Cyso Cloud vs Unomed Cloud PACS

Compare Cyso Cloud and Unomed Cloud PACS on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Cyso Cloud

Netherlands· Cloud Computing

Needs review

Shortlist Cyso Cloud when you want Dutch-operated OpenStack IaaS and KCSP managed Kubernetes with AMS/FRA residency and engineer-to-engineer support. Skip when you need global hyperscaler regions or default encryption-at-rest object storage—consider OVHcloud or Scaleway for broader European multi-region IaaS, or keep a hyperscaler for worldwide PaaS depth.

EU-operated (NL)OpenStack IaaSManaged Kubernetes (KCSP)AMS + FRA regionsISO 27001 (claimed)NEN 7510 (claimed)

View listing Visit Website

Unomed Cloud PACS

Switzerland· Cloud Computing

Needs review

Shortlist for Swiss practices that want a cloud DICOM archive, browser viewing and referrer sharing without replacing their PIS, and that accept a Zurich SaaS vendor with claimed Swiss image hosting. Skip when you need a default CE-marked diagnostic viewer, a fully public subprocessor and audit pack, or a self-hosted PACS you operate yourself. Consider PostDICOM or a classic on-prem PACS plus sharing tool when those constraints dominate.

Swiss-operatedCloud PACS / VNADICOM archiveBrowser viewerPIS overlay

View listing Visit Website

Highlighted rows differ between the two products.

Cyso Cloud vs Unomed Cloud PACS: Snapshot
Feature	Cyso Cloud	Unomed Cloud PACS
Country of origin	Netherlands	Switzerland
Category	Cloud Computing	Cloud Computing
Open source	Yes	No
Self-hosted	No	No
Headquarters	Netherlands	Switzerland
Legal entity	Cyso B.V. (part of Cyso Group B.V.), Wognumsebuurt 3, 1817 BH Alkmaar; KVK 37133395	Unomed AG
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Primary public IaaS on Cyso-operated hardware in Tier 3 facilities in Amsterdam and Frankfurt (3 AZs per region); vendor states storage replicas/backups stay in the selected EU region. Not marketed as AWS/Azure/GCP-hosted IaaS. Ancillary tools disclosed at group level include website analytics (PostHog) and third parties for payments/support; status tooling has referenced Atlassian Statuspage. Full public customer-workload subprocessor list not found.	Vendor claims primary hosting, databases and DICOM storage in Switzerland. Privacy policy lists identity/liveness processing in EU (Ireland) and speech recognition in EU (Denmark). API CSP references AWS S3 eu-central-2 (Zurich) and AWS Rekognition/Cognito eu-west-1; push via Firebase; website may use Cloudflare WAF cookies and Google Analytics. Named subprocessor list on request only.
Summary	Dutch OpenStack IaaS from Cyso B.V. with AMS/FRA regions, managed Kubernetes (KCSP), S3-compatible object storage, and EU data residency for teams avoiding hyperscaler lock-in.	Swiss cloud PACS and vendor-neutral archive for storing, viewing and sharing DICOM medical images in the browser, integrated with existing medical practice workflows.
Tags	cloud iaas openstack kubernetes gdpr netherlands eu-hosting sovereign-cloud	pacs dicom medical-imaging healthcare cloud-pacs switzerland vna

At a glance: Cyso Cloud vs Unomed Cloud PACS
At a glance	Cyso Cloud	Unomed Cloud PACS
HQ	Alkmaar, Netherlands	Zurich, Switzerland
Legal entity	Cyso B.V. (Cyso Group)	Unomed AG (CHE-374.858.885)
Founded	1997 (group); public OpenStack cloud since 2016 (Fuga); Cyso Cloud brand 2025	Not listed
Regions	Amsterdam, Frankfurt (more under investigation)	Not listed
Stack	OpenStack + managed Kubernetes (KCSP)	Not listed
Commercial model	Pay-as-you-go / hourly; optional trial via sales	Not listed
Product type	Not listed	Cloud PACS / VNA SaaS
Self-hosted	Not listed	No (local connector only)
Default viewer	Not listed	OHIF (not for diagnosis per GTCs)
Data residency regions	Not listed	Switzerland claimed for DICOM/hosting; some auxiliary processing in EU (IE/DK) per privacy policy

