STRATO
STRATO is a German web hosting provider headquartered in Berlin and a subsidiary of United Internet AG. It offers domain registration, shared and managed Linux hosting, dedicated and bare metal servers, the Webseiten-Baukasten drag and drop website builder, HiDrive cloud storage, Microsoft 365 mailboxes and Wordpress hosting. With ISO 27001 certified twin data centres in Karlsruhe and Berlin and no extra-EU transfer for the core service, STRATO is a popular choice for German speaking small and medium businesses that want a fully GDPR aligned hosting partner.
What does STRATO do?
What STRATO does and how it appears on a website
STRATO AG, registered in Berlin, is a German hosting provider founded in 1997 and now part of United Internet AG. It targets the German speaking small and medium business market with shared web hosting plans, managed WordPress, dedicated and bare metal servers, the Webseiten-Baukasten drag and drop builder, HiDrive cloud storage, mailboxes powered by Microsoft 365 and a domain registrar service. STRATO operates two twin data centres in Karlsruhe and Berlin that are ISO 27001 certified and have received the TUEV-Saarland trusted data centre attestation.
Cookies and data collected by STRATO
On a website hosted with STRATO, the infrastructure layer sets technical session cookies for the customer panel and may add load balancing cookies. The Webseiten-Baukasten injects strato_session and strato_csrf cookies for the editor. Analytics, marketing or social embed cookies are only added by the customer through Baukasten blocks or by integrating third party services. STRATO server logs capture IP, User-Agent, requested URL and Referer for security and abuse detection.
GDPR and ePrivacy implications
STRATO acts as Auftragsverarbeiter for hosting, mail, HiDrive and Baukasten, and as Verantwortlicher for its own customer communications. The Auftragsverarbeitungsvertrag (AVV) is signed automatically as part of the customer contract, fully aligned with Articles 28 and 32 GDPR, and is available in the customer panel in German, English, French and Spanish.
International data transfers
All customer data for the core STRATO hosting service stays in Germany. The optional Microsoft 365 mailbox plan introduces a Microsoft processing layer, with its own EU Data Boundary scope. The HiDrive Pro plan and dedicated servers stay strictly inside the EU.
Consent and legal basis
Article 6(1)(b) GDPR (contract) covers hosting, mailbox and Baukasten services. Article 6(1)(f) covers security. Article 6(1)(a) only applies if the customer integrates analytics or marketing scripts through the Baukasten.
Practical compliance steps
Sign the STRATO AVV in the customer panel, enable two factor authentication, review the ISO 27001 attestation and the TUEV-Saarland trusted data centre certificate, list STRATO in the privacy notice, document the sub-processor list (in particular Microsoft for the optional 365 mailbox) and integrate any optional analytics or marketing snippet into the Consent Management Platform.
STRATO and the GDPR
- Legal basis
- Contractual necessity under Article 6(1)(b) GDPR for hosting and domain services. Legitimate interest under Article 6(1)(f) for security and abuse prevention. Consent under Article 6(1)(a) only for analytics or marketing scripts added through Webseiten-Baukasten templates.
- Risk level
- low
- Applicable regulations
- GDPR, ePrivacy Directive, German TTDSG / TDDDG, German BDSG, ISO 27001, TUEV-Saarland datacentre attestations
Impact assessment (DPIA)
A DPIA is rarely required for STRATO alone. Document a short transfer impact assessment confirming that the data stays in the Karlsruhe and Berlin datacentres, the ISO 27001 certification, the BSI principles followed by STRATO and the response plan for any government access request based on German Bundesnachrichtendienst rules.
Sample text for your banner
This website is hosted on STRATO infrastructure in Germany. Hosting cookies for load balancing and security are strictly necessary and exempt from consent. Optional cookies set by Webseiten-Baukasten templates for analytics or marketing only fire after you click Accept on the cookie banner.
What STRATO sets and contacts
- Tracking method
- German web hosting, domain registration, HiDrive cloud storage and Webseiten-Baukasten website builder. Server side logs and session cookies for the customer panel; templates may inject analytics cookies if enabled by the customer.
- Server location
- Headquartered in Berlin, Germany. Twin data centres in Karlsruhe and Berlin, certified ISO 27001 and TUEV-Saarland. STRATO is part of United Internet AG, the same group as IONOS.
Cookies set (3)
| Name | Type | Duration | Purpose |
|---|---|---|---|
| strato_session | HTTP cookie | Session | STRATO customer panel and Webseiten-Baukasten session identifier. |
| strato_csrf | HTTP cookie | Session | Anti CSRF token for STRATO panel and Baukasten editor. |
| strato_lang | HTTP cookie | 1 year | Stores the preferred language for the customer panel. |
Third-party domains contacted (4)
strato.destrato.comhidrive.comcdn.strato.de
Frequently asked questions about STRATO
Can't find your question? Write to us, we answer fast.
What cookies does STRATO set?
STRATO hosting and Webseiten-Baukasten set technical session cookies (strato_session, strato_csrf) and a language preference cookie. No analytics or marketing cookies are deployed by default.
Do I need consent to use STRATO?
Hosting cookies are strictly necessary and exempt from prior consent under TTDSG and ePrivacy. Only the optional analytics or marketing snippets added by the customer require consent.
