Server hosting
Hetzner privacy rating
German provider of cloud servers, dedicated servers and storage, with its own datacenters in Germany and Finland and cloud locations in the US and Singapore.
Summary
Hetzner scores 48 out of 100 (grade D) on the server hosting criteria. It meets 4 of 12 criteria: no ads or data sales, TLS configuration, Reverse DNS and IPv6. It partly meets no trackers or telemetry, independent audit, security headers and mail-friendly (port 25). It does not meet open source, transparency report, tells users about requests and anonymous payment. It is based in Germany: Fourteen Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.
Score 48 out of 100. How scoring works
Criteria
- No
-
Partial
No trackers or telemetry Weight 3 of 3
Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
No third-party trackers, but website analytics use Matomo with cookies after consent.
-
Yes
No ads or data sales Weight 2 of 3
Is the product funded without advertising, ad targeting or selling user data?
Funded by paid hosting, and the privacy policy says data is not passed to third parties unless specified.
-
Partial
Independent audit Weight 2 of 3
Has an independent security or privacy audit been published within the last three years?
Only a one-page summary of the BSI C5 Type 2 audit and an ISO 27001 certificate are public.
-
No
Transparency report Weight 2 of 3
Does the provider regularly publish how many government and legal requests it receives and how it responds?
No transparency report or government request policy is published.
-
No
Tells users about requests Weight 1 of 3
Does the provider promise to tell users about requests for their data, unless a court forbids it?
No published policy on notifying users about data requests.
-
Partial
Mail-friendly (port 25) Weight 1 of 3
Is outbound port 25 open by default, or opened on request?
Ports 25 and 465 are blocked on cloud servers by default and can be unblocked on request after the first paid invoice.
-
Yes
Reverse DNS Weight 1 of 3
Can reverse DNS (PTR) records be set for IPv4 and IPv6?
rDNS entries for IPv4 and IPv6 are set in the Hetzner Console.
- Yes
-
No
Anonymous payment Weight 1 of 3
Can servers be paid for with cryptocurrency or without identity checks?
Cryptocurrency is not accepted.
Automated tests
-
Yes
TLS configuration Weight 2 of 3
Does the website pass the Qualys SSL Labs test with a grade of A or better?
Grade A+
-
Partial
Security headers Weight 1 of 3
Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
Grade B (75/100+)
-
Not tested yet
Modern web standards Weight 1 of 3
Does the website score 90% or higher on the Internet.nl website test?
Not tested yet.
New accounts must wait about a month before asking to open port 25.