# Exoscale privacy rating

Swiss cloud provider, part of the A1 Group, offering compute instances, GPUs, managed Kubernetes, object storage and databases in European zones.

## Summary

Exoscale scores 65 out of 100 (grade C) on the server hosting criteria. It meets 6 of 12 criteria: no trackers or telemetry, no ads or data sales, tells users about requests, TLS configuration, mail-friendly (port 25) and IPv6. It partly meets independent audit, transparency report, security headers and Reverse DNS. It does not meet open source and anonymous payment. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A and Mozilla HTTP Observatory grade B.

- Website: https://www.exoscale.com
- Jurisdiction: Switzerland. Not in the Five, Nine or Fourteen Eyes. GDPR-style data protection law.
- Home page trackers: none found
- Category: [Server hosting](https://privacyratings.com/server-hosting/)
- Grade: C (65/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | No | Closed source. |  |
| No trackers or telemetry | Yes | No third-party trackers. Website analytics run in a cookieless mode and measure visits anonymously. | https://www.exoscale.com/privacy/ |
| No ads or data sales | Yes | Funded by paid cloud services, and the privacy policy says personal information is not sold. | https://www.exoscale.com/privacy/ |
| Independent audit | Partial | Exoscale holds a BSI C5 Type 2 attestation and ISO 27001 certification, but the reports are not public. | https://www.exoscale.com/compliance/bsi-c5/ |
| Transparency report | Partial | The abuse page says foreign authorities must use judicial assistance with Switzerland. No request counts are published. | https://www.exoscale.com/abuse/ |
| Tells users about requests | Yes | The terms promise prior notice of compelled disclosure to government authorities, to the extent legally permitted. | https://www.exoscale.com/terms/ |
| TLS configuration | Yes | Grade A | https://www.ssllabs.com/ssltest/analyze.html?d=portal.exoscale.com&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=portal.exoscale.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| Mail-friendly (port 25) | Yes | Security groups allow all outgoing traffic by default, and no SMTP restriction is documented. | https://community.exoscale.com/product/networking/security-group/overview/ |
| Reverse DNS | Partial | PTR records for instance public IPs and Elastic IPs are set through the API; IPv6 reverse DNS is not documented. | https://community.exoscale.com/reference/api/compute/reverse-dns/ |
| IPv6 | Yes | Every instance includes a free public IPv4 and IPv6 address. | https://www.exoscale.com/pricing/ |
| Anonymous payment | No | Payment is by credit card or PayPal. Cryptocurrency is not accepted. | https://community.exoscale.com/platform/billing/ |

Source: https://privacyratings.com/server-hosting/exoscale/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/server-hosting/exoscale.md