Compare Scaleway and Unomed Cloud PACS on capabilities, jurisdiction, assurance, and fit for European buyers.
Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure
France· Cloud Computing
Needs review
Shortlist Scaleway for French-owned multi-AZ IaaS (Paris/Amsterdam/Warsaw) with bare metal, EU-resident GPUs and Kapsule Kubernetes—especially HDS/sovereignty-sensitive stacks. Skip if you need completed SecNumCloud today or hyperscaler global depth; consider OVHcloud, Exoscale/UpCloud, or AWS/Azure/GCP instead.
Switzerland· Cloud Computing
Needs review
Shortlist for Swiss practices that want a cloud DICOM archive, browser viewing and referrer sharing without replacing their PIS, and that accept a Zurich SaaS vendor with claimed Swiss image hosting. Skip when you need a default CE-marked diagnostic viewer, a fully public subprocessor and audit pack, or a self-hosted PACS you operate yourself. Consider PostDICOM or a classic on-prem PACS plus sharing tool when those constraints dominate.
Highlighted rows differ between the two products.
| Feature | Scaleway | Unomed Cloud PACS |
|---|---|---|
| Country of origin | France | Switzerland |
| Category | Cloud Computing | Cloud Computing |
| Open source | No | No |
| Self-hosted | No | No |
| Headquarters | France | Switzerland |
| Legal entity | SCALEWAY SAS (R.C.S. Paris 433 115 904), 8 rue de la Ville l'Évêque, 75008 Paris | Unomed AG |
| Governing law | French law (General Terms of Services) | Not listed |
| US parent / control | No known US parent | No known US parent |
| CLOUD Act exposure (indicative) | Low | Medium |
| EU-hosted status | Not listed | Partial |
| Hosting / residency | Customer cloud workloads on Scaleway-operated European multi-AZ infrastructure (Paris, Amsterdam, Warsaw; Milan listed in availability docs)—not primary hosting on AWS/GCP/Azure. Account/controller activities use processors; privacy policy allows some non-EU transfers under SCCs. Full named subprocessor table is via Trust Center/contracts rather than a fully public marketing page. | Vendor claims primary hosting, databases and DICOM storage in Switzerland. Privacy policy lists identity/liveness processing in EU (Ireland) and speech recognition in EU (Denmark). API CSP references AWS S3 eu-central-2 (Zurich) and AWS Rekognition/Cognito eu-west-1; push via Firebase; website may use Cloudflare WAF cookies and Google Analytics. Named subprocessor list on request only. |
| Summary | French iliad-group cloud platform: bare metal, virtual instances, EU-resident GPU for AI, managed Kubernetes, serverless, storage and databases on Scaleway-operated multi-AZ regions in Europe. | Swiss cloud PACS and vendor-neutral archive for storing, viewing and sharing DICOM medical images in the browser, integrated with existing medical practice workflows. |
| Tags |
| At a glance | Scaleway | Unomed Cloud PACS |
|---|---|---|
| HQ | Paris, France (SCALEWAY SAS) | Zurich, Switzerland |
| Group | iliad Group subsidiary | Not listed |
| Regions | Paris, Amsterdam, Warsaw multi-AZ (+ Milan listed) | Not listed |
| Model | Public cloud IaaS/PaaS (not self-hosted) | Not listed |
| Commercial model | Pay-as-you-go; compute Savings Plans (GPU rules differ) | Not listed |
| Open source | Platform proprietary; open standards (K8s, S3 API, Terraform) | Not listed |
| Legal entity | Not listed | Unomed AG (CHE-374.858.885) |
| Product type | Not listed | Cloud PACS / VNA SaaS |
| Self-hosted | Not listed | No (local connector only) |
| Default viewer | Not listed | OHIF (not for diagnosis per GTCs) |
| Data residency regions | Not listed | Switzerland claimed for DICOM/hosting; some auxiliary processing in EU (IE/DK) per privacy policy |
| Key capabilities | Scaleway | Unomed Cloud PACS |
|---|---|---|
| EU-operated regions | Yes | Yes |
| Bare metal + Elastic Metal | Yes | Not listed |
| EU GPU for AI | Yes | Not listed |
| Kapsule Kubernetes | Yes | Not listed |
| ISO 27001 (certified) | Yes | Not listed |
| HDS (claimed) | Yes | Not listed |
| Cloud PACS / VNA | Not listed | Yes |
| DICOM archive | Not listed | Yes |
| Browser viewer | Not listed | Yes |
| PIS overlay | Not listed | Yes |
Elastic Metal, Dedibox and Apple Silicon bare metal
Single-tenant physical servers without a shared hypervisor layer: Dedibox for a wide dedicated catalogue, Elastic Metal for bare metal integrated with Scaleway VPC, load balancing, storage and Kubernetes, plus Apple Silicon Mac mini hosts for native macOS/iOS CI. Best when you need hardware isolation, custom kernels, or GPU bare metal without VM overhead—product lines are still converging, so compare availability zone coverage per SKU.
