Hetzner vs Hostinger

Vergelijk Hetzner en Hostinger op mogelijkheden, rechtsgebied, waarborgen en geschiktheid voor Europese kopers.

Beide vermeld als alternatief voor: DigitalOcean

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud

Bekijk vermelding Bezoek Website

Hostinger

Lithuania· Cloud Computing

Needs review

Shortlist Hostinger when you want managed WordPress or a simple KVM VPS with an EU data-center option and a published DPA. Skip it when you need HIPAA or PCI, an EU-only data path, or a custom enterprise SLA. Consider Hetzner or OVHcloud instead for more operator-centric European infrastructure.

EU-operated (Cyprus contract)ISO 27001 (claimed)Managed WordPressKVM VPS + public APIPublic DPASelectable EU data centers

Bekijk vermelding Bezoek Website

Gemarkeerde rijen verschillen tussen de twee producten.

Hetzner vs Hostinger: Overzicht
Kenmerk	Hetzner	Hostinger
Land van herkomst	Germany	Lithuania
Categorie	Cloud Computing	Cloud Computing
Open source	Nee	Nee
Self-hosted	Nee	Nee
Hoofdkantoor	Germany	Lithuania
Juridische entiteit	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)	EU customers: Hostinger International Ltd (Cyprus). Affiliates: HOSTINGER, UAB and HOSTINGER operations, UAB (Vilnius). Also Hostinger UK Limited and Hostinger Global S.a r.l. (Luxembourg).
VS-moeder / zeggenschap	Geen bekende VS-moeder	Geen bekende VS-moeder
CLOUD Act-blootstelling (indicatief)	Middel	Middel
Hosting / residentie	Owned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.	Customer-chosen DCs: FR, DE, LT, NL, UK plus US (Phoenix, Boston, Asheville), Brazil, India, Indonesia, Malaysia (plan-dependent). DPA subprocessors include AWS EMEA SARL, Google Cloud EMEA Limited, Cloudflare, Inc., MailChannels, Proofpoint, Inc., Anthropic Ireland, and spectra tech UAB. Privacy policy also names Google Analytics, Meta ads, Ravelin, and iDenfy.
Samenvatting	German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.	Lithuania-founded web hosting for WordPress, managed cloud, and KVM VPS, with selectable European data centers and Cyprus contracting for EU customers.
Tags	vps gdpr cloud dedicated-servers hosting germany data-center bare-metal self-hosting iso-27001 c5 hetzner-cloud	vps gdpr web-hosting wordpress kvm cloud-hosting domains lithuania

In één oogopslag: Hetzner vs Hostinger
In één oogopslag	Hetzner	Hostinger
HQ	Gunzenhausen, Germany	Niet vermeld
Legal entity	Hetzner Online GmbH (HRB 6089 Ansbach)	Niet vermeld
EU parks	Nuremberg, Falkenstein (DE); Helsinki (FI)	Niet vermeld
Optional cloud regions	Ashburn and Hillsboro (US); Singapore	Niet vermeld
Model	IaaS / dedicated / hosting (unmanaged cloud and root)	Niet vermeld
Open source	No (commercial infrastructure)	Niet vermeld
HQ / operations	Niet vermeld	Vilnius, Lithuania (also Kaunas; Yogyakarta office)
EU contracting entity	Niet vermeld	Hostinger International Ltd (Larnaca, Cyprus)
Founded	Niet vermeld	2004 as Hosting Media; Hostinger brand in 2011
Product shape	Niet vermeld	Managed web/WordPress, managed cloud, KVM VPS, domains, email
Open source / self-host	Niet vermeld	Neither. Proprietary platform; VPS guests are customer-managed
Commercial model	Niet vermeld	Prepaid subscription with auto-renew; 30-day money-back on eligible hosting

