Elastx vs Unomed Cloud PACS

Compare Elastx and Unomed Cloud PACS on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Elastx

Sweden· Cloud Computing

Needs review

Shortlist Elastx when you need a Sweden-only OpenStack public cloud with multi-AZ managed Kubernetes and DBaaS under a Swedish AB and self-operated Stockholm data centers. Skip when you need many global regions, hyperscaler managed-service breadth, or live migration as a platform feature—consider UpCloud, Scaleway, OVHcloud, or Azure/AWS instead depending on sovereignty vs scale tradeoffs.

Swedish OpenStack IaaSMulti-AZ managed KubernetesManaged DBaaSISO 27001/27017/27018 (claimed)Sweden data residencyHourly, no lock-in contracts

View listing Visit Website

Unomed Cloud PACS

Switzerland· Cloud Computing

Needs review

Shortlist for Swiss practices that want a cloud DICOM archive, browser viewing and referrer sharing without replacing their PIS, and that accept a Zurich SaaS vendor with claimed Swiss image hosting. Skip when you need a default CE-marked diagnostic viewer, a fully public subprocessor and audit pack, or a self-hosted PACS you operate yourself. Consider PostDICOM or a classic on-prem PACS plus sharing tool when those constraints dominate.

Swiss-operatedCloud PACS / VNADICOM archiveBrowser viewerPIS overlay

View listing Visit Website

Highlighted rows differ between the two products.

Elastx vs Unomed Cloud PACS: Snapshot
Feature	Elastx	Unomed Cloud PACS
Country of origin	Sweden	Switzerland
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Sweden	Switzerland
Legal entity	Elastx AB	Unomed AG
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Self-operated Swedish Tier 3 data centers; primary region se-sto with three Stockholm-area AZs (~20 km apart). Customer platform data documented as staying in Sweden; Swift object storage triple-replicated across AZs. Not sold as AWS/Azure/GCP regions. Website analytics: Piwik PRO. Optional products (Varnish CDN beta, Virtuozzo PaaS software, hybrid Cloud Connect/Exchange to other clouds) may add separate paths—confirm in DPA. No public full subprocessor inventory found.	Vendor claims primary hosting, databases and DICOM storage in Switzerland. Privacy policy lists identity/liveness processing in EU (Ireland) and speech recognition in EU (Denmark). API CSP references AWS S3 eu-central-2 (Zurich) and AWS Rekognition/Cognito eu-west-1; push via Firebase; website may use Cloudflare WAF cookies and Google Analytics. Named subprocessor list on request only.
Summary	Swedish cloud provider (Elastx AB) offering OpenStack IaaS, managed Kubernetes, DBaaS, and related services with data and operations kept in Sweden across three Stockholm availability zones.	Swiss cloud PACS and vendor-neutral archive for storing, viewing and sharing DICOM medical images in the browser, integrated with existing medical practice workflows.
Tags	cloud openstack kubernetes iaas swedish-cloud data-sovereignty dbaas	pacs dicom medical-imaging healthcare cloud-pacs switzerland vna

At a glance: Elastx vs Unomed Cloud PACS
At a glance	Elastx	Unomed Cloud PACS
HQ	Stockholm, Sweden (Elastx AB)	Zurich, Switzerland
Founded	2012	Not listed
Primary region	se-sto — 3 AZs in Stockholm area	Not listed
Core stack	OpenStack IaaS, Kubernetes CaaS, DBaaS	Not listed
Commercial model	Hourly usage; no long-term lock-in contracts (vendor)	Not listed
Ownership	Swedish PE Sobro majority (~53%); no known US parent	Not listed
Legal entity	Not listed	Unomed AG (CHE-374.858.885)
Product type	Not listed	Cloud PACS / VNA SaaS
Self-hosted	Not listed	No (local connector only)
Default viewer	Not listed	OHIF (not for diagnosis per GTCs)
Data residency regions	Not listed	Switzerland claimed for DICOM/hosting; some auxiliary processing in EU (IE/DK) per privacy policy

