Hetzner vs SiteGround

Vergelijk Hetzner en SiteGround op mogelijkheden, rechtsgebied, waarborgen en geschiktheid voor Europese kopers.

Beide vermeld als alternatief voor: Google Cloud Platform

Logo: Hetzner

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud
Bekijk vermeldingBezoek Website
Logo: SiteGround

SiteGround

Bulgaria· Web Hosting and Cloud Computing

Needs review

Shortlist when you want managed WordPress or PHP hosting with an EU or UK contract, a named European Google Cloud region, and Site Tools. Skip when you need EU-owned metal with no US-group cloud. Consider IONOS, OVHcloud, Scaleway, or Hetzner instead in that case.

EU-operated (BG origin, ES/UK contracts)Managed WordPress / PHP hostingGoogle Cloud regions (not EU-only)Site Tools control panelSuperCacherDPA in TOS pack
Bekijk vermeldingBezoek Website

Gemarkeerde rijen verschillen tussen de twee producten.

Hetzner vs SiteGround: Overzicht
KenmerkLogo: HetznerHetznerLogo: SiteGroundSiteGround
Land van herkomstGermanyBulgaria
CategorieCloud ComputingWeb Hosting and Cloud Computing
Open sourceNeeNee
Self-hostedNeeNee
HoofdkantoorGermanyBulgaria
Juridische entiteitHetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)SiteGround Hosting EOOD (BG UIC 204181297). EU: Spain S.L. B-87194171. UK: Hosting Ltd 09348602. US storefront: SG Hosting Inc.
VS-moeder / zeggenschapGeen bekende VS-moederGeen bekende VS-moeder
CLOUD Act-blootstelling (indicatief)MiddelMiddel
Hosting / residentieOwned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.Primary hosting: Google Cloud Platform in customer-chosen SiteGround regions (Europe: Madrid, Eemshaven, Frankfurt, Paris, London; plus US and APAC). CDN: SiteGround CDN on the Google Cloud edge network (global, including US). Backups: vendor says geographically separate / offsite on Cloud. No public dated subprocessor register found. Payments, analytics, and third-party AI models are mentioned in privacy/TOS.
Samenvatting

German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.

Sofia-origin managed web and WordPress hosting on Google Cloud, with Site Tools, SuperCacher, and EU or UK contracting entities depending on storefront.

Tags
gdprcloudvpsdedicated-servershostinggermanydata-centerbare-metalself-hostingiso-27001c5hetzner-cloud
gdprweb-hostingwordpress-hostinggoogle-cloudmanaged-hostingbulgaria
In één oogopslag: Hetzner vs SiteGround
In één oogopslagLogo: HetznerHetznerLogo: SiteGroundSiteGround
HQGunzenhausen, GermanyNiet vermeld
Legal entityHetzner Online GmbH (HRB 6089 Ansbach)Niet vermeld
EU parksNuremberg, Falkenstein (DE); Helsinki (FI)Niet vermeld
Optional cloud regionsAshburn and Hillsboro (US); SingaporeNiet vermeld
ModelIaaS / dedicated / hosting (unmanaged cloud and root)Niet vermeld
Open sourceNo (commercial infrastructure)Niet vermeld
HQ / originNiet vermeldSofia, Bulgaria (founded 2004, privately owned)
EU contractNiet vermeldSiteGround Spain S.L. (CIF B-87194171, Madrid)
UK contractNiet vermeldSiteGround Hosting Ltd (09348602)
BG operating companyNiet vermeldSiteGround Hosting EOOD (UIC 204181297)
US storefrontNiet vermeldSG Hosting Inc. (Delaware)
InfrastructureNiet vermeldGoogle Cloud (customer-chosen region + global CDN)
Control panelNiet vermeldSite Tools (not cPanel)
Open source / self-hostNiet vermeldNo / no
Commercial modelNiet vermeldPrepaid subscription (shared StartUp/GrowBig/GoGeek and Cloud). Confirm live site.
Key capabilities: Hetzner vs SiteGround
Key capabilitiesLogo: HetznerHetznerLogo: SiteGroundSiteGround
EU-operated (DE HQ)JaJa
Owned DE/FI parksJaNiet vermeld
ISO 27001:2022JaNiet vermeld
BSI C5 Type 2JaNiet vermeld
Bare metal + auctionJaNiet vermeld
Optional US/SG cloudJaNiet vermeld
Managed WordPress / PHP hostingNiet vermeldJa
Google Cloud regions (not EU-only)Niet vermeldJa
Site Tools control panelNiet vermeldJa
SuperCacherNiet vermeldJa
DPA in TOS packNiet vermeldJa

Hetzner

  • Dedicated root servers and Server Auction

    Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.

