Snippet from the BorgBase General Data Protection Regulation page

For just over a year now, I’ve been expanding my backup strategy using BorgBackup. Initially, I used a Storage Box from Hetzner as the destination for these backups. While the Storage Box is versatile, configuring it – especially for BorgBackup – can sometimes involve a lot of manual work.

Late last year, I started using BorgBase as an additional hosting service for my backups. BorgBase offers a really nice web UI that makes setting up and monitoring backup repositories much easier. It also includes alerts for when new backups haven’t been created.

I chose the EU region for my repositories. Since Borg already encrypts the backups on the local machine, privacy concerns were taken care of, so I didn’t look into the details about their hosting partners.

Due to current political developments, the issue of digital sovereignty has become more important to me. I try to host my data outside the US and avoid US hyperscales whenever possible. It’s not always feasible, but I make the switch wherever I can do so without a significant loss of functionality.

Even when data resides within the EU, one of the US hyperscalers might still be in the picture. The whole idea of a sovereign European cloud that directly or indirectly involves one of these US giants strikes me as pure fantasy.

That’s why I finally decided to check which partners BorgBase actually uses to host their EU data. I found the answer on their General Data Protection Regulation page: Hetzner.

For me, this is both good news and bad news.

I trust Hetzner as a hosting provider and use them for a large portion of my cloud services. I also see that many services and projects, both small and large, rely on Hetzner. So, in that sense, it’s good news.

On the other hand, I intended to use BorgBase alongside my StorageBox as a secondary location for storing my backups.

But now it turns out these backups are also stored with Hetzner, using the same infrastructure. And from my point of view, that’s the bad news.

Right now, I’m weighing whether to live with the (low) risk or find another cloud provider that’s independent of Hetzner.