16 ms·

I hope they created an offspring company with no access to the Hetzner main infrastructure. It would be very inconvenient to lose the "hosted in Germany" - a.k.

I hope they created an offspring company with no access to the Hetzner main infrastructure. It would be very inconvenient to lose the "hosted in Germany" - a.k.a. "not accessible data for the US" - aspect in terms of GDPR.

e61133e3 4y ago
Same... hope to see a response from Hetzner on this!
ukutaht 4y ago
Yes, very important to understand the corporate structure and legal implications wrt to GDPR and the Schrems II decison.
q-base 4y ago
To the best of my knowledge, this is already too late. I remember reading through their FAQ and seeing that hence they now have a US-based owner, they are then within reach of US 3-letter agencies.
- shafyy 4y ago
  I can't find any info that they are owned by a US company. Can you link to a source?
  - formerly_proven 4y ago
    Hetzner is owned by a holding company owned by Ensoxx and Ensoxx is Martin Hetzner's company as far as I can tell.
    - hnbad 4y ago
      That seems to be correct. My understanding (IANAL) of Schrems II is that the problem exists when a EU datacenter is under the direct or indirect control of a US company. Indirect in this case meaning operated by a EU company that is the subsidiary of a US company, as is the case with AWS, Google and Microsoft. Since the EU datacenters seem to be operated by EU companies and the US company is merely a sibling subsidiary of Ensoxx, which itself is also an EU company, this should provide sufficient isolation to prevent interference from US agencies short of direct sabotage or espionage (since the EU staff is not in the chain of command of the US company). So for a definitive answer you probably want your lawyers to talk to Hetzner's lawyers but at face value this is at least miles ahead of any US-based cloud provider, which in all honesty is still the default solution for most EU-based companies despite this ruling.
  - q-base 4y ago
    From here: https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/ https://docs.hetzner.com/general/general-terms-and-condition... Conclusion: In summary, you as a customer do have influence - to a certain extent - on shaping who has access to the data on your servers. EU and US authorities do have to follow the laws and legal procedures in requesting data. However, this may give you a false sense of security since some authorities have been known to stretch or violate agreements. If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you. Since Hetzner US LLC is part of the Hetzner Group, there certainly is a connection. We hope that we have explained things clearly from our point of view using the two above case studies.
    - shafyy 4y ago
      Ok, but: "US authorities do not have direct access to your server or its content in the EU. US authorities have to comply with the regulations of the EU legislation.". So, because Hetzner is not owned by a US company, stuff like the CLOUD act doesn't apply to them. So, if you have a contract with the German entity of Hetzner and use a German server, you should be fine in terms of GDPR.
      - q-base 4y ago
        I think it depends on how you read the Schrems II ruling and how you read Hetzners words. Any of the big cloud providers can claim that they comply with EU legislation, but they also have to comply with US-legislation and if 3-letter agency wants to have some data from one of their subsidiaries in EU, then they can/will decide which contract to breach. I read Hetzners statements as being that they can no longer guarantee that they will not be forced to do the same - but that can be my reading of their statement that is wrong. If I already had them as hosting-partner for a solution that fell under Schrems II, I would have them confirm this, to be sure.