Key capabilities: Hetzner vs Hostinger
Key capabilities	Hetzner	Hostinger
EU-operated (DE HQ)	Ja	Ja
Owned DE/FI parks	Ja	Niet vermeld
ISO 27001:2022	Ja	Ja
BSI C5 Type 2	Ja	Niet vermeld
Bare metal + auction	Ja	Niet vermeld
Optional US/SG cloud	Ja	Niet vermeld
Managed WordPress	Niet vermeld	Ja
KVM VPS + public API	Niet vermeld	Ja
Public DPA	Niet vermeld	Ja
Selectable EU data centers	Niet vermeld	Ja

Hetzner

Dedicated root servers and Server Auction
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
Hetzner Cloud with API, networks, and apps
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Owned EU data center parks plus optional US/Singapore cloud
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
ISO 27001, BSI C5 Type 2, and console DPA
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Inclusive traffic-oriented European cloud pricing model
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

Hostinger

Selectable European and global data centers
Web and cloud plans can be placed in France, Germany, Lithuania, the Netherlands, or the United Kingdom, or in the United States, Brazil, India, Indonesia, or Malaysia. VPS omits the Netherlands. Location is chosen at setup and can be moved later on web and cloud, but not on VPS without rebuild.
Managed WordPress on LiteSpeed and hPanel
Plans include one-click install, staging, automatic updates, malware scanning, WAF, Let's Encrypt, WP-CLI, SSH, and Git. WordPress.org lists Hostinger as a recommended host. Shared plans isolate accounts with CloudLinux LVE. Not a self-hosted WordPress appliance you run elsewhere.
KVM VPS with root, templates, and a public API
KVM guests use AMD EPYC and NVMe, weekly backups, snapshots, a managed firewall, Wanguard DDoS filtering, and one-click OS or app templates (Docker, n8n, Ubuntu, and others). A documented public API and MCP server support automation. The guest is unmanaged: you patch the OS.
Managed cloud with dedicated IP and NVMe
Cloud plans keep hPanel and add more CPU, RAM, NVMe, PHP workers, inode headroom, a dedicated IP, CDN, and daily or on-demand backups. Aimed at agencies and busier WordPress or Node.js sites that do not want root. Upgrade path from shared hosting is in-panel.
In-house hPanel, Access Manager, and migrations
hPanel is Hostinger's control plane for sites, DNS, mail, backups, and collaborators. Access Manager shares scoped access without handing over the account password. Website migration is a supported request flow for common CMS stacks. Developer tools (SSH, Git, PHP versions) live in the same panel.
Public DPA with a named sub-processor list
A click-through DPA covers hosting, VPS, email, domains, Website Builder, Horizons, and Reach. Appendix 3 lists AWS EMEA, Google Cloud EMEA, Cloudflare, MailChannels, Proofpoint, Anthropic Ireland, and spectra tech UAB. New sub-processors can be added with a 10-day objection window.

Assurance & compliance: Hetzner vs Hostinger
Assurance & compliance	Hetzner	Hostinger
Independent security / no-logs audit	Not applicable Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.	Not found Vendor describes internal pentests and a HackerOne-style responsible disclosure programme. No public independent audit PDF found.
ISO 27001	Verified ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.	Vendor claimed Trust Center and security article claim ISO/IEC 27001:2022. Certificate download requires Trust Center access. Not independently verified here.
SOC 2 / SOC 3	Not found Hetzner states focus on ISO 27001 rather than SOC 2 for international market.	Not found No public SOC 2 or SOC 3 report found on Trust Center overview or legal pages.
GDPR / EU data protection	Vendor claimed German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.	Vendor claimed EU/UK/Luxembourg contracting entities; privacy policy cites GDPR; DPA includes EU SCCs and UK addendum. Confirm entity on the invoice.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.	Partial European group, no known US parent. Exposure is medium because customers may select US data centers and the DPA names US-group processors (AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint). Not legal advice.
Data processing agreement (B2B)	Vendor claimed Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.	Vendor claimed Public DPA incorporated into the Terms of Service. Parties: Hostinger International Ltd, Hostinger UK Limited, or Hostinger Global S.a r.l.
EU AI Act	Not applicable Infrastructure hosting, not an AI system product.	Not applicable Core product is hosting. Horizons, Kodee, and Reach are AI features inside that product, not an AI-centric system of record.
BSI C5 (cloud)	Verified Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).	Niet vermeld
KRITIS / section 8a BSIG	Vendor claimed Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.	Niet vermeld
HIPAA / PCI environment	Niet vermeld	Not applicable Hosting agreement: services are not intended to provide a PCI or HIPAA compliant environment.