EU-resident GPU instances for AI training and inference
On-demand GPU VMs with recent NVIDIA options (including L4, L40S, H100 PCIe/SXM and B300-SXM) aimed at LLM fine-tuning, inference and graphics/media acceleration, with data residency in European regions. Integrates with Kapsule via the NVIDIA GPU Operator; pay-as-you-go by the minute. GPU capacity and Savings Plan eligibility differ from general instances—validate stock and zone before committing multi-node jobs.
Kubernetes Kapsule and multi-cloud Kosmos
Managed Kubernetes control planes on Scaleway nodes (Kapsule) with autoscaling-oriented operations, plus Kosmos for hybrid/multi-cloud worker pools including non-Scaleway infrastructure. Suits teams standardising on portable Kubernetes rather than proprietary orchestrators; external Kosmos pools remain your responsibility to patch and size.
Multi-AZ European regions with VPC networking
Place compute and storage in Paris, Amsterdam and Warsaw multi-AZ regions (docs also reference Milan), using regional private networking, load balancers and related network services. Useful for EU latency and residency designs without a US region on the primary map—confirm each product’s AZ matrix in the product-availability guide before multi-region DR planning.
Managed storage and databases on open-ish APIs
S3-compatible Object Storage (including multi-AZ class options), block volumes, and managed database engines (PostgreSQL, MySQL, Redis, MongoDB, ClickHouse-oriented analytics) plus serverless containers/functions/jobs. Reduces day-2 ops for common stack pieces while keeping export paths closer to open standards than pure proprietary PaaS—always check engine versions, HA options and backup retention for production.
API, CLI and Terraform-first operations
Full console plus documented APIs, CLI and Infrastructure-as-Code workflows for provisioning instances, networks and managed services. Fits platform teams automating environments; IAM permissions and account Owner roles still need deliberate design for production orgs.
Cloud DICOM archive (VNA-style)
Central archive for studies from in-house modalities and external institutes, with DICOM export so you can take the archive with you. Storage is billed as you grow; long-term statutory retention remains the customer's duty under Unomed's terms.
Zero-footprint browser viewer (OHIF default)
Open studies in the browser with nothing installed on the workstation. OHIF is the default; other viewers can be connected on request. Unomed's GTCs state the standard viewer is not authorised for diagnostic reporting.
PACS inbox with assisted patient matching
Inbound studies land in an inbox; Unomed suggests the matching patient (including fuzzy name matches) and a human confirms. Useful when institutes send studies that do not already carry a clean order from your record.
Share via messenger and guest links
Send studies to colleagues, referrers and patients through Unomed messenger. Recipients without an account get a time-limited guest link; registered users keep the thread in case chat instead of CDs or ad-hoc portals.
Cloud Connector, Radiology Bridge and Medical API
Connect DICOM modalities like a second destination printer, autoroute from an existing institute PACS via Radiology Bridge, or integrate via DICOMweb/Medical API. Keeps on-site PACS investments when you only need outbound routing to Unomed practices.
Overlay on existing practice software
Opens studies from the patient record in supported web-based Swiss practice systems without replacing the PIS. Vendor lists 16+ systems with several official partners; desktop-only software needs a feasibility discussion.