        deleted 4y ago
        [deleted]
      - 4y ago
- codethief 4y ago
  Hetzner Online GmbH and Hetzner Cloud GmbH are fully owned (resp. majority-owned) by ENSoXX Holding AG of which Martin Hetzner is the CEO and which seems to be the parent company[0]. I cannot find any indication in the publicly available documents that any US company (or any other company for that matter) holds more than a 25% share in ENSoXX Holding AG. (25% is the reporting threshold.) In the 2022 annual financial statement they do mention expanding to the US, though they don't go into the legal details. As the link posted in the cousin comment mentions, though: > Hetzner US LLC, as a subsidiary of Hetzner Online GmbH, provides data center services within the USA for the parent company, Hetzner Online.[2] So there is no US owner. [0]: https://www.northdata.de/Hetzner+Online+GmbH,+Gunzenhausen/Amtsgericht+Ansbach+HRB+6089 https://www.northdata.de/Hetzner+Online+GmbH,+Gunzenhausen/A... [1]: https://www.unternehmensregister.de/ https://www.unternehmensregister.de/ (enter "ENSoXX Holding AG" in the text field) [2]: https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/ https://docs.hetzner.com/general/general-terms-and-condition...
  - PaywallBuster 4y ago
    Quite impressive the numbers they're doing 78M profit on 290M revenue (See [0] above) _ edited figures _
    - codethief 4y ago
      I see 78M on 290M EUR but yeah, still very impressive!
    - yread 4y ago
      It's insane that they are so cheap and they could still have a third lower prices and not lose money somehow
      - openplatypus 4y ago
        Makes you wonder how much you are overpaying on AWS.
      - wongarsu 4y ago
deleted 4y ago
[deleted]
Kiro 4y ago
How can AWS claim they are GDPR compliant?
- Sander_Marechal 4y ago
  They can't really, since the Schrems II decision.
devn0ll 4y ago
It is because of this, I had to move four of my customers away from Hetzner. Since they just did not want to be in the "sphere of US influence". Choices for EU only companies are getting smaller, and this is a real let-down.
- s_dev 4y ago
  Some choices: https://european-alternatives.eu/category/cloud-computing-platforms https://european-alternatives.eu/category/cloud-computing-pl...
  - aflukasz 4y ago
    Non of them deliver equivalence of big cloud providers. Also, track record of at least some of them is not the best, if we are to believe, for example, comments on HN. I've made initial research about most of them. Just to give some examples about Scaleaway: prices moving up by 75% without notice (https://news.ycombinator.com/item?id=25999148 https://news.ycombinator.com/item?id=25999148), zero notice of the removal of the ability to start ARM64 instances (https://news.ycombinator.com/item?id=22923413 https://news.ycombinator.com/item?id=22923413).
    - sofixa 4y ago
      As a counterpoint, i quite like Scaleway. I've been using them for a few years for a personal Kubernetes cluster, with some random experiments with their serverless and managed database offerings, and i didn't have any issues (for my minimal workloads). They've changed pricing quite a few of times which is far from ideal, but I accept that situations evolve (e.g. the latest one is due to the massive increase in electricity costs in France). Even with all the changes they're still cheaper than many of the alternatives, so it's still "a win".
- aflukasz 4y ago
  This is becoming ridiculous. Sure, I may deploy to EU based provider, but then they will get bought or, like Hetzner, expand to USA, and now my business is at a legal risk all of a sudden.