What is the legal basis?
Article 6(1)(b) GDPR (contract) for hosting, domain and mailbox services. Article 6(1)(f) for security. Article 6(1)(a) only for optional analytics or marketing scripts.
Does STRATO transfer data to the US?
No, the core hosting service stays in Germany. The optional Microsoft 365 mailbox plan introduces Microsoft processing under its own EU Data Boundary commitment.
Do I need a DPIA?
Rarely. A short transfer impact assessment confirms that data stays in Karlsruhe and Berlin and references the ISO 27001 and TUEV-Saarland trusted data centre attestations.
How do I implement STRATO compliantly?
Sign the AVV in the customer panel, enable 2FA, review ISO 27001 and TUEV-Saarland attestations, list STRATO in the privacy notice, document Microsoft as a sub-processor for optional 365 plans and channel optional analytics into the CMP.
Are there alternatives to STRATO?
Hetzner, IONOS, Mittwald, all-inkl, Netcup, Domainfactory for German speaking markets. OVHcloud and Scaleway in France. Infomaniak in Switzerland. All offer EU only hosting.
How do I update my cookie policy for STRATO?
List STRATO AG as a processor for hosting and registrar for the domain, describe the technical cookies, mention the ISO 27001 and TUEV-Saarland attestations and link to the STRATO AVV and privacy notice.
Hostpoint
Hostpoint is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Hostpoint offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Hostpoint empowers organizations to optimize strategy and maximize return on investment.
%22%3E%0A%3Cpath%20d%3D%22M0.00295%2015.9857C0.00870714%207.15714%207.16429%200%2016%200C24.8357%200%2032%207.16429%2032%2016C32%2024.8357%2024.8429%2031.9929%2016.0071%2032H3.63786C1.63143%2032%200.00594286%2030.3786%200.00297143%2028.3714H0V15.9857H0.00295ZM24.4714%2011.4786C24.4714%208.64286%2021.9286%206.58571%2019.2429%206.58571C16.75%206.58571%2014.5429%208.46429%2014.2357%2010.8643C14.2214%2011.1357%2014.2071%2011.2214%2014.2071%2011.4714C14.2%2012.9786%2014.2071%2014.5286%2014.15%2016.0714C14.2143%2017.9357%2014.2214%2019.7929%2014.15%2021.5429C14.15%2023.4786%2012.7643%2024.7929%2010.9571%2024.7929C9.15%2024.7929%207.68571%2023.35%207.68571%2021.5429C7.72143%2019.5643%209.3%2018.3071%2011.15%2018.25H11.1643L13.0429%2018.2357V15.5714L11.1643%2015.5857C7.8%2015.5571%205.12286%2018.1929%205.02571%2021.5429C5.02571%2024.8%207.70714%2027.4643%2010.9571%2027.4643C14.0286%2027.4643%2016.5786%2025.0643%2016.8571%2022.0643L16.8714%2018.2429L19.2%2018.2214C21.0071%2018.2357%2020.9857%2015.5214%2019.1857%2015.5571L16.8714%2015.5786C16.8714%2015.1214%2016.8786%2014.6643%2016.8786%2014.2071C16.8857%2013.3%2016.8857%2012.3929%2016.8714%2011.4786C16.8786%2010.3%2018%209.25%2019.2429%209.25C20.4929%209.25%2021.8071%209.87143%2021.8071%2011.4786C21.8071%2011.7071%2021.8%2011.8429%2021.7857%2011.9286C21.65%2012.6786%2022.1571%2013.3857%2022.9071%2013.4929C23.6643%2013.6%2024.35%2013.0571%2024.4214%2012.3071C24.4643%2012.0071%2024.4714%2011.7429%2024.4714%2011.4786Z%22%20fill%3D%22%2344A3D7%22%2F%3E%0A%3C%2Fg%3E%0A%3Cdefs%3E%0A%3CclipPath%20id%3D%22clip0_15_193%22%3E%0A%3Crect%20width%3D%2232%22%20height%3D%2232%22%20fill%3D%22white%22%2F%3E%0A%3C%2FclipPath%3E%0A%3C%2Fdefs%3E%0A%3C%2Fsvg%3E)
Fedora
Fedora is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Fedora integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Fedora helps organizations maintain robust websites that meet user expectations and technical requirements.
Acquia Cloud Platform
Acquia Cloud Platform is a web hosting and cloud infrastructure provider delivering reliable, scalable hosting solutions for websites and applications of all sizes. It offers shared, VPS, and dedicated server options with SSD storage, global CDN, and automated backups. Acquia Cloud Platform provides one-click deployment, managed databases, and 24/7 monitoring. With high uptime guarantees and developer-friendly tools, Acquia Cloud Platform ensures optimal performance at scale.
phpMyAdmin
phpMyAdmin is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. phpMyAdmin integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, phpMyAdmin helps organizations maintain robust websites that meet user expectations and technical requirements.
Debian
Debian is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Debian supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Debian ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
LiteSpeed
LiteSpeed is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. LiteSpeed supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, LiteSpeed ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.
Make your site compliant today.
Free up to 25,000 sessions a month. No credit card, no commitment.