← Stack

Hetzner

Fixed cost, German jurisdiction, no US CLOUD Act lever on eu-central data: EU infrastructure for self-hosted agent stacks.

Overview

Hetzner Online GmbH is a German internet infrastructure provider founded in 1997, headquartered in Gunzenhausen, Bavaria, privately held by Martin Hetzner with no US parent company. It operates its own datacenters in Nuremberg, Falkenstein and Helsinki (the eu-central network zone) and holds ISO/IEC 27001:2022 certification covering all three sites, plus BSI C5 Type 2 and KRITIS/NIS-2 classification under German law. On jurisdiction: the entity controlling eu-central data has no US parent, so the CLOUD Act (18 U.S.C. § 2713) has no lever on it. US authorities cannot compel Hetzner Online GmbH to produce customer data. Hetzner does operate a US subsidiary (Hetzner, Inc.) for its American colocation sites (ash, hil), but that entity has no access to eu-central infrastructure or data. Honest caveat: beyond US reach is not beyond all reach. German courts and the EU e-Evidence Regulation provide their own legal access paths. Sources: hetzner.com/unternehmen and docs.hetzner.com/general/company-and-policy/information-security-at-hetzner/.

The structural case for Hetzner in an agentic stack is the cost curve. API-per-token pricing from US labs works at low volume but scales poorly when agent workflows run continuously. A CAX21 ARM VM (4 vCPU, 8 GB RAM, ~€10.49/mo post June 2026) carries n8n orchestration, a Qdrant vector store and a PostgreSQL instance for the cost of a few hundred thousand API tokens. The billing is fixed regardless of call volume, and the jurisdiction is fixed to Germany. That combination, fixed cost and fixed jurisdiction, is what makes Hetzner relevant for teams building agentic infrastructure for EU clients. Source: docs.n8n.io/hosting/installation/server-setups/hetzner/ (n8n officially documents Hetzner as a deployment target).

The tradeoff is ops surface. Hetzner is raw compute: a VM or dedicated server with a public IP. You bring the reverse proxy (Traefik, Caddy), the container runtime, the monitoring, the backups and the upgrade cycles. The graduation question is when the monthly cost of ops time exceeds the savings over a managed layer. For teams with Docker fluency and no GPU training need, Hetzner is frequently the right answer. For teams needing GPU cloud (H100, A100) or managed container runtimes, Scaleway is the EU-native alternative to evaluate. For French health data, use an HDS-certified provider: Scaleway offers an HDS-certified product, Hetzner does not. Sources: gartsolutions.com/scaleway-vs-hetzner/ and softwareseni.com/eu-native-cloud-providers-compared.

Architecture

The canonical agentic stack on Hetzner runs as Docker Compose services on a single VM or dedicated server in the eu-central zone. Traefik or Caddy handles reverse proxying and automatic TLS. n8n runs as a container for workflow orchestration, backed by PostgreSQL for persistence. Qdrant (or pgvector on the same Postgres instance) provides vector memory. Ollama or vLLM can be added on AX or GEX servers for local LLM inference. All services communicate on the Docker internal network: only ports 80 and 443 are publicly exposed. Hetzner Object Storage (S3-compatible) or a Storage Box handles offsite backups.

Hetzner eu-centralNuremberg · Falkenstein · Helsinki, no US parent, beyond US CLOUD Act reachReverse proxyTraefik / Caddy: SSL, domain routingn8nworkflow orchestrationQdrant / pgvectorvector memoryOllama / vLLMlocal inference (AX / GEX)optionalObject Storagebackups
Agentic stack on Hetzner eu-central: reverse proxy, n8n orchestration, Qdrant memory, optional local inference and object storage, all on one server with fixed monthly cost.

