Yundera is a managed self-hosting platform. You pick a hosting provider like Hetzner, Contabo, or Scaleway, and Yundera sets up and manages the entire server for you. Install apps with one click, get automatic domains and HTTPS, and pay one flat monthly price with no per-app or per-user fees.

Is Yundera real self-hosting?

Yes. Your data lives on your server at your chosen hosting provider. Yundera handles server management, domains, and reachability. Your app traffic goes directly to your server. Only behind CGNAT does traffic travel through an encrypted WireGuard tunnel.

How is Yundera different from Cloudron or YunoHost?

Cloudron and YunoHost are software you install on a server you provision and maintain yourself. Yundera manages the entire server for you — you just pick apps. No SSH, no Docker, no SSL renewals, no Linux administration required.

Is my traffic encrypted?

Yes. All traffic is encrypted with HTTPS (TLS). Use sslip.io for true end-to-end encryption, or nsl.sh subdomains for convenient encrypted-in-transit access.

Where is my data stored?

All data stays on your server at your chosen hosting provider. Nothing is stored on Yundera servers.

What apps can I install?

Nextcloud, Immich, Jellyfin, Vaultwarden, n8n, Ghost, Docmost, Uptime Kuma, and 100+ more. All install with one click and get automatic domains and HTTPS.

Do I need technical knowledge?

No. Apps install with one click. Domains and HTTPS are automatic. Advanced users can SSH in and customize everything.

What if Yundera servers go down?

Your apps and data remain on your server. Local network access continues. Only nsl.sh domains would be temporarily unavailable.

Is NSL.SH open source?

Yes. NSL.SH is the open-source networking layer that provides automatic domains and HTTPS. Fully open source on GitHub at github.com/Yundera/mesh-router-root. Uses WireGuard.

How much does Yundera cost?

Starting from EUR 11.99/month depending on the hosting provider you choose. One flat price includes server management, all apps, all users. No per-app or per-user fees.

Which hosting providers does Yundera support?

Hetzner, Contabo, Scaleway, Vultr, and others. You pick the provider and plan. Yundera publishes benchmarks on 1,247 servers from 38 providers to help you choose.

How do I backup my data?

All data is under /DATA/. Use rsync to copy to USB or remote server. Automatic daily backups via cron.

Can I migrate from other platforms?

Yes. Export data from your current platform, install the same app on Yundera, copy data to /DATA/AppData/.

Is Yundera GDPR compliant?

All data stored on your server at your chosen provider. Yundera servers never store personal data. Aptero SAS is headquartered in Paris under EU law.

TLS & Privacy

This page explains how TLS encryption works for each way of reaching your PCS, and what that means for your privacy.

The short answer

Fully end-to-end encrypted only when you use your sslip.io address. With nsl.sh subdomains and Cloudflare-fronted custom domains, traffic is encrypted in transit but re-terminated at an edge node.

In every mode, your application data at rest always stays on your own machine.

TLS by address type

How you reach your PCS	TLS	End-to-end to your PCS?
sslip.io address (`<ip-dashes>.sslip.io`)	One TLS session, terminated on your PCS	Yes — nothing in between decrypts
nsl.sh subdomain (managed)	Dedicated certificate from your PCS to the edge, then a Let's Encrypt certificate to the public internet	Encrypted in transit, re-terminated at the edge
Custom domain via Cloudflare	HTTPS terminated at Cloudflare's edge; encrypted link to your PCS	Encrypted in transit; the Cloudflare edge sees plaintext

What each mode means

sslip.io — true end-to-end

When someone connects to your sslip.io address (e.g., 203-0-113-42.sslip.io), there is a single TLS session from the visitor's browser directly to your PCS. No intermediary sees the decrypted traffic. This is the only fully end-to-end path.

nsl.sh — encrypted, edge-terminated

With your managed subdomain (e.g., app.yourname.nsl.sh), TLS is terminated at the NSL.SH edge. A separate encrypted connection carries the traffic from the edge to your PCS. The edge node briefly sees traffic in plaintext during the handoff. This is the standard mode — convenient and secure for most use cases.

Custom domain via Cloudflare — encrypted, Cloudflare-terminated

When using a custom domain routed through Cloudflare in proxy mode, Cloudflare terminates HTTPS at its edge. An encrypted connection (Full or Full Strict mode) carries traffic to your PCS. Cloudflare's edge can see plaintext.

Data at rest

Regardless of how traffic reaches your PCS, your application data is stored locally on your machine. Yundera infrastructure never stores your app data.

Choosing the right mode

Priority	Recommended mode
Maximum privacy (strict e2e)	sslip.io direct
Convenience + managed DNS	nsl.sh subdomain
Custom branding + DDoS protection	Custom domain via Cloudflare

The short answer​

TLS by address type​

What each mode means​

sslip.io — true end-to-end​

nsl.sh — encrypted, edge-terminated​

Custom domain via Cloudflare — encrypted, Cloudflare-terminated​

Data at rest​

Choosing the right mode​