Key capabilities: Cyso Cloud vs Unomed Cloud PACS
Key capabilities	Cyso Cloud	Unomed Cloud PACS
EU-operated (NL)	Yes	Yes
OpenStack IaaS	Yes	Not listed
Managed Kubernetes (KCSP)	Yes	Not listed
AMS + FRA regions	Yes	Not listed
ISO 27001 (claimed)	Yes	Not listed
NEN 7510 (claimed)	Yes	Not listed
Cloud PACS / VNA	Not listed	Yes
DICOM archive	Not listed	Yes
Browser viewer	Not listed	Yes
PIS overlay	Not listed	Yes

Cyso Cloud

OpenStack public IaaS on EU hardware
Vanilla OpenStack compute (roughly 2–64 vCPUs and up to 512 GB RAM flavors), NVMe-backed ephemeral and block volumes, dashboard plus OpenStack APIs/CLI. Deployed on Cyso-managed hardware in Amsterdam and Frankfurt with three availability zones per region so multi-AZ designs are first-class.
S3-compatible NVMe object storage
Region-scoped object storage with triple-disk redundancy, versioning, lifecycle rules, object lock, pre-signed URLs, and standard S3 clients (AWS CLI, Rclone, MinIO mc, SDKs). Data and replicas stay in the selected AMS or FRA region; default server-side encryption at rest is not applied—plan client-side or customer-key approaches for sensitive objects.
Enterprise Managed Kubernetes (KCSP)
CNCF Kubernetes Certified Service Provider managed control planes with multi-version support, automated upgrades, worker groups (including GPU/high-memory options), HPA/VPA/node autoscaling, Garden Linux workers, Terraform/kubectl/k9s workflows, and cluster hibernation to scale workers to zero on a schedule.
European networking and multi-AZ design
VPC-style private networks, security groups as virtual firewalls, load balancers with health checks, floating/reserved IPs, Anycast DNS, IPv6 dual-stack, native edge DDoS mitigation, and Direct Connect-style private links. SLA text targets 99.99% monthly uptime for listed compute, volume, object, and networking services when multi-AZ conditions are met.
Private cloud and wholesale options
Same OpenStack-based stack can be deployed as a private cloud on customer data-centre hardware (including VMware-alternative messaging) or white-label/wholesale models for partners—useful when public multi-tenant regions are not enough for isolation or residency policy.

Unomed Cloud PACS

Cloud DICOM archive (VNA-style)
Central archive for studies from in-house modalities and external institutes, with DICOM export so you can take the archive with you. Storage is billed as you grow; long-term statutory retention remains the customer's duty under Unomed's terms.
Zero-footprint browser viewer (OHIF default)
Open studies in the browser with nothing installed on the workstation. OHIF is the default; other viewers can be connected on request. Unomed's GTCs state the standard viewer is not authorised for diagnostic reporting.
PACS inbox with assisted patient matching
Inbound studies land in an inbox; Unomed suggests the matching patient (including fuzzy name matches) and a human confirms. Useful when institutes send studies that do not already carry a clean order from your record.
Share via messenger and guest links
Send studies to colleagues, referrers and patients through Unomed messenger. Recipients without an account get a time-limited guest link; registered users keep the thread in case chat instead of CDs or ad-hoc portals.
Cloud Connector, Radiology Bridge and Medical API
Connect DICOM modalities like a second destination printer, autoroute from an existing institute PACS via Radiology Bridge, or integrate via DICOMweb/Medical API. Keeps on-site PACS investments when you only need outbound routing to Unomed practices.
Overlay on existing practice software
Opens studies from the patient record in supported web-based Swiss practice systems without replacing the PIS. Vendor lists 16+ systems with several official partners; desktop-only software needs a feasibility discussion.

