Hetzner vs Unomed Cloud PACS

Compare Hetzner and Unomed Cloud PACS on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

Hetzner

Germany· Cloud Computing

Needs review

Shortlist for German-owned IaaS/bare metal in DE/FI parks, API cloud VMs, inclusive-traffic EU economics, ISO 27001 + BSI C5 Type 2. Skip for hyperscaler PaaS depth, SOC 2-first audits, or zero US-group footprint (optional US Ashburn/Hillsboro + Singapore via subsidiaries/colocation). Prefer OVHcloud/Scaleway for broader EU portfolios; STACKIT for DE public-sector framing.

EU-operated (DE HQ)Owned DE/FI parksISO 27001:2022BSI C5 Type 2Bare metal + auctionOptional US/SG cloud

View listing Visit Website

Unomed Cloud PACS

Switzerland· Cloud Computing

Needs review

Shortlist for Swiss practices that want a cloud DICOM archive, browser viewing and referrer sharing without replacing their PIS, and that accept a Zurich SaaS vendor with claimed Swiss image hosting. Skip when you need a default CE-marked diagnostic viewer, a fully public subprocessor and audit pack, or a self-hosted PACS you operate yourself. Consider PostDICOM or a classic on-prem PACS plus sharing tool when those constraints dominate.

Swiss-operatedCloud PACS / VNADICOM archiveBrowser viewerPIS overlay

View listing Visit Website

Highlighted rows differ between the two products.

Hetzner vs Unomed Cloud PACS: Snapshot
Feature	Hetzner	Unomed Cloud PACS
Country of origin	Germany	Switzerland
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Switzerland
Legal entity	Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (HRB 6089 Ansbach)	Unomed AG
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Medium	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Owned parks: Nuremberg, Falkenstein (DE), Helsinki (FI). Non-cloud EU-only. Cloud optional US (Ashburn, Hillsboro) and Singapore on 3rd-party colocation. AV subprocessors: Hetzner Finland Oy; US: Hetzner US LLC, NTT Americas, QTS Hillsboro; SG: Hetzner Singapore, NTT SG1. Master data stays EU.	Vendor claims primary hosting, databases and DICOM storage in Switzerland. Privacy policy lists identity/liveness processing in EU (Ireland) and speech recognition in EU (Denmark). API CSP references AWS S3 eu-central-2 (Zurich) and AWS Rekognition/Cognito eu-west-1; push via Firebase; website may use Cloudflare WAF cookies and Google Analytics. Named subprocessor list on request only.
Summary	German data center operator (Gunzenhausen): dedicated servers, Hetzner Cloud VPS, storage, and owned parks in Germany and Finland, with optional US and Singapore cloud locations.	Swiss cloud PACS and vendor-neutral archive for storing, viewing and sharing DICOM medical images in the browser, integrated with existing medical practice workflows.
Tags	cloud vps dedicated-servers hosting gdpr germany data-center bare-metal self-hosting iso-27001 c5 hetzner-cloud	pacs dicom medical-imaging healthcare cloud-pacs switzerland vna

At a glance: Hetzner vs Unomed Cloud PACS
At a glance	Hetzner	Unomed Cloud PACS
HQ	Gunzenhausen, Germany	Zurich, Switzerland
Legal entity	Hetzner Online GmbH (HRB 6089 Ansbach)	Unomed AG (CHE-374.858.885)
EU parks	Nuremberg, Falkenstein (DE); Helsinki (FI)	Not listed
Optional cloud regions	Ashburn and Hillsboro (US); Singapore	Not listed
Model	IaaS / dedicated / hosting (unmanaged cloud and root)	Not listed
Open source	No (commercial infrastructure)	Not listed
Product type	Not listed	Cloud PACS / VNA SaaS
Self-hosted	Not listed	No (local connector only)
Default viewer	Not listed	OHIF (not for diagnosis per GTCs)
Data residency regions	Not listed	Switzerland claimed for DICOM/hosting; some auxiliary processing in EU (IE/DK) per privacy policy

Key capabilities: Hetzner vs Unomed Cloud PACS
Key capabilities	Hetzner	Unomed Cloud PACS
EU-operated (DE HQ)	Yes	Yes
Owned DE/FI parks	Yes	Not listed
ISO 27001:2022	Yes	Not listed
BSI C5 Type 2	Yes	Not listed
Bare metal + auction	Yes	Not listed
Optional US/SG cloud	Yes	Not listed
Cloud PACS / VNA	Not listed	Yes
DICOM archive	Not listed	Yes
Browser viewer	Not listed	Yes
PIS overlay	Not listed	Yes