Considerations & known limitations: Hetzner vs Hostinger
Considerations & known limitations	Hetzner	Hostinger
Optional US and Singapore cloud regions	Medium Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.	Niet vermeld
Unmanaged cloud and dedicated servers	Medium You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.	Niet vermeld
Narrower managed-service catalog vs hyperscalers	Low Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.	Niet vermeld
ISO scope is DE/FI parks	Low Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.	Niet vermeld
Optional non-EU hosting regions	Niet vermeld	Medium US, Brazil, and Asia data centers are first-class options. An operator can place production outside the EEA at checkout. Lock region in procurement if residency is required.
US-group cloud, CDN, email, and security vendors	Niet vermeld	Medium Even an EU VM still depends on AWS EMEA, Google Cloud EMEA, Cloudflare, Proofpoint, MailChannels, plus Google/Meta marketing tools. This is why CLOUD Act exposure is not low.
Cyprus contract vs Lithuanian operations	Niet vermeld	Low HQ and affiliates are Lithuanian; EU paper is usually Hostinger International Ltd (Cyprus). Invoices may also be charged by other group entities. Confirm the contracting party before security review.
ISO 27001 certificate not independently verified here	Niet vermeld	Low The cert is claimed on the Trust Center but gated. Download it before treating ISO as verified.
Customer still owns CMS, guest OS, and backups	Niet vermeld	Medium VPS is unmanaged. Terms require you to keep your own backups even when Hostinger offers weekly copies. Shared and cloud plans are not HIPAA/PCI environments.

Geschiktheid

Hetzner

Best fit when

Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
Policies that forbid any US subsidiary, US colocation, or optional US region at group level
Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.

Hostinger

Best fit when

SMBs and creators who want domain, SSL, mail, and a WordPress or builder site in one hPanel
Teams that can pick an EU data center (FR, DE, LT, NL, or UK) and still accept named US-group subprocessors
Agencies managing multiple client WordPress sites on Hostinger Pro or cloud plans
Developers who want a straightforward KVM VPS with templates, weekly backups, and a public API
Buyers who need a click-through DPA and published sub-processor list before legal review

Poor fit when

Workloads that require a HIPAA or PCI environment (explicitly excluded in the hosting agreement)
Organisations that mandate EU-only processing with no US-group cloud, CDN, email, or analytics vendors
Buyers who need a custom enterprise SLA, dedicated account team, or AWS/GCP-scale IaaS catalog
Operators who need to relocate a VPS between regions without a backup-and-reinstall

Consider instead when

When: You want German-operated dedicated servers, object storage, or more operator-centric VPS without a consumer website-builder overlay
Consider: Hetzner
Hetzner is in the catalog as German web hosting and cloud.
When: You need a large European public cloud with many regions and a stronger IaaS and public-sector posture
Consider: OVHcloud or IONOS
Both are catalog EU clouds; IONOS also covers consumer-style web hosting.
When: You need US-centric SMB WordPress hosting already familiar to North American agencies
Consider: GoDaddy or Bluehost
Different jurisdiction. Useful only if European contracting is not a filter.

Open questions for due diligence

Hetzner

Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?

Hostinger

Which Hostinger group entity will appear on our invoice and DPA counterparty line?
Can we obtain the ISO/IEC 27001:2022 certificate and statement of applicability without NDA friction?
Which subprocessors and regions actually touch our account if we pin web hosting to Lithuania or Germany and disable AI, Reach, and Dark Web Monitor?
Is a SOC 2 or equivalent report available under NDA?
What is the exact SLA credit process and exclusion list for our plan versus the 99.9% marketing figure?