Assurance & compliance: Cyso Cloud vs Unomed Cloud PACS
Assurance & compliance	Cyso Cloud	Unomed Cloud PACS
Independent security / no-logs audit	Not found Security measures and pen-testing philosophy are described; no public independent no-logs or IaaS audit report found beyond ISMS certs.	Not found No public independent security audit report located on unomed.ch.
ISO 27001	Vendor claimed Vendor publishes ISO/IEC 27001 certificate PDF via Trust Centre / certifications (listed expiry into 2028). Not re-checked on an independent registry for this draft.	Not found No ISO 27001 certificate or registry entry found on the official site.
SOC 2 / SOC 3	Not found Certifications page explains SOC 2 Type II generally; no clear statement that Cyso currently holds a published SOC 2 report.	Not found No SOC 2/3 report referenced on public pages reviewed.
GDPR / EU data protection	Vendor claimed EU legal entity; AMS/FRA residency claims; Trust Centre GDPR section. Obtain DPA and TOMs for controller/processor mapping.	Vendor claimed Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case.
US CLOUD Act exposure (indicative)	Partial EuropeanStack assessment: EU entity, no known US parent, primary IaaS claimed on self-operated NL/DE hardware (not AWS/GCP/Azure). Partial because no full public subprocessor schedule and ancillary SaaS (e.g. PostHog analytics, Atlassian-linked status) may involve non-EU providers. Not legal advice.	Partial Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Marketing (e.g. Azure alternative pages) states Cyso signs a DPA under Dutch law; confirm current template and subprocessor annex in contracting.	Vendor claimed GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider.
NEN 7510 (Dutch healthcare information security)	Vendor claimed Vendor publishes NEN 7510 certificate PDF on certifications/Trust Centre pages.	Not listed
EU AI Act	Not applicable IaaS/infrastructure platform, not an AI system product.	Not applicable PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system.
Diagnostic viewer certification	Not listed	Partial Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional.

Considerations & known limitations: Cyso Cloud vs Unomed Cloud PACS
Considerations & known limitations	Cyso Cloud	Unomed Cloud PACS
Only two live public regions	Medium Production public cloud is AMS and FRA today. Multi-continent latency, in-country residency outside NL/DE, or extensive multi-region DR across Europe may require another provider or private cloud.	Not listed
No default object storage encryption at rest	Medium Official FAQs state no standard server-side encryption at rest; TLS in transit and client-side/SSE-C patterns are recommended. Regulated designs must implement key management outside default storage behaviour.	Not listed
Incomplete public subprocessor inventory	Medium Primary hosting path is vendor-operated EU hardware, but privacy materials list third parties without a dedicated live subprocessor register for all ancillary processing. Request the schedule under NDA or DPA annex.	Not listed
Certifications are vendor-published PDFs	Low ISO 27001 and NEN 7510 are claimed with certificate PDFs on Cyso sites; this draft did not independently verify registry entries. Treat as claimed until audit pack is reviewed.	Not listed
Smaller ecosystem than hyperscalers	Low Fewer managed PaaS services and marketplace options than AWS/Azure/GCP. Expect to run more of the stack yourself on OpenStack/Kubernetes.	Not listed
US-group cloud components in the data path	Not listed	Medium Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk.
Default viewer not for diagnosis	Not listed	High If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted.
No public ISO/SOC or independent audit	Not listed	Medium Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates.
Subprocessor list not published	Not listed	Medium Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared.