Key concepts

eu-central
The Hetzner Cloud network zone that contains the three European locations where Hetzner owns its infrastructure: fsn1 (Falkenstein, DE), nbg1 (Nuremberg, DE) and hel1 (Helsinki, FI). The only zone relevant for EU data sovereignty: US (ash, hil) and Singapore (sin) sites are colocation, not Hetzner-owned.
CAX (Arm cloud instance)
Hetzner Cloud VMs running on Ampere Altra ARM processors. Best price-to-compute ratio in the eu-central lineup after the June 2026 price adjustment (CX and CAX tiers saw ~1.3x increase vs CCX/CPX at 2-3x). CAX21 (4 vCPU, 8 GB, ~€10.49/mo post June 2026) is the standard entry for n8n + Qdrant deployments. Most Docker images publish ARM64 builds; verify before deploying.
AX (dedicated AMD server)
Hetzner dedicated servers with AMD Ryzen CPUs. Not cloud VMs: bare metal, sole tenant. The AX102 uses a Ryzen 9 7950X3D (3D V-Cache architecture, 128 GB DDR5, ~€122/mo), which delivers strong CPU throughput for llama.cpp and Ollama inference at fixed cost. AX series runs in Hetzner's own German datacenters.
GEX (GPU dedicated server)
Hetzner dedicated GPU servers. GEX44 (RTX 4000 SFF Ada, 20 GB GDDR6, €184/mo) handles models up to ~32B parameters at 4-bit quantisation. GEX131 (RTX PRO 6000 Blackwell, 96 GB GDDR7) targets training and large-model inference. GPU server prices were unchanged in the June 2026 adjustment. Source: hetzner.com/dedicated-rootserver/matrix-gpu/.
Object Storage
Hetzner S3-compatible object storage, priced at approximately 0.0068 EUR/GB/month. Used for agentic stack backups (n8n workflows, Postgres dumps, Qdrant snapshots). Compatible with any S3-SDK client; no provider lock-in on the application side.

When to use

Good fit

  • Fixed monthly cost replacing per-token billing: sustained agent workflows convert variable API spend into a predictable server bill. A CAX21 (~€10.49/mo) or AX41 (~€44/mo) carries n8n orchestration, Qdrant and PostgreSQL at a cost equivalent to a few hundred thousand API tokens per month, regardless of call volume. Source: docs.n8n.io/hosting/installation/server-setups/hetzner/.
  • EU jurisdiction with no US CLOUD Act exposure at the entity level: Hetzner Online GmbH is a German private company with no US parent. The entity controlling eu-central data carries no CLOUD Act obligation: US authorities cannot compel it to produce customer data under 18 U.S.C. § 2713. Hetzner does operate a US subsidiary (Hetzner, Inc.) for its American colocation sites, but that entity has no access to eu-central data. Honest caveat: beyond US reach is not beyond all reach. German courts and the EU e-Evidence Regulation still apply. See /stack/sovereign-ai for the full jurisdiction decision tree. Sources: hetzner.com/unternehmen/ueber-uns/ and docs.hetzner.com/general/company-and-policy/information-security-at-hetzner/.
  • Full self-hosted agentic stack: n8n, Qdrant, pgvector, Ollama and vLLM all run as Docker containers on Hetzner without modification. The n8n Self-Hosted AI Starter Kit (n8n + PostgreSQL + Ollama + Qdrant) is documented to run on Hetzner. Traefik v3 handles reverse proxying and automatic TLS. One server, one Docker Compose file, one bill. Source: docs.n8n.io/hosting/installation/server-setups/hetzner/.
  • CPU inference at scale: the AX102 dedicated server (Ryzen 9 7950X3D, 128 GB DDR5, ~€122/mo) uses AMD's 3D V-Cache architecture, purpose-suited to the random-access memory pattern of llama.cpp and Ollama. Community benchmarks document running Mixtral and comparable models on the AX52 (~€64/mo). For teams self-hosting a 7B-14B model for internal agent use, the AX series converts GPU costs to a predictable CPU line item. Sources: codref.org/rated-d/run-llm-on-hetzner/ and klymentiev.com/blog/cheap-dedicated-server-2026.
  • Budget-constrained entry point: the CAX21 ARM VM (4 vCPU, 8 GB RAM, ~€10.49/mo post June 2026) is the lowest-cost path to a production-grade agentic stack in EU jurisdiction. It comfortably runs n8n + Qdrant + PostgreSQL with headroom for moderate workflow volume. ARM64 images exist for all major agentic stack components. Upgrade path is linear: CAX31 then dedicated AX41 as volume grows, with no vendor migration, just a new server and the same Docker Compose file.