Key capabilities: Elastx vs Unomed Cloud PACS
Key capabilities	Elastx	Unomed Cloud PACS
Swedish OpenStack IaaS	Yes	Not listed
Multi-AZ managed Kubernetes	Yes	Not listed
Managed DBaaS	Yes	Not listed
ISO 27001/27017/27018 (claimed)	Yes	Not listed
Sweden data residency	Yes	Not listed
Hourly, no lock-in contracts	Yes	Not listed
Swiss-operated	Not listed	Yes
Cloud PACS / VNA	Not listed	Yes
DICOM archive	Not listed	Yes
Browser viewer	Not listed	Yes
PIS overlay	Not listed	Yes

Elastx

OpenStack IaaS across three Stockholm AZs
Full virtual data center on OpenStack (Nova/Neutron/Cinder/Swift/Octavia/Barbican and related services): KVM instances, security groups, encrypted block and object storage, load balancers, and HSM-backed secrets. Primary region se-sto uses three separate data centers up to ~20 km apart; you pick AZ per resource. Marketplace-validated OpenStack public cloud; hourly metering. No live migration—design for multi-AZ yourself.
Managed multi-AZ Kubernetes (CNCF-certified)
Private Kubernetes clusters on Elastx OpenStack with at least three control-plane and three worker nodes spread across all three AZs. Fully managed option includes 24×7 cluster monitoring and planned rolling upgrades; non-managed includes office-hours upgrades/support without continuous monitoring. CNCF Certified Kubernetes Platform listing; OpenStack integration for persistent volumes and load balancers. Minimum production footprint is non-trivial—test clusters available under different terms.
Managed DBaaS with multi-engine choice
Self-service datastores for MariaDB, MySQL, PostgreSQL, Microsoft SQL Server, and Valkey with automated provisioning, metrics UI, IP allowlisting, and MFA (TOTP/YubiKey) via Elastx Identity Provider. Single-node or primary plus one/two read replicas; multi-node layouts and backups use multiple Swedish AZs with automatic failover options. Backups land in triple-replicated Swift object storage. Customer owns query design, extra users/DBs, and restore decisions.
Platform security defaults and Swedish ops
Included L3/L4 DDoS protection, threat intelligence blocking, encryption at rest for ephemeral/volume/object storage, encrypted inter-AZ links, and HSM-backed secret management. Data centers described as Tier 3 with 24×7 staffing; staff described as Swedish citizens with annual background checks. Suits regulated buyers who want baseline controls without buying each security add-on separately—still shared responsibility for OS and app hardening on IaaS.
GPU and AI workloads on Swedish infrastructure
NVIDIA Ampere-class and related GPU flavors on OpenStack and Kubernetes for AI, analytics, and HPC-style jobs, plus an AI services offering framed around Swedish digital sovereignty and regulatory control. Useful when models or training data must stay in Sweden; not a substitute for evaluating the separate AI product scope, model licenses, or EU AI Act classification for your use case.

Unomed Cloud PACS

Cloud DICOM archive (VNA-style)
Central archive for studies from in-house modalities and external institutes, with DICOM export so you can take the archive with you. Storage is billed as you grow; long-term statutory retention remains the customer's duty under Unomed's terms.
Zero-footprint browser viewer (OHIF default)
Open studies in the browser with nothing installed on the workstation. OHIF is the default; other viewers can be connected on request. Unomed's GTCs state the standard viewer is not authorised for diagnostic reporting.
PACS inbox with assisted patient matching
Inbound studies land in an inbox; Unomed suggests the matching patient (including fuzzy name matches) and a human confirms. Useful when institutes send studies that do not already carry a clean order from your record.
Share via messenger and guest links
Send studies to colleagues, referrers and patients through Unomed messenger. Recipients without an account get a time-limited guest link; registered users keep the thread in case chat instead of CDs or ad-hoc portals.
Cloud Connector, Radiology Bridge and Medical API
Connect DICOM modalities like a second destination printer, autoroute from an existing institute PACS via Radiology Bridge, or integrate via DICOMweb/Medical API. Keeps on-site PACS investments when you only need outbound routing to Unomed practices.
Overlay on existing practice software
Opens studies from the patient record in supported web-based Swiss practice systems without replacing the PIS. Vendor lists 16+ systems with several official partners; desktop-only software needs a feasibility discussion.