Fit

Cyso Cloud

Best fit when

European product/SaaS teams that need VMs, volumes, and S3-compatible storage with explicit Amsterdam or Frankfurt residency
Organisations standardising on OpenStack APIs/CLI to reduce hyperscaler lock-in and support multi-cloud portability
Teams wanting CNCF KCSP managed Kubernetes with hibernation and pay-as-you-go worker nodes on EU infrastructure
Dutch healthcare-adjacent or regulated buyers who need NEN 7510 alongside ISO 27001 claims from a NL operator
Buyers evaluating a private OpenStack cloud or VMware alternative on their own data-centre hardware

Poor fit when

Workloads that require many global regions, edge PoPs, or a large marketplace of managed PaaS services
Storage designs that assume default server-side encryption at rest without customer-managed keys
Procurement that must rely only on a fully published subprocessor schedule without vendor engagement
Teams that need fully self-serve free tiers or only automated chat support with no human engineering contact

Consider instead when

When: You need many European (or global) regions and a broader product catalogue than two live IaaS regions
Consider: OVHcloud or Scaleway
Larger EU multi-region footprints; different APIs and commercial models.
When: You want Swiss multi-zone simplicity with strong managed Kubernetes emphasis
Consider: Exoscale
Swiss operator profile; fewer regions than hyperscalers but clear sovereignty messaging.
When: You need maximum global PaaS depth, AI services, and worldwide edge
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership for ecosystem breadth; apply your own residency and CLOUD Act analysis.
When: You prioritise high-performance European VMs across more city locations than AMS/FRA only
Consider: UpCloud
Different stack; compare residency guarantees and support model side by side.

Unomed Cloud PACS

Best fit when

Swiss medical or dental practices that want cloud DICOM archive and sharing without an on-site PACS project
Teams that must open imaging from an existing web-based practice system rather than a second patient search
Institutes that need to autoroute studies to referring practices while keeping an existing PACS (Radiology Bridge)
Buyers who prioritise a Swiss contracting entity and vendor-claimed Swiss image residency under the FADP
Workflows that share studies with referrers or patients via links instead of CDs or one-off portals

Poor fit when

Organisations that require the included viewer to be a certified diagnostic/reporting workstation out of the box
Buyers that need a published named subprocessor list and independent ISO/SOC evidence before first sales call
Teams seeking a fully self-hosted open-source PACS they operate themselves
Hospitals needing a full RIS/PACS suite beyond practice-oriented cloud archive and sharing

Consider instead when

When: You need a European cloud PACS peer outside Switzerland or broader multi-country packaging
Consider: PostDICOM (Netherlands) or other EU cloud PACS vendors
Feature parity is not claimed; compare residency contracts and viewer certification directly.
When: You primarily need raw cloud object storage or hospital-grade imaging services on a hyperscaler
Consider: AWS or Azure health/imaging stacks with your own viewer and compliance design
More infrastructure flexibility; you own more of the clinical workflow glue.
When: You must keep all image data on premises under your sole operational control
Consider: Classic on-prem PACS plus a dedicated sharing portal
Unomed is cloud SaaS with a local connector, not a self-hosted Unomed server product.

Open questions for due diligence

Cyso Cloud

Can Cyso provide the current DPA, technical and organisational measures, and a dated subprocessor list covering payments, support, analytics, and status tooling?
What is the exact OpenStack release, upgrade cadence, and any divergences from upstream APIs that affect Terraform/automation?
For object storage and volumes, what encryption-at-rest or KMS options can be contractually committed for regulated data?
What are contractual 24/7 escalation SLAs for severity-1 incidents beyond office-hours tech-to-tech support?
Which additional EU regions (if any) have committed go-live dates versus community voting only?

Unomed Cloud PACS

Will Unomed provide the current named subprocessor list (hosting, backup, email, SMS, identity) under NDA or in the ABV annex?
Which exact Swiss data-centre operators and certifications cover the DICOM archive?
Is a CE-marked / certified diagnostic viewer required for your reporting workflow, and which third-party option will Unomed integrate?
What SLA, backup/RPO and export support apply to your Cloud PACS tier?