Anti-patterns

  • Heavy GPU training or large-scale GPU inference: Hetzner's GPU catalogue is limited to two models (GEX44 at 20 GB VRAM, GEX131 at 96 GB VRAM) with restricted availability. For H100 or A100 clusters needed for training runs or high-throughput inference at scale, Scaleway leads the EU GPU cloud market. Availability on Hetzner GEX servers is not guaranteed on demand. Source: gartsolutions.com/scaleway-vs-hetzner/.
  • Managed PaaS needed: Hetzner delivers raw compute with no managed container runtime, no auto-scaling and no built-in observability. If the team lacks Docker and Linux server fluency, the ops overhead erodes the cost advantage. Scaleway Serverless Containers or similar managed layers are the EU-native alternative for teams who need to stay in the stack without managing servers.
  • French health data (HDS): Hetzner is not certified as a Hebergeur de Donnees de Sante (HDS) under French law. Storing or processing French healthcare personal data requires an HDS-certified provider. Scaleway offers an HDS-certified hosting product; OVHcloud also has HDS-certified infrastructure. Evaluate those instead for this regulated use case.
  • Latency-sensitive services targeting Paris users: Hetzner's nearest eu-central location is Falkenstein, Saxony (fsn1), approximately 750 km from Paris. For latency-sensitive workloads where sub-10 ms round-trip matters, Scaleway par-1 or OVH Roubaix deliver lower network latency to French users. For most agentic workloads where the bottleneck is LLM inference time (hundreds of milliseconds to seconds), the Falkenstein-Paris network hop is not the constraint.
  • Account suspension risk: Hetzner promptly suspends accounts when a server is reported for abuse (spam, port scanning, cryptocurrency mining). Reactivation requires an abuse-ticket response with explanation and mitigation plan, which can take 24-72 hours. Agent workloads generating high outbound HTTP traffic can trigger abuse reports from third parties. Configure Hetzner Firewall egress rules to restrict unexpected outbound patterns, and keep support contact details current. Source: hetzner.com/legal/terms-and-conditions/.
  • No uptime SLA on Hetzner Cloud: Cloud VMs operate on a best-effort basis with no published uptime guarantee and no financial credit for downtime. Hetzner's reported historical availability is high, but there is no contractual SLA. Dedicated servers (AX, GEX lines) have a 99.9% hardware-availability target and a hardware-failure replacement policy, but this does not cover network or software incidents. For workloads requiring a contractual SLA with credits, Scaleway, OVHcloud and AWS/GCP EU regions all publish SLAs. Source: hetzner.com/legal/terms-and-conditions/.

Code examples

Docker Compose: n8n + Qdrant + PostgreSQL + Traefik on Hetzner

# Minimal agentic stack on Hetzner
# Tested on CAX21 (ARM 4 vCPU / 8 GB RAM, ~€10.49/mo post June 2026) and CX32 (shared Intel)
# Prerequisites: Ubuntu 24.04, Docker + Docker Compose v2 installed,
#   DNS A record pointing to the server IP, ports 80 and 443 open in the Hetzner Firewall.
#
# Usage:
#   ACME_EMAIL=you@example.com \
#   N8N_HOST=n8n.yourdomain.com \
#   POSTGRES_PASSWORD=$(openssl rand -hex 32) \
#   docker compose up -d
#
# Nightly backup (one-shot, triggered by host cron or manually):
#   BACKUP_S3_KEY=... BACKUP_S3_SECRET=... BACKUP_S3_ENDPOINT=... BACKUP_BUCKET=... \
#   docker compose --profile backup run --rm backup