  • Hetzner Cloud with API, networks, and apps

    VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.

  • Owned EU data center parks plus optional US/Singapore cloud

    Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.

  • ISO 27001, BSI C5 Type 2, and console DPA

    Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.

  • Inclusive traffic-oriented European cloud pricing model

    Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

SiteGround

  • Customer-chosen Google Cloud data center

    You pick a SiteGround location at signup and can relocate later from the Client Area (per site on shared plans, per plan on Cloud). Documented European data-center cities include Madrid, Eemshaven, Frankfurt, Paris, and London. US and APAC locations exist on the same map. The fleet runs on Google Cloud. This is not an EU-only host.

  • SuperCacher (NGINX, Dynamic Cache, Memcached)

    SiteGround's own caching stack: NGINX Direct Delivery for static files, Dynamic Cache in RAM for generated pages, and Memcached for database and API objects. All clients manage it in Site Tools > Speed > Caching. It is a host-level accelerator, not a substitute for application-level cache plugins when you need custom rules.

  • Site Tools instead of cPanel

    The company replaced cPanel with its in-house Site Tools panel for DNS, email, PHP, SSL, Git, backups, and caching. Useful if you want a single vendor UI. Poor fit if your runbooks assume WHM/cPanel, standard cPanel plugin hooks, or reseller WHM.

  • WordPress staging on mid-tier and Cloud plans

    A one-click staging copy, edit, and push-to-live flow is documented for GrowBig, GoGeek, and Cloud. The company says it takes an automatic backup before a staging push. StartUp is not listed as including this tool. Pair with the SiteGround Security plugin if you want the vendor's WP hardening pack.

  • Daily backups with self-serve restore

    Site Tools > Security > Backups lists automatic daily copies: up to 30 on shared plans, up to 7 on Cloud. Restores can be full or files/database only. Academy copy says shared backups are stored in a geographically separate location. Premium Backup is a paid add-on. Destination cloud for those copies is not published as a separate provider list.

  • Server-level WAF and AI anti-bot

    The company describes a custom WAF with rules written by its security team for common CMS exploits, plus an AI anti-bot layer that it says blocks large volumes of brute-force traffic before it hits customer sites. These are vendor-operated controls, not a customer-auditable WAF appliance you can export rules from.

Assurance & compliance: Hetzner vs SiteGround
Assurance & complianceLogo: HetznerHetznerLogo: SiteGroundSiteGround
Independent security / no-logs audit
Not applicable

Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.

Not found

No public independent security or no-logs audit PDF found. Vendor describes in-house WAF and AI anti-bot.

ISO 27001
Verified

ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.

Not found

No current SiteGround ISO 27001 certificate found. 2021 staff comment: not certified; rely on Google Cloud certifications.

SOC 2 / SOC 3
Not found

Hetzner states focus on ISO 27001 rather than SOC 2 for international market.

Not found

No SiteGround SOC 2/3 report found. Historical support replies pointed customers at Google Cloud documentation.

GDPR / EU data protection
Vendor claimed

German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.

Vendor claimed

EU/UK entities and public DPA in the TOS pack. Controller depends on storefront (Spain SL vs UK Ltd vs US Inc).

US CLOUD Act exposure (indicative)
Partial

EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.

Partial

European HQ and contracting for EU/UK, no known US parent, but primary infrastructure is Google Cloud (US-group) with optional US regions and a global GCP CDN. Not legal advice.

Data processing agreement (B2B)
Vendor claimed

Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.

Vendor claimed

DPA is incorporated in the TOS pack for EU/UK storefronts.

EU AI Act
Not applicable

Infrastructure hosting, not an AI system product.

Not found

Product includes Coderick AI and AI Studio. No public AI Act classification or compliance statement found. TOS says third-party providers may use Inputs/Outputs to improve models.

BSI C5 (cloud)
Verified

Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).

Niet vermeld
KRITIS / section 8a BSIG
Vendor claimed

Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.

Niet vermeld
Considerations & known limitations: Hetzner vs SiteGround
Considerations & known limitationsLogo: HetznerHetznerLogo: SiteGroundSiteGround
Optional US and Singapore cloud regions
Medium

Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.

Niet vermeld
Unmanaged cloud and dedicated servers
Medium

You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.

Niet vermeld
Narrower managed-service catalog vs hyperscalers
Low

Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.

Niet vermeld
ISO scope is DE/FI parks
Low

Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.

Niet vermeld
Google Cloud as primary infrastructureNiet vermeld
Medium

Since 2020 SiteGround has run hosting on Google Cloud. A European region does not remove US-group cloud exposure. Badging this product as EU-only infrastructure would be wrong.