| Assurance & compliance | Scaleway | Unomed Cloud PACS |
|---|---|---|
| Independent security / no-logs audit | Not applicable IaaS provider (not a no-logs VPN). Trust Center references penetration testing and security reports available on request; not a public no-logs audit product claim. | Not found No public independent security audit report located on unomed.ch. |
| ISO 27001 | Verified ISO/IEC 27001:2022 certificate documentation published (e.g. certificate IS 787020 for SCALEWAY, Paris). Confirm scope covers the services you buy. | Not found No ISO 27001 certificate or registry entry found on the official site. |
| SOC 2 / SOC 3 | Not found Not listed among public Trust Center compliance badges reviewed (GDPR, HDS, ISO 27001, CSA STAR L1). | Not found No SOC 2/3 report referenced on public pages reviewed. |
| HDS (French health data hosting) | Vendor claimed Vendor security and healthcare pages claim HDS certification; Trust Center lists HDS. Confirm certified service scope for your architecture. | Not listed |
| CSA STAR Level 1 | Vendor claimed Trust Center announces CSA STAR Level 1 (CCM self-assessment / CAIQ). | Not listed |
| ANSSI SecNumCloud | Partial Qualification process started (public news); security pages mark SecNumCloud as ongoing—not obtained as a finished qualification in sources reviewed. | Not listed |
| GDPR / EU data protection | Vendor claimed EU controller/processor with published privacy policy and DPA; French entity. Not legal advice. | Vendor claimed Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case. |
| US CLOUD Act exposure (indicative) | Partial French SAS / iliad Group; customer IaaS on self-operated EU regions; no US parent found. Controller-side processors and possible third-country transfers per privacy policy; SecNumCloud not complete. Assessment only—not a vendor “safe” claim. | Partial Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice. |
| Data processing agreement (B2B) | Vendor claimed DPA PDF downloadable on https://www.scaleway.com/en/contracts/ alongside TOMs. | Vendor claimed GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider. |
| EU AI Act | Not applicable Infrastructure/GPU host; customer models and apps drive AI Act roles. Not an AI Act conformity product claim. | Not applicable PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system. |
| Diagnostic viewer certification | Not listed | Partial Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional. |
| Considerations & known limitations | Scaleway | Unomed Cloud PACS |
|---|---|---|
| SecNumCloud not yet obtained | Medium ANSSI SecNumCloud is in progress on public materials. Regulated French public-sector tenders that hard-require a qualified cloud today may need another SKU/provider or a delayed migration plan. | Not listed |
| Smaller service catalogue than US hyperscalers | Medium Expect fewer proprietary managed services and less global region density than AWS/Azure/GCP. Multi-cloud or complementary SaaS may still be required for parts of the estate. | Not listed |
| Account-plane processors and possible non-EU transfers | Low Even with EU workload regions, privacy policy allows processor use and SCC-backed transfers for some controller purposes (support, payments, marketing, etc.). Pull the live subprocessor list for DPIAs. | Not listed |
| Shared responsibility for guest security | Medium Scaleway secures the platform; you own OS hardening, IAM, application security, encryption keys and backups. Recent Trust Center advisories on kernel issues illustrate customer patching duties on instances and Kapsule nodes. | Not listed |
| Dedibox vs Elastic Metal product split | Low Two bare-metal experiences still coexist while Scaleway documents convergence. Mis-choosing the line can affect API integration, networking features and migration effort. | Not listed |
| US-group cloud components in the data path | Not listed | Medium Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk. |
| Default viewer not for diagnosis | Not listed | High If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted. |
| No public ISO/SOC or independent audit | Not listed | Medium Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates. |
| Subprocessor list not published | Not listed | Medium Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared. |
When: You need completed SecNumCloud-qualified private cloud or a larger non-EU region footprint under one European operator
Consider: OVHcloud
Compare exact qualified product SKUs and region maps; OVH and Scaleway are both French industrial clouds with different strengths.
When: You want simpler EU VPS/dedicated economics with a smaller product surface
Consider: UpCloud, Exoscale, or Cyso Cloud
Leaner catalogues; validate GPU, HDS and multi-AZ needs separately.
When: You need maximum global managed-service depth and partner ecosystem
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Accept US-parent CLOUD Act exposure and design residency/controls explicitly.
When: German SMB hosting plus EU cloud under a DE-centric brand is the priority
Consider: IONOS
Different product mix and market focus than Scaleway’s developer/AI-oriented public cloud.
When: You need a European cloud PACS peer outside Switzerland or broader multi-country packaging
Consider: PostDICOM (Netherlands) or other EU cloud PACS vendors
Feature parity is not claimed; compare residency contracts and viewer certification directly.
When: You primarily need raw cloud object storage or hospital-grade imaging services on a hyperscaler
Consider: AWS or Azure health/imaging stacks with your own viewer and compliance design
More infrastructure flexibility; you own more of the clinical workflow glue.
When: You must keep all image data on premises under your sole operational control
Consider: Classic on-prem PACS plus a dedicated sharing portal
Unomed is cloud SaaS with a local connector, not a self-hosted Unomed server product.