Assurance & compliance: Elastx vs Unomed Cloud PACS
Assurance & compliance	Elastx	Unomed Cloud PACS
Independent security / pen-test audit (public)	Not found No public independent audit PDF or pen-test report located; ISO management-system claims are separate.	Not found No public independent security audit report located on unomed.ch.
ISO 27001 / 27017 / 27018	Vendor claimed Vendor states ISO 27001 since 2015 and current 27017/27018; request current certificates. Badge marked claimed.	Not found No ISO 27001 certificate or registry entry found on the official site.
ISO 14001 (environmental)	Vendor claimed Vendor claims ISO 14001 with green electricity; Green Web Foundation badge linked on site.	Not listed
SOC 2 / SOC 3	Not found No SOC 2/3 claim found on official product/trust pages reviewed.	Not found No SOC 2/3 report referenced on public pages reviewed.
GDPR / EU data protection	Vendor claimed Swedish AB; privacy policy; Sweden data residency claims; DPA path advertised. Confirm processor role wording in contract.	Vendor claimed Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case.
US CLOUD Act exposure (indicative)	Partial Swedish entity, no known US parent, self-operated SE DCs—not AWS/GCP/Azure primary hosting. Vendor claims Cloud Act–free. Public subprocessor inventory not found; optional hybrid links/CDN/SaaS tools can change residual risk. Indicative only—not legal advice.	Partial Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice.
Data processing agreement (B2B)	Vendor claimed About page: ISO certifications and ability to enter DPAs for GDPR personal data. Obtain signed DPA + subprocessors in procurement.	Vendor claimed GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider.
EU AI Act	Not applicable Core offering is IaaS/CaaS/DBaaS. Separate AI services exist—classify your own AI use case under the AI Act if applicable.	Not applicable PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system.
Diagnostic viewer certification	Not listed	Partial Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional.

Considerations & known limitations: Elastx vs Unomed Cloud PACS
Considerations & known limitations	Elastx	Unomed Cloud PACS
No public subprocessor inventory	Medium Marketing/docs emphasize Swedish operations and ISO, but a complete public subprocessor list was not found. Request it with the DPA before treating residual transfer risk as zero.	Not listed
OpenStack operational constraints	Medium No live migration; no cross-AZ volume migration while attached; one router per project; floating-IP hairpin limits. Multi-AZ designs must be intentional—not automatic failover of every pattern.	Not listed
Sweden-centric footprint	Low Primary strength is Swedish residency; teams needing many non-Swedish regions will outgrow the geography and should evaluate multi-country EU clouds or hyperscalers.	Not listed
ISO claims need certificate pack	Low ISO 27001/27017/27018/14001 are vendor-claimed publicly; independent public audit PDFs for no-logs/pen-test not found. Procurement should verify current certificates.	Not listed
US-group cloud components in the data path	Not listed	Medium Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk.
Default viewer not for diagnosis	Not listed	High If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted.
No public ISO/SOC or independent audit	Not listed	Medium Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates.
Subprocessor list not published	Not listed	Medium Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared.