Contracting entity depends on storefrontNiet vermeld
Medium

The same brand signs as Spain S.L., UK Ltd, or Delaware Inc. depending on scid/region. US privacy.htm names SG Hosting Inc. as controller. Procurement must capture the entity on the order, not the brand name.

Vendor can relocate data centersNiet vermeld
Medium

TOS 4.2 allows SiteGround to move accounts between data centers or jurisdictions for quality, continuity, or security. Non-emergency jurisdiction changes have a 10-day objection window. Emergency moves may happen without prior notice.

No public SiteGround ISO/SOC certificateNiet vermeld
Medium

Assurance for many RFPs will be Google Cloud's reports plus SiteGround's DPA and internal WAF, not a SiteGround ISO 27001 or SOC 2 badge.

Third-party AI may retain Inputs and OutputsNiet vermeld
Medium

TOS 4.6.3: third-party AI providers may store and use Inputs and Outputs to provision and improve models. SiteGround advises against putting confidential or personal data in prompts.

No standalone public subprocessor registerNiet vermeld
Low

Google Cloud is named. A dated annex listing backup, email, support, analytics, and payment subprocessors was not found as a standalone page.

Geschiktheid

Hetzner

Best fit when

  • Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
  • Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
  • Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
  • Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
  • German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

  • Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
  • Policies that forbid any US subsidiary, US colocation, or optional US region at group level
  • Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
  • Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

  • When: You need a broader European cloud portfolio or more managed service surface

    Consider: OVHcloud or Scaleway

    Still European operators; compare regions, bare-metal depth, and support models.

  • When: German public-sector sovereign cloud framing is the primary procurement driver

    Consider: STACKIT

    Different product and governance story; verify current certifications and residency.

  • When: You need hyperscaler managed depth more than EU-owned IaaS

    Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)

    Trade EU operator control for catalog breadth.

  • When: You want a smaller EU regional cloud with a different feature/region mix

    Consider: Exoscale or UpCloud

    Compare locations, SLAs, and managed options against Hetzner's park scale.

SiteGround

Best fit when

  • Agencies and SMBs that want managed WordPress or PHP hosting with 24/7 vendor support and Site Tools instead of raw VMs
  • EU buyers who will contract with SiteGround Spain S.L. and pin production to Madrid, Eemshaven, Frankfurt, or Paris
  • UK buyers who will contract with SiteGround Hosting Ltd and can use the London Google Cloud location
  • Teams that want SuperCacher, daily self-serve restores, and (on GrowBig/GoGeek/Cloud) one-click staging
  • Workloads that already accept Google Cloud as infrastructure and need a managed layer on top

Poor fit when

  • Organisations that ban US-group clouds (AWS/GCP/Azure) regardless of region
  • Buyers who need a public ISO 27001 or SOC 2 certificate in SiteGround's own name
  • Teams whose automation depends on cPanel/WHM rather than Site Tools
  • IaaS, Kubernetes, or root-server use cases better served by IONOS Cloud, OVHcloud, Scaleway, or Hetzner
  • StartUp-plan sites that require staging (documented on GrowBig, GoGeek, and Cloud only)

Consider instead when

  • When: You need EU-owned infrastructure with no Google Cloud or other US-group IaaS underneath

    Consider: IONOS, OVHcloud, Scaleway, or Hetzner

    Those peers are closer to metal or EU public cloud. SiteGround is a managed host on GCP.

  • When: You want a European-origin shared host comparison rather than IaaS

    Consider: Hostinger (catalog incumbent) or Swissnode

    Different panels and footprints. Confirm each operator's contracting entity and hoster.

  • When: You need a current ISO 27001 or SOC 2 report from the hosting brand itself

    Consider: IONOS or another certified EU host after checking their live trust center

    SiteGround staff said in 2021 they were not ISO certified. Relying on GCP certs is not the same as a SiteGround cert.

Open questions for due diligence

Hetzner

  • Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
  • Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
  • Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
  • Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?

SiteGround

  • Which exact legal entity and TOS scid will this order use (Spain S.L., UK Ltd, or US Inc.)?
  • Will SiteGround contractually lock the production region (for example Eemshaven or Madrid) and notify before any jurisdiction change?
  • Can they provide a current subprocessor list covering backups, email, support, analytics, payments, and AI vendors?
  • Is there a current ISO 27001, SOC 2, or other audit letter in SiteGround's name, or only Google Cloud shared-responsibility materials?
  • For AI Studio / Coderick: which model vendors are used, is training on customer Input disabled under a B2B addendum, and is there an AI Act position?