Server hosting
Exoscale privacy rating
Swiss cloud provider, part of the A1 Group, offering compute instances, GPUs, managed Kubernetes, object storage and databases in European zones.
Summary
Exoscale scores 65 out of 100 (grade C) on the server hosting criteria. It meets 6 of 12 criteria: no trackers or telemetry, no ads or data sales, tells users about requests, TLS configuration, mail-friendly (port 25) and IPv6. It partly meets independent audit, transparency report, security headers and Reverse DNS. It does not meet open source and anonymous payment. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B.
Score 65 out of 100. How scoring works
Criteria
- No
-
Yes
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party trackers. Website analytics run in a cookieless mode and measure visits anonymously.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid cloud services, and the privacy policy says personal information is not sold.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Exoscale holds a BSI C5 Type 2 attestation and ISO 27001 certification, but the reports are not public.
-
Partial
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
The abuse page says foreign authorities must use judicial assistance with Switzerland. No request counts are published.
-
Yes
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
The terms promise prior notice of compelled disclosure to government authorities, to the extent legally permitted.
-
Yes
Mail-friendly (port 25) Weight 1 of 3
Is outbound port 25 open by default, or opened on request?
Security groups allow all outgoing traffic by default, and no SMTP restriction is documented.
-
Partial
Reverse DNS Weight 1 of 3
Can reverse DNS (PTR) records be set for IPv4 and IPv6?
PTR records for instance public IPs and Elastic IPs are set through the API; IPv6 reverse DNS is not documented.
-
Yes
IPv6 Weight 1 of 3
Is native IPv6 included?
Every instance includes a free public IPv4 and IPv6 address.
-
No
Anonymous payment Weight 1 of 3
Can servers be paid for with cryptocurrency or without identity checks?
Payment is by credit card or PayPal. Cryptocurrency is not accepted.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.