e61133e3 4y ago

Same... hope to see a response from Hetzner on this!

ukutaht 4y ago

Yes, very important to understand the corporate structure and legal implications wrt to GDPR and the Schrems II decison.

q-base 4y ago

To the best of my knowledge, this is already too late. I remember reading through their FAQ and seeing that hence they now have a US-based owner, they are then within reach of US 3-letter agencies.

shafyy 4y ago
I can't find any info that they are owned by a US company. Can you link to a source?
- formerly_proven 4y ago
  Hetzner is owned by a holding company owned by Ensoxx and Ensoxx is Martin Hetzner's company as far as I can tell.
  - hnbad 4y ago
    That seems to be correct. My understanding (IANAL) of Schrems II is that the problem exists when a EU datacenter is under the direct or indirect control of a US company. Indirect in this case meaning operated by a EU company that is the subsidiary of a US company, as is the case with AWS, Google and Microsoft. Since the EU datacenters seem to be operated by EU companies and the US company is merely a sibling subsidiary of Ensoxx, which itself is also an EU company, this should provide sufficient isolation to prevent interference from US agencies short of direct sabotage or espionage (since the EU staff is not in the chain of command of the US company). So for a definitive answer you probably want your lawyers to talk to Hetzner's lawyers but at face value this is at least miles ahead of any US-based cloud provider, which in all honesty is still the default solution for most EU-based companies despite this ruling.
- q-base 4y ago
  From here: https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/ https://docs.hetzner.com/general/general-terms-and-condition... Conclusion: In summary, you as a customer do have influence - to a certain extent - on shaping who has access to the data on your servers. EU and US authorities do have to follow the laws and legal procedures in requesting data. However, this may give you a false sense of security since some authorities have been known to stretch or violate agreements. If you require a web hosting company that has absolutely no connections to the USA, then unfortunately, we may no longer be the best choice for you. Since Hetzner US LLC is part of the Hetzner Group, there certainly is a connection. We hope that we have explained things clearly from our point of view using the two above case studies.
  - shafyy 4y ago
    Ok, but: "US authorities do not have direct access to your server or its content in the EU. US authorities have to comply with the regulations of the EU legislation.". So, because Hetzner is not owned by a US company, stuff like the CLOUD act doesn't apply to them. So, if you have a contract with the German entity of Hetzner and use a German server, you should be fine in terms of GDPR.
    - q-base 4y ago
      I think it depends on how you read the Schrems II ruling and how you read Hetzners words. Any of the big cloud providers can claim that they comply with EU legislation, but they also have to comply with US-legislation and if 3-letter agency wants to have some data from one of their subsidiaries in EU, then they can/will decide which contract to breach. I read Hetzners statements as being that they can no longer guarantee that they will not be forced to do the same - but that can be my reading of their statement that is wrong. If I already had them as hosting-partner for a solution that fell under Schrems II, I would have them confirm this, to be sure.
      - deleted 4y ago
        [deleted]
    - 4y ago
codethief 4y ago
Hetzner Online GmbH and Hetzner Cloud GmbH are fully owned (resp. majority-owned) by ENSoXX Holding AG of which Martin Hetzner is the CEO and which seems to be the parent company[0]. I cannot find any indication in the publicly available documents that any US company (or any other company for that matter) holds more than a 25% share in ENSoXX Holding AG. (25% is the reporting threshold.) In the 2022 annual financial statement they do mention expanding to the US, though they don't go into the legal details. As the link posted in the cousin comment mentions, though: > Hetzner US LLC, as a subsidiary of Hetzner Online GmbH, provides data center services within the USA for the parent company, Hetzner Online.[2] So there is no US owner. [0]: https://www.northdata.de/Hetzner+Online+GmbH,+Gunzenhausen/Amtsgericht+Ansbach+HRB+6089 https://www.northdata.de/Hetzner+Online+GmbH,+Gunzenhausen/A... [1]: https://www.unternehmensregister.de/ https://www.unternehmensregister.de/ (enter "ENSoXX Holding AG" in the text field) [2]: https://docs.hetzner.com/general/general-terms-and-conditions/data-privacy-faq/ https://docs.hetzner.com/general/general-terms-and-condition...
- PaywallBuster 4y ago
  Quite impressive the numbers they're doing 78M profit on 290M revenue (See [0] above) _ edited figures _
  - codethief 4y ago
    I see 78M on 290M EUR but yeah, still very impressive!
  - yread 4y ago
    It's insane that they are so cheap and they could still have a third lower prices and not lose money somehow
    - openplatypus 4y ago
      Makes you wonder how much you are overpaying on AWS.
    - wongarsu 4y ago

deleted 4y ago

[deleted]

Kiro 4y ago

How can AWS claim they are GDPR compliant?

Sander_Marechal 4y ago
They can't really, since the Schrems II decision.

devn0ll 4y ago

It is because of this, I had to move four of my customers away from Hetzner. Since they just did not want to be in the "sphere of US influence". Choices for EU only companies are getting smaller, and this is a real let-down.

s_dev 4y ago
Some choices: https://european-alternatives.eu/category/cloud-computing-platforms https://european-alternatives.eu/category/cloud-computing-pl...
- aflukasz 4y ago
  Non of them deliver equivalence of big cloud providers. Also, track record of at least some of them is not the best, if we are to believe, for example, comments on HN. I've made initial research about most of them. Just to give some examples about Scaleaway: prices moving up by 75% without notice (https://news.ycombinator.com/item?id=25999148 https://news.ycombinator.com/item?id=25999148), zero notice of the removal of the ability to start ARM64 instances (https://news.ycombinator.com/item?id=22923413 https://news.ycombinator.com/item?id=22923413).
  - sofixa 4y ago
    As a counterpoint, i quite like Scaleway. I've been using them for a few years for a personal Kubernetes cluster, with some random experiments with their serverless and managed database offerings, and i didn't have any issues (for my minimal workloads). They've changed pricing quite a few of times which is far from ideal, but I accept that situations evolve (e.g. the latest one is due to the massive increase in electricity costs in France). Even with all the changes they're still cheaper than many of the alternatives, so it's still "a win".
aflukasz 4y ago
This is becoming ridiculous. Sure, I may deploy to EU based provider, but then they will get bought or, like Hetzner, expand to USA, and now my business is at a legal risk all of a sudden.