Hetzner

Dedicated root servers and Server Auction
Bare-metal root servers with full hardware isolation for predictable I/O and custom OS installs. The Server Auction lists surplus or end-of-primary-use machines at declining prices for labs, secondary environments, and cost-sensitive dedicated capacity.
Hetzner Cloud with API, networks, and apps
VMs with shared or dedicated vCPU classes, managed via Console, REST API, and CLI. Private networks, stateful firewalls, load balancers, Linux images, Terraform/Ansible/Kubernetes integrations, and one-click apps (Docker, Nextcloud, GitLab CE, WireGuard, and more) for self-hosted stacks.
Owned EU data center parks plus optional US/Singapore cloud
Company-operated parks in Nuremberg, Falkenstein (Germany), and Helsinki (Finland). Cloud also in Ashburn, Hillsboro (USA), and Singapore on third-party colocation. Non-cloud products and EU-selected cloud locations keep server data in the EU per Hetzner docs; master data stays in the EU.
ISO 27001, BSI C5 Type 2, and console DPA
Public ISO/IEC 27001:2022 certificate for DE/FI park scope; BSI C5 Type 2 for cloud; Art. 28 DPA accept-in-console with published TOMs and annual external TOM review available to DPA customers. Not a SOC 2-first vendor.
Inclusive traffic-oriented European cloud pricing model
Pay-as-you-go cloud (hourly or monthly) and list-based dedicated servers, with marketing emphasis on high inclusive traffic on European plans versus hyperscaler egress bills. Confirm current allowances and rates only on the official calculator—figures change by region and over time.

Unomed Cloud PACS

Cloud DICOM archive (VNA-style)
Central archive for studies from in-house modalities and external institutes, with DICOM export so you can take the archive with you. Storage is billed as you grow; long-term statutory retention remains the customer's duty under Unomed's terms.
Zero-footprint browser viewer (OHIF default)
Open studies in the browser with nothing installed on the workstation. OHIF is the default; other viewers can be connected on request. Unomed's GTCs state the standard viewer is not authorised for diagnostic reporting.
PACS inbox with assisted patient matching
Inbound studies land in an inbox; Unomed suggests the matching patient (including fuzzy name matches) and a human confirms. Useful when institutes send studies that do not already carry a clean order from your record.
Share via messenger and guest links
Send studies to colleagues, referrers and patients through Unomed messenger. Recipients without an account get a time-limited guest link; registered users keep the thread in case chat instead of CDs or ad-hoc portals.
Cloud Connector, Radiology Bridge and Medical API
Connect DICOM modalities like a second destination printer, autoroute from an existing institute PACS via Radiology Bridge, or integrate via DICOMweb/Medical API. Keeps on-site PACS investments when you only need outbound routing to Unomed practices.
Overlay on existing practice software
Opens studies from the patient record in supported web-based Swiss practice systems without replacing the PIS. Vendor lists 16+ systems with several official partners; desktop-only software needs a feasibility discussion.

Assurance & compliance: Hetzner vs Unomed Cloud PACS
Assurance & compliance	Hetzner	Unomed Cloud PACS
Independent security / no-logs audit	Not applicable Hosting/IaaS, not a no-logs VPN. Public ISO 27001, BSI C5 Type 2, and annual TOM review (TUV Rheinland) instead.	Not found No public independent security audit report located on unomed.ch.
ISO 27001	Verified ISO/IEC 27001:2022; public SOCOTEC certificate. Scope: infrastructure, operation, support of Nuremberg, Falkenstein, Helsinki parks.	Not found No ISO 27001 certificate or registry entry found on the official site.
SOC 2 / SOC 3	Not found Hetzner states focus on ISO 27001 rather than SOC 2 for international market.	Not found No SOC 2/3 report referenced on public pages reviewed.
GDPR / EU data protection	Vendor claimed German entity; public privacy policy, Art. 28 DPA, TOMs, subprocessor list. Customer remains controller for data on rented systems.	Vendor claimed Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case.
US CLOUD Act exposure (indicative)	Partial EU entity / no known US parent, but optional US cloud uses Hetzner US LLC and US colocation (NTT, QTS); Singapore similarly. EU placements keep server data in EU per docs. Not legal advice.	Partial Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice.
Data processing agreement (B2B)	Vendor claimed Standard DPA accept-in-console; sample PDF published; no custom wet-ink DPAs per vendor docs.	Vendor claimed GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider.
EU AI Act	Not applicable Infrastructure hosting, not an AI system product.	Not applicable PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system.
BSI C5 (cloud)	Verified Vendor publishes BSI C5 Type 2 attestation PDF for cloud services (German BSI catalogue).	Not listed
KRITIS / section 8a BSIG	Vendor claimed Hetzner states BSI classification as operator of critical services and certification under section 8a BSIG.	Not listed
Diagnostic viewer certification	Not listed	Partial Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional.

