Hetzner Object Storage vs OVHcloud

IaaS object store, not a no-logs VPN. Company publishes ISO 27001, BSI C5 Type 2, and annual TOM review instead.

IaaS/hosting provider, not a no-logs VPN product. Security is covered via ISO/SOC programme rather than a public no-logs audit.

Public ISO/IEC 27001:2022 certificate (SOCOTEC) for the ISMS covering Nuremberg, Falkenstein, and Helsinki parks. Confirm attested scope includes this SKU with your auditor.

Vendor compliance pages assert ISO/IEC 27001 (with 27017/27018) for cloud services and datacentres; US pages reference Schellman certificate directory. Confirm current scope per product and region.

Hetzner states it focuses on ISO 27001 rather than SOC 2.

Vendor asserts SSAE 18 Type 2 SOC 1, SOC 2 (+NIST), and SOC 3 attestations; reports available to prospective customers under vendor process.

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data stored in buckets.

EU headquartered; GDPR compliance asserted; DPA documents published for relevant subsidiaries. Residency depends on chosen region.

EU entity, no known US parent, Object Storage has no US region and no US-group storage backend. Group still includes Hetzner US LLC for other products. Not legal advice.

French group with no known US parent, but operates US datacentres (Vint Hill, Hillsboro) and OVH US LLC. Medium indicative exposure: EU-region workloads on EU contracts differ from US-region workloads. Not legal advice.

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Published DPAs form part of terms (e.g. OVH SAS Europe paths; separate US DPA for OVH US LLC). Obtain the DPA matching your contracting entity.

Object storage infrastructure, not an AI system product.

Core product is IaaS/bare metal/hosting; AI/ML platforms are optional infrastructure offerings, not a single AI system product under typical procurement framing.

Vendor publishes a BSI C5 Type 2 attestation PDF for cloud services. Confirm whether Object Storage is inside the attested cloud-service scope.

Hosted Private Cloud (VMware on OVHcloud and related) holds SecNumCloud qualification; hosted in French sites (Roubaix, Gravelines, Strasbourg). Not all products are SecNumCloud-qualified.

Vendor lists HDS certification for healthcare data hosting options; confirm which products and locations are in scope.

Vendor asserts PCI DSS Level 1 certification for payment data hosting—confirm applicability to your architecture.

Supported-actions list omits website hosting, notifications, inventory, replication, custom domains, SSE-KMS, and more. CopyObject may fail even in one location. Apps that assume full AWS S3 will break.

Standard HDD only, no archive or flash classes. Hetzner says it is a poor fit for high-frequency small objects, low-latency apps, and large-scale public HTTP. Plan a CDN or different storage for those cases.

Objects are not encrypted at rest unless you use SSE-C and keep the key. Lost keys are unrecoverable. SSE-C copy is unsupported.

A bucket lives in one DC. There is no first-party cross-location replication. You must build DR yourself if one park outage is unacceptable.

Vendor docs describe cluster growth, bucket migrations, and temporary concurrency or upload limits (including 503 in Nuremberg under load). Shared tenancy can affect latency.

This SKU is EU-only, but Hetzner Online GmbH has US and Singapore subsidiaries for other Cloud locations. Zero-US-footprint procurement may still reject the vendor.

US East/West datacentres and OVH US LLC mean CLOUD Act and US process risk apply to US-placed data and some contracts. EU-only deployment reduces this but buyers must enforce region and contracting path.

A major fire at SBG caused widespread customer outages. Treat multi-AZ/multi-region backup design as mandatory for critical data; do not rely on single-site assumptions.

ISO, SOC, HDS, SecNumCloud, and PCI claims do not automatically cover every SKU and location. Procurement should request the exact report for the services ordered.

Vendor documents unmetered traffic exceptions for Asia-Pacific (lower default bandwidth and monthly volume caps vs Europe/North America). Model egress and bandwidth options for APAC workloads.

Bare Metal, Public Cloud, Private Cloud, and Web Cloud under one brand can confuse account structure, IAM, and billing. Define landing-zone standards early.