Ensuring Robust Security on Hetzner Cloud

Built‑in Encryption and Data Protection

Hetzner Cloud automatically encrypts all block storage at rest using AES‑256. Data is encrypted on the host before writing to disk, and keys are managed by Hetzner's secure key‑management service. This eliminates the need for user‑managed encryption for most workloads. For sensitive compliance scenarios, users can attach external encryption layers such as LUKS or cloud‑native services.

Network Isolation and Firewalls

Virtual Private Cloud (VPC) segments create isolated networks, allowing separate subnets for front‑end, back‑end, and database layers. Each subnet can enforce ingress and egress rules through Hetzner's user‑defined firewalls. By default, all traffic is blocked unless explicitly allowed, providing a strong defense in depth. Users can also bind firewalls to individual instances or entire subnets for granular control.

Identity and Access Management (IAM)

Hetzner Cloud's API tokens are scoped to specific actions and resources. Tokens can be rotated or revoked without affecting other services. Combining token scopes with role‑based access control ensures that only authorized personnel can perform critical operations such as instance creation, network changes, or key management.

Compliance and Auditing

Hetzner Cloud meets ISO 27001 and GDPR requirements. All API actions are logged and can be exported for audit trails. Users can enable CloudTrail‑style logging to capture configuration changes, firewall updates, and instance lifecycle events. This visibility supports internal compliance reviews and external regulatory reporting.

Best‑Practice Recommendations

• Use separate VPCs for production, staging, and development.
• Apply least‑privilege IAM tokens and rotate them regularly.
• Enable firewalls on every subnet and enforce strict port whitelisting.
• Implement automated backups with encrypted snapshots.
• Use multi‑factor authentication for the Hetzner Cloud console.