Hetzner vs TransIP

Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.

IaaS/hosting provider, not a no-logs VPN. Assurance is via ISMS certifications and responsible disclosure (Intigriti), not a public no-logs audit.

ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.

Vendor publishes ISO 27001:2022 PDF (team-blue-nl-bv naming). Independent registry re-check not completed in this draft.

Hetzner states focus on ISO 27001 rather than SOC 2 for international market.

No clear TransIP product-level SOC 2/3 claim found on primary legal/security pages reviewed.

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.

Dutch controller/processor entity; privacy policy and control-panel DPA. Residency depends on selected product/zone.

EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.

EuropeanStack assessment: Dutch entity / no known US parent / NL-first hosting, but privacy names Google Analytics, reCAPTCHA, and PayPal, and OpenStack KB names Equinix colo. Not a vendor safety claim. Not legal advice.

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Processor agreement available to view/accept in the control panel per knowledge base.

Infrastructure hosting, not an AI system product.

Infrastructure hosting/registrar; not marketed as an AI system provider. Optional third-party AI assistant images on VPS are customer-chosen workloads.

Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).

Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.

Vendor publishes NEN 7510:2017 certificate PDF; accounts processing medical data can be marked for extra handling per cert page.

Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.

You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.

Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.

Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.

Brand is TransIP B.V.; certificates use team.blue NL B.V. Procurement should map the exact contracting entity, DPA signatory, and cert scope to the services purchased.

Privacy policy discloses Google Analytics, reCAPTCHA, and PayPal. These are not described as the VPS storage backend, but they affect overall vendor diligence and CLOUD Act style questionnaires.

OpenStack facility list includes Equinix AMS3 (US-parent colo operator). Workloads remain in Amsterdam physically; treat as partial EU-hosted diligence, not AWS-region hosting.

No broad multi-continent region map or hyperscaler-class managed database suite on the pages reviewed. Teams needing those should plan self-managed stacks or another cloud.

Diligence relies on privacy policy, product pages, and DPA rather than a dedicated exhaustive subprocessor HTML table. Request an up-to-date schedule under NDA if required.