Fit

Elastx

Best fit when

Organizations that must keep infrastructure and personal data processing in Sweden under a Swedish legal entity
Platform teams that want OpenStack APIs, Terraform-friendly IaaS, and open standards without commercial lock-in contracts
Teams needing CNCF-aligned private Kubernetes with control planes and workers across three Swedish AZs
Product teams wanting managed MariaDB/MySQL/PostgreSQL/MSSQL/Valkey with multi-AZ options and object-storage backups
Buyers who value included baseline security (DDoS, threat intel, encryption at rest, HSM secrets) and 24×7 Swedish support

Poor fit when

Workloads that require many regions outside Sweden or a hyperscaler-scale SaaS/marketplace ecosystem
Architectures that depend on live migration or transparent cross-AZ volume moves (not supported)
Teams that only need a few simple VMs and prefer a minimal global UI over OpenStack operational depth
Buyers who require published independent pen-test/no-logs audit packs before shortlisting (not found publicly)

Consider instead when

When: You need high-performance IaaS across multiple European countries with a simpler product surface
Consider: UpCloud
Less Sweden-only OpenStack/K8s packaging; stronger multi-country footprint.
When: You want broad EU/FR developer cloud (bare metal, serverless, many regions) rather than Sweden-only OpenStack
Consider: Scaleway or OVHcloud
Different sovereignty and product mixes; not a drop-in OpenStack twin.
When: You need global regions and the deepest managed-service catalogs despite US CLOUD Act exposure
Consider: Microsoft Azure or AWS
Opposite sovereignty tradeoff.
When: Your RFP is pure Swedish public-sector OpenStack peers
Consider: Cleura or Safespring (evaluate off-catalog if not listed)
Closest Nordic sovereignty competitors.

Unomed Cloud PACS

Best fit when

Swiss medical or dental practices that want cloud DICOM archive and sharing without an on-site PACS project
Teams that must open imaging from an existing web-based practice system rather than a second patient search
Institutes that need to autoroute studies to referring practices while keeping an existing PACS (Radiology Bridge)
Buyers who prioritise a Swiss contracting entity and vendor-claimed Swiss image residency under the FADP
Workflows that share studies with referrers or patients via links instead of CDs or one-off portals

Poor fit when

Organisations that require the included viewer to be a certified diagnostic/reporting workstation out of the box
Buyers that need a published named subprocessor list and independent ISO/SOC evidence before first sales call
Teams seeking a fully self-hosted open-source PACS they operate themselves
Hospitals needing a full RIS/PACS suite beyond practice-oriented cloud archive and sharing

Consider instead when

When: You need a European cloud PACS peer outside Switzerland or broader multi-country packaging
Consider: PostDICOM (Netherlands) or other EU cloud PACS vendors
Feature parity is not claimed; compare residency contracts and viewer certification directly.
When: You primarily need raw cloud object storage or hospital-grade imaging services on a hyperscaler
Consider: AWS or Azure health/imaging stacks with your own viewer and compliance design
More infrastructure flexibility; you own more of the clinical workflow glue.
When: You must keep all image data on premises under your sole operational control
Consider: Classic on-prem PACS plus a dedicated sharing portal
Unomed is cloud SaaS with a local connector, not a self-hosted Unomed server product.

Open questions for due diligence

Elastx

Will Elastx provide a current ISO certificate package and statement of applicability under NDA?
What is the full subprocessor list for support, ticketing, email, monitoring, CDN, and any AI services?
Which optional services (Varnish CDN, Virtuozzo PaaS, hybrid Cloud Exchange links) process customer data outside Elastx-operated Swedish DCs?
What RTO/RPO and availability SLA apply to the specific SKUs under evaluation (IaaS vs managed K8s vs DBaaS)?

Unomed Cloud PACS

Will Unomed provide the current named subprocessor list (hosting, backup, email, SMS, identity) under NDA or in the ABV annex?
Which exact Swiss data-centre operators and certifications cover the DICOM archive?
Is a CE-marked / certified diagnostic viewer required for your reporting workflow, and which third-party option will Unomed integrate?
What SLA, backup/RPO and export support apply to your Cloud PACS tier?