services:
  traefik:
    image: traefik:v3
    restart: unless-stopped
    command:
      - "--providers.docker=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.le.acme.httpchallenge=true"
      - "--certificatesresolvers.le.acme.httpchallenge.entrypoint=web"
      - "--certificatesresolvers.le.acme.email=${ACME_EMAIL}"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
    ports: ["80:80", "443:443"]
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - letsencrypt:/letsencrypt

  postgres:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: n8n
      POSTGRES_USER: n8n
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
    volumes: [postgres_data:/var/lib/postgresql/data]

  n8n:
    image: n8nio/n8n
    restart: unless-stopped
    environment:
      N8N_HOST: ${N8N_HOST}
      N8N_PROTOCOL: https
      WEBHOOK_URL: https://${N8N_HOST}/
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_DATABASE: n8n
      DB_POSTGRESDB_USER: n8n
      DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
    volumes: [n8n_data:/home/node/.n8n]
    labels:
      traefik.enable: "true"
      traefik.http.routers.n8n.rule: "Host(`${N8N_HOST}`)"
      traefik.http.routers.n8n.entrypoints: websecure
      traefik.http.routers.n8n.tls.certresolver: le
    depends_on: [postgres]

  qdrant:
    image: qdrant/qdrant
    restart: unless-stopped
    volumes: [qdrant_data:/qdrant/storage]
    # Internal only: no Traefik label. n8n reaches Qdrant on the compose network (qdrant:6333)

  backup:
    image: minio/mc:latest
    profiles: ["backup"]
    environment:
      PGPASSWORD: ${POSTGRES_PASSWORD}
      MC_HOST_hetzner: https://${BACKUP_S3_KEY}:${BACKUP_S3_SECRET}@${BACKUP_S3_ENDPOINT}
    volumes: [backup_data:/backup]
    entrypoint: ["/bin/sh", "-c"]
    command:
      - >
        apk add --no-cache postgresql-client &&
        pg_dump -h postgres -U n8n n8n | gzip > /backup/n8n-$(date +%Y%m%d).sql.gz &&
        mc mirror /backup/ hetzner/${BACKUP_BUCKET}/
    depends_on: [postgres]

volumes:
  letsencrypt:
  n8n_data:
  postgres_data:
  qdrant_data:
  backup_data:

Tested on CAX21 ARM (~€10.49/mo post June 2026). All services communicate on the Docker internal network; only Traefik is publicly reachable on 80/443. Qdrant stores vectors in a named volume: data survives container restarts. The backup service (profile "backup") runs pg_dump and mirrors dumps to Hetzner Object Storage via mc; trigger it from host cron nightly.

Terraform: provision a Hetzner Cloud server (IaC)

# Terraform: provision a Hetzner Cloud server for an agentic stack
# Provider: registry.terraform.io/providers/hetznercloud/hcloud
# Run: terraform init && terraform apply -var="hcloud_token=<token>"

terraform {
  required_providers {
    hcloud = { source = "hetznercloud/hcloud", version = "~> 1.50" }
  }
}

provider "hcloud" {
  token = var.hcloud_token
}

variable "hcloud_token" { sensitive = true }
variable "ssh_key_name" { default = "default" }
variable "admin_cidr" {
  type    = list(string)
  default = ["203.0.113.0/24"]  # replace with your admin CIDRs
}

data "hcloud_ssh_key" "key" { name = var.ssh_key_name }

# Firewall: restrict SSH to known CIDRs; 80/443 are public
resource "hcloud_firewall" "agent" {
  name = "agent-stack"
  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "22"
    source_ips = var.admin_cidr
  }
  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "80"
    source_ips = ["0.0.0.0/0", "::/0"]
  }
  rule {
    direction  = "in"
    protocol   = "tcp"
    port       = "443"
    source_ips = ["0.0.0.0/0", "::/0"]
  }
}

