SOC 2 policies for Hetzner teams

P03 Access Control Policy

Production runs in a dedicated Hetzner Cloud project whose owner and administrator roles are held by no more than two named people, other engineers are invited as project members with the least role they need, and every member is required to enable two-factor authentication on their personal Hetzner account. Project API tokens are created with Read permission unless a pipeline needs Read & Write, are stored only in the secrets manager and are revoked when a person who could see them leaves. Any dedicated servers managed in Hetzner Robot have their logins and webservice users reviewed separately at each quarterly access review, because Robot access is not managed through Cloud Console project membership.

P08 Encryption and Key Management Policy

Volumes and server disks that hold customer data are encrypted at the operating-system level with LUKS2, with the key held in the secrets manager rather than in the Hetzner project, and database dumps are encrypted before they are written to Object Storage or any other backup target. Public HTTPS terminates on a Hetzner Load Balancer with a managed or uploaded certificate, or on the application's reverse proxy configured for TLS 1.2 or higher, and traffic between servers on the private network is also encrypted with TLS or WireGuard rather than relying on network isolation alone.

P12 Logging and Monitoring Policy

Every server ships system, SSH authentication and application logs to the central logging tool through a log agent, and engineers reach servers with their own SSH keys rather than a shared key, so each login can be attributed to a person. Changes to Hetzner Cloud servers, firewalls, networks, load balancers and placement groups are made through Terraform with the hcloud provider from source control, so the reviewed plan and the apply output for each change form the record of who changed the project and when.

P14 Business Continuity and Disaster Recovery Policy

Each production tier runs at least two servers in a spread placement group, so they sit on different physical hosts, behind a Hetzner Load Balancer whose health checks stop sending traffic to an unhealthy target. The disaster recovery runbook names a second Hetzner location, describes how servers are rebuilt there from Terraform and how data is restored from backups held outside the production project, and records the most recently tested recovery time and recovery point objectives.

P15 Backup and Recovery Policy

Hetzner Cloud backups are enabled on every production server, keeping the seven daily backup slots Hetzner provides, and a manual snapshot is taken before any major change to a server. Because these backups cover the server's own disk but not attached volumes, are deleted along with the server and stay inside the same project, each production database is also backed up daily to encrypted storage outside the Hetzner project under separate credentials, and a full restore is tested each quarter.

P20 Network and Infrastructure Security Policy

A Hetzner Cloud Firewall is applied to every production server through a label selector, so inbound traffic that no rule allows is dropped, web servers accept HTTP and HTTPS only from the Hetzner Load Balancer, and SSH is allowed only from the VPN or bastion address range. Databases and internal services are created without public IPv4 or IPv6 addresses and are reachable only over a Hetzner private network, where each database server's host firewall limits which private addresses may connect, and any dedicated server managed in Robot has the Robot firewall enabled with an equivalent allow list.

Frequently asked questions

Does Hetzner's own security assurance cover our SOC 2?

No. Whatever independent assurance Hetzner provides, such as a SOC 2 report or an ISO 27001 certificate, covers the controls Hetzner operates for its own platform. Your examination covers how your company configures and uses Hetzner: who has access, how it is authenticated, what is logged and how data in it is protected. Auditors read the vendor's assurance to decide what they can rely on, and the Vendor and Third-Party Risk Management Policy tells you to obtain it at onboarding and annually, and to send a security questionnaire where gaps remain.

What does the generator pre-fill when I arrive from this page?

The link on this page opens the generator with a preset that sets the cloud platform to Hetzner. The other answers (company, product, headcount, owners, data types, scope and review cadence) are yours to fill in. The policies render in your browser as Markdown; nothing is sent to a server and there is no signup.

Which policies change when I add Hetzner to my answers?

6 policies name Hetzner once it is in the intake: Access Control Policy, Encryption and Key Management Policy, Logging and Monitoring Policy, Business Continuity and Disaster Recovery Policy, Backup and Recovery Policy, Network and Infrastructure Security Policy. The free generator names it in scope, roles and procedures; the Audit Kit ($59 one-time) rewrites sections 4 and 5 of each policy with statements specific to how Hetzner is configured, like the examples on this page. Refunds are available within 14 days on request.