISO 27001 rather than SOC 2 for international market.

No SOC 2/3 report advertised on the official certifications page at research time.

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.

Italian controller/processor entity, European hosting messaging, privacy policy, ISO 27018 claim, CISPE; confirm DPA for your processing roles.

EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.

Italian Seeweb S.r.l., Italian DHH parent, no known US parent; primary hosting on European DCs (not AWS/GCP/Azure). Third-party Swiss/BG facilities and global transit carriers exist. Indicative only—not legal advice.

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Art. 28 DPA language used for Seeweb-operated services (e.g. published for Regolo); request current signed DPA + TOMs + subprocessors for core cloud/IaaS contracts.

Infrastructure hosting, not an AI system product.

Infrastructure/GPU provider and Rethic.AI partnership messaging; AI Act duties mainly fall on customer AI systems. Not a full provider high-risk AI assessment by EuropeanStack.

Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).

Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Appendix to ISO 27001 certificate on certifications page; same validity window stated.

Vendor states CISPE registry presence and European data storage under the Code (since 31 May 2017 on certifications page).

IaaS qualification for Italian PA; QI2 infrastructure and QC2 for listed products including AI/supercomputing infrastructures (19 Jan 2023 on certifications page).

Stated for Virtual Private Cloud and Foundation Server PRO (6 July 2022 on certifications page).

Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.

You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.

Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.

Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.

Region set is European (IT/CH/BG) with a mid-size operator catalog. Multi-continent apps or niche managed PaaS may force multi-cloud or a larger EU peer.

ISO and ACN claims include certificate numbers and dates on seeweb.it, but EuropeanStack did not re-download every registry PDF. Re-verify serials and scope statements in formal assurance reviews.

Facility partners and network carriers are described on DC pages, but a consolidated customer-content subprocessor list was not found as one public document. Request annex under NDA for regulated workloads.

Vendor documents ~2-minute notice before Spot termination when On-Demand needs capacity. Architect batch/checkpointing; do not run sole critical control planes only on Spot.

Lugano, Zurich, and Sofia are presented via partner facilities (Swisscom, Global Data Centers Switzerland AG, Evolink). Italy-only residency must be contracted explicitly if required.