# CAX21 ARM: 4 vCPU / 8 GB / 80 GB SSD, eu-central, ~€10.49/mo post June 2026
# Upgrade path: cax31 (8vCPU/16GB) -> cax41 (16vCPU/32GB) -> ax41 dedicated (64GB)
resource "hcloud_server" "agent" {
  name         = "agent-host"
  server_type  = "cax21"       # ARM Ampere, best cost ratio post-June 2026
  image        = "ubuntu-24.04"
  location     = "fsn1"        # Falkenstein DE: lowest latency to Paris in eu-central
  ssh_keys     = [data.hcloud_ssh_key.key.id]
  firewall_ids = [hcloud_firewall.agent.id]
  user_data    = file("${path.module}/cloud-init.yaml")  # installs Docker + Compose
}

output "ip" { value = hcloud_server.agent.ipv4_address }

fsn1 (Falkenstein, Germany) is the closest eu-central location to Paris. cloud-init.yaml should install Docker Engine and Docker Compose v2, then pull and start the Compose stack. The hcloud Terraform provider version ~> 1.50 is current as of July 2026. Source: registry.terraform.io/providers/hetznercloud/hcloud.

Comparison

vs Scaleway

GPU cloud leadership and managed services vs raw compute cost

Both are EU-native with no US parent company. Scaleway leads on GPU cloud (H100 and A100 cloud instances available on demand), managed serverless containers (scale-to-zero, automatic TLS, no server management) and developer experience with Terraform. Hetzner wins on raw compute cost: a CAX21 (~€10.49/mo) carries an agentic stack at a fraction of comparable Scaleway VM pricing. Scaleway also offers HDS-certified hosting (Hetzner does not) and a Paris datacenter for lower France-latency workloads. Decision: Hetzner for cost-optimised CPU workloads with in-house Docker ops capacity. Scaleway when managed runtime, GPU cloud or HDS compliance is required. Sources: gartsolutions.com/scaleway-vs-hetzner/ and softwareseni.com/eu-native-cloud-providers-compared.

vs OVHcloud

Broadest EU cloud portfolio vs simplicity

OVHcloud is Europe's largest cloud by revenue, with a wider catalog: managed databases, CDN, DNS, bare metal, managed Kubernetes and HDS-certified hosting in France. Its API and Terraform provider are more complex than Hetzner's. For a focused use case (self-hosted agentic stack: n8n + vector DB + optional inference), Hetzner's simpler model is a feature: fewer abstractions, fewer pricing variables, a single clean Terraform provider. OVH makes sense when a team needs to consolidate many infrastructure services under one EU provider, or when French HDS certification is the constraint. Sources: softwareseni.com/eu-native-cloud-providers-compared.

vs AWS / GCP (EU region)

Richest managed ecosystem vs EU jurisdiction and cost

AWS Frankfurt (eu-central-1) and GCP europe-west are US-headquartered. The CLOUD Act (18 U.S.C. § 2713) lets US authorities compel them to produce data they control regardless of EU storage location: choosing an EU region does not remove that exposure. Hetzner Online GmbH (no US parent) has no such obligation; its US subsidiary (Hetzner, Inc.) operates only US colocation sites and has no access to eu-central data. Note: beyond US reach is not beyond all reach, German courts and the EU e-Evidence Regulation still apply in eu-central. On cost: a CAX21 at ~€10.49/mo versus an AWS t4g.medium (~$24.5/mo on-demand) is roughly 3x cheaper on raw compute. The managed service ecosystem of AWS/GCP is vastly richer (RDS, EKS, Bedrock, CloudWatch). The decision driver for Hetzner vs hyperscaler is jurisdiction and TCO at sustained load once the stack is stable. See /stack/sovereign-ai for the full EU jurisdiction decision tree.