Considerations & known limitations: Hetzner vs Unomed Cloud PACS
Considerations & known limitations	Hetzner	Unomed Cloud PACS
Optional US and Singapore cloud regions	Medium Ashburn, Hillsboro, and Singapore use third-party colocation and local subsidiaries; server content placed there leaves the EU. Zero-US-footprint policies may still reject the vendor even for EU-only workloads.	Not listed
Unmanaged cloud and dedicated servers	Medium You own OS patching, app security, and backups. Platform firewalls help but do not replace customer ops. Poor fit if you need managed DBaaS and full-stack ops.	Not listed
Narrower managed-service catalog vs hyperscalers	Low Strong IaaS and bare metal; weak match if procurement assumes AWS-parity managed services. Plan hybrid architecture early.	Not listed
ISO scope is DE/FI parks	Low Published ISO 27001 scope centers on German and Finnish parks. Do not assume identical coverage for every US/Singapore deployment without reading current certificates.	Not listed
US-group cloud components in the data path	Not listed	Medium Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk.
Default viewer not for diagnosis	Not listed	High If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted.
No public ISO/SOC or independent audit	Not listed	Medium Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates.
Subprocessor list not published	Not listed	Medium Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared.

Fit

Hetzner

Best fit when

Teams that want German-jurisdiction hosting with owned parks in Germany and Finland
Workloads that need bare-metal root servers or cost-effective dedicated via Server Auction
Ops-heavy orgs comfortable with unmanaged IaaS (Console/API/CLI, Terraform, apps)
Buyers optimizing for EU residency plus inclusive traffic economics versus hyperscaler egress
German/EU checklists asking for ISO 27001, BSI C5, and an Art. 28 DPA in-console

Poor fit when

Orgs that need a full AWS/Azure-style managed services catalog (PaaS, serverless, AI)
Policies that forbid any US subsidiary, US colocation, or optional US region at group level
Buyers requiring SOC 2 as the primary assurance artifact (Hetzner focuses on ISO/C5)
Teams expecting fully managed OS patching, databases, and DR without operating the stack

Consider instead when

When: You need a broader European cloud portfolio or more managed service surface
Consider: OVHcloud or Scaleway
Still European operators; compare regions, bare-metal depth, and support models.
When: German public-sector sovereign cloud framing is the primary procurement driver
Consider: STACKIT
Different product and governance story; verify current certifications and residency.
When: You need hyperscaler managed depth more than EU-owned IaaS
Consider: AWS, Azure, or Google Cloud (accept US-group CLOUD Act posture)
Trade EU operator control for catalog breadth.
When: You want a smaller EU regional cloud with a different feature/region mix
Consider: Exoscale or UpCloud
Compare locations, SLAs, and managed options against Hetzner's park scale.

Unomed Cloud PACS

Best fit when

Swiss medical or dental practices that want cloud DICOM archive and sharing without an on-site PACS project
Teams that must open imaging from an existing web-based practice system rather than a second patient search
Institutes that need to autoroute studies to referring practices while keeping an existing PACS (Radiology Bridge)
Buyers who prioritise a Swiss contracting entity and vendor-claimed Swiss image residency under the FADP
Workflows that share studies with referrers or patients via links instead of CDs or one-off portals

Poor fit when

Organisations that require the included viewer to be a certified diagnostic/reporting workstation out of the box
Buyers that need a published named subprocessor list and independent ISO/SOC evidence before first sales call
Teams seeking a fully self-hosted open-source PACS they operate themselves
Hospitals needing a full RIS/PACS suite beyond practice-oriented cloud archive and sharing

Consider instead when

When: You need a European cloud PACS peer outside Switzerland or broader multi-country packaging
Consider: PostDICOM (Netherlands) or other EU cloud PACS vendors
Feature parity is not claimed; compare residency contracts and viewer certification directly.
When: You primarily need raw cloud object storage or hospital-grade imaging services on a hyperscaler
Consider: AWS or Azure health/imaging stacks with your own viewer and compliance design
More infrastructure flexibility; you own more of the clinical workflow glue.
When: You must keep all image data on premises under your sole operational control
Consider: Classic on-prem PACS plus a dedicated sharing portal
Unomed is cloud SaaS with a local connector, not a self-hosted Unomed server product.

Open questions for due diligence

Hetzner

Does your policy allow a German provider that also offers US/Singapore regions if you only deploy in DE/FI?
Is BSI C5 Type 2 + ISO 27001 sufficient, or is SOC 2 mandatory for your auditors?
Which SKUs (cloud vs dedicated vs managed web hosting) match your backup and support needs?
Will you need regions or managed services Hetzner does not offer natively (CDN, managed DB, AI APIs)?

Unomed Cloud PACS

Will Unomed provide the current named subprocessor list (hosting, backup, email, SMS, identity) under NDA or in the ABV annex?
Which exact Swiss data-centre operators and certifications cover the DICOM archive?
Is a CE-marked / certified diagnostic viewer required for your reporting workflow, and which third-party option will Unomed integrate?
What SLA, backup/RPO and export support apply to your Cloud PACS tier?