Resources

FAQ

Is Hetzner exposed to the US CLOUD Act?
Not at the entity level that controls eu-central data. The US CLOUD Act (18 U.S.C. § 2713) compels US-headquartered companies to produce data they control, regardless of where it is stored. Hetzner Online GmbH is incorporated in Germany with no US parent: US authorities have no legal basis to compel it under the CLOUD Act. Hetzner does operate a US subsidiary (Hetzner, Inc.) for its American colocation presence (ash, hil), but that entity has no access to data stored in eu-central (Nuremberg, Falkenstein, Helsinki). Important nuance: being outside US legal reach is not the same as being outside all legal reach. German judicial orders and the EU e-Evidence Regulation provide law-enforcement access paths that remain applicable regardless of hosting location. See /stack/sovereign-ai for the full EU jurisdiction decision tree. Source: hetzner.com/unternehmen/ueber-uns/.
Which Hetzner instance should I start with for n8n + Qdrant?
Start with a CAX21 (ARM, 4 vCPU, 8 GB RAM, ~€10.49/mo post June 2026). It carries n8n orchestration, Qdrant and PostgreSQL comfortably at moderate workflow volume. ARM64 Docker images exist for all three services. When Qdrant memory or n8n concurrency becomes the constraint, upgrade linearly: CAX31 (8 vCPU, 16 GB) then a dedicated AX41 (~€44/mo). No vendor migration, just a new server and the same Docker Compose file. Source: docs.n8n.io/hosting/installation/server-setups/hetzner/.
Can I run LLM inference on Hetzner?
Yes, two paths. CPU inference (Ollama, llama.cpp): the AX dedicated servers with AMD Ryzen CPUs handle 7B and 13B models. The AX102 (Ryzen 9 7950X3D, 128 GB DDR5, ~€122/mo) uses 3D V-Cache which improves cache hit rates for LLM inference. Community benchmarks document Mixtral running on the AX52 (~€64/mo). GPU inference: the GEX44 (RTX 4000 SFF Ada, 20 GB GDDR6, €184/mo) handles models up to ~32B at 4-bit quantisation and 7B-14B at full throughput. GEX server availability is not always immediate. For H100/A100 GPU workloads, Scaleway is the EU alternative. Sources: codref.org/rated-d/run-llm-on-hetzner/ and hetzner.com/dedicated-rootserver/matrix-gpu/.
How did the June 2026 Hetzner price increase affect the agentic stack case?
The June 2026 adjustment hit CCX (dedicated cloud vCPU, ~2.1-2.7x) and CPX (shared AMD cloud, ~2.4-2.75x) tiers hard, driven by DRAM and NVMe price surges. CX (shared Intel) and CAX (Arm) saw a more moderate ~1.3x increase. GEX GPU servers were unchanged. For the canonical agentic stack entry point, the CAX21 moved from ~€7.99 to ~€10.49/mo: a noticeable increase but Hetzner remains materially cheaper than AWS or GCP equivalents at sustained load. Sources: docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/ and northflank.com/blog/hetzner-cloud-server-price-increases.
Is Hetzner GDPR-compliant and suitable for processing EU personal data?
Yes, with the standard caveats. Hetzner is an EU-based processor (German GmbH), operates its own datacenters in Germany and Finland, holds ISO 27001:2022 and BSI C5 Type 2 certifications, and provides a DPA to customers under GDPR Article 28. Signing the DPA is your responsibility as controller. The usual GDPR conditions apply: lawful basis, subprocessor chain, data minimisation. For French health data (donnees de sante), Hetzner is not HDS-certified: use Scaleway (HDS-certified) or another certified provider instead. Source: hetzner.com/unternehmen/zertifizierung and docs.hetzner.com/general/company-and-policy/information-security-at-hetzner/.