STACKIT vs Unomed Cloud PACS

Compare STACKIT and Unomed Cloud PACS on capabilities, jurisdiction, assurance, and fit for European buyers.

Both listed as alternatives to: Amazon Web Services (AWS), Microsoft Azure

STACKIT

Germany· Cloud Computing

Needs review

Shortlist STACKIT when you want German-entity IaaS/PaaS on Schwarz Group–owned DE/AT infrastructure with managed Kubernetes, scoped BSI C5 Type 2 claims, and optional same-campus colocation. Skip when you need global multi-region hyperscaler breadth or a fully self-hosted control plane—consider OVHcloud or Scaleway for multi-country EU clouds, or AWS/Azure when worldwide services dominate the architecture.

EU-operatedGerman legal entityGroup-owned DE/AT DCsBSI C5 Type 2 (claimed)Managed Kubernetes (SKE)EU colocation + hybrid

View listing Visit Website

Unomed Cloud PACS

Switzerland· Cloud Computing

Needs review

Shortlist for Swiss practices that want a cloud DICOM archive, browser viewing and referrer sharing without replacing their PIS, and that accept a Zurich SaaS vendor with claimed Swiss image hosting. Skip when you need a default CE-marked diagnostic viewer, a fully public subprocessor and audit pack, or a self-hosted PACS you operate yourself. Consider PostDICOM or a classic on-prem PACS plus sharing tool when those constraints dominate.

Swiss-operatedCloud PACS / VNADICOM archiveBrowser viewerPIS overlay

View listing Visit Website

Highlighted rows differ between the two products.

STACKIT vs Unomed Cloud PACS: Snapshot
Feature	STACKIT	Unomed Cloud PACS
Country of origin	Germany	Switzerland
Category	Cloud Computing	Cloud Computing
Open source	No	No
Self-hosted	No	No
Headquarters	Germany	Switzerland
Legal entity	Schwarz Digits Cloud GmbH & Co. KG (Am Campus 1, 74177 Bad Friedrichshall; imprint lists STACKIT Beteiligungs-GmbH as general partner vehicle in Neckarsulm)	Unomed AG
Governing law	Germany (imprint also notes ICT infrastructure jurisdiction Germany and Austria)	Not listed
US parent / control	No known US parent	No known US parent
CLOUD Act exposure (indicative)	Low	Medium
EU-hosted status	Not listed	Partial
Hosting / residency	Vendor claims STACKIT Cloud runs in group-owned ISO 27001 data centers in Germany and Austria (sites publicly named include Neckarsulm DC01, Ellhofen DC08, Ostermiething DC10; additional EU sites claimed). Cloud regions include EU01 (Germany) and EU02 (Austria). No public evidence found that customer data-plane hosting is on AWS/GCP/Azure. A detailed third-party subprocessor list for all support/analytics tooling was not found on marketing pages—confirm in the AVV.	Vendor claims primary hosting, databases and DICOM storage in Switzerland. Privacy policy lists identity/liveness processing in EU (Ireland) and speech recognition in EU (Denmark). API CSP references AWS S3 eu-central-2 (Zurich) and AWS Rekognition/Cognito eu-west-1; push via Firebase; website may use Cloudflare WAF cookies and Google Analytics. Named subprocessor list on request only.
Summary	German sovereign cloud from Schwarz Digits (Schwarz Group): IaaS, managed Kubernetes, databases, and colocation on group-owned data centers in Germany and Austria.	Swiss cloud PACS and vendor-neutral archive for storing, viewing and sharing DICOM medical images in the browser, integrated with existing medical practice workflows.
Tags	cloud infrastructure privacy kubernetes sovereign-cloud iaas paas	pacs dicom medical-imaging healthcare cloud-pacs switzerland vna

At a glance: STACKIT vs Unomed Cloud PACS
At a glance	STACKIT	Unomed Cloud PACS
HQ / legal entity	Bad Friedrichshall / Neckarsulm area, Germany — Schwarz Digits Cloud GmbH & Co. KG	Not listed
Parent	Schwarz Digits (Schwarz Group — Lidl/Kaufland)	Not listed
Hosting	Group-owned data centers in Germany & Austria (e.g. EU01/EU02); not marketed as AWS/Azure reseller	Not listed
Model	Consumption-based public cloud + quote-based colocation	Not listed
Open source	Uses open-source components; platform itself is managed, not self-hosted	Not listed
External market	Public offering from 2022 (internal roots from 2018)	Not listed
HQ	Not listed	Zurich, Switzerland
Legal entity	Not listed	Unomed AG (CHE-374.858.885)
Product type	Not listed	Cloud PACS / VNA SaaS
Self-hosted	Not listed	No (local connector only)
Default viewer	Not listed	OHIF (not for diagnosis per GTCs)
Data residency regions	Not listed	Switzerland claimed for DICOM/hosting; some auxiliary processing in EU (IE/DK) per privacy policy

Key capabilities: STACKIT vs Unomed Cloud PACS
Key capabilities	STACKIT	Unomed Cloud PACS
EU-operated	Yes	Yes
German legal entity	Yes	Not listed
Group-owned DE/AT DCs	Yes	Not listed
BSI C5 Type 2 (claimed)	Yes	Not listed
Managed Kubernetes (SKE)	Yes	Not listed
EU colocation + hybrid	Yes	Not listed
Cloud PACS / VNA	Not listed	Yes
DICOM archive	Not listed	Yes
Browser viewer	Not listed	Yes
PIS overlay	Not listed	Yes

STACKIT

Compute Engine VMs and GPUs in group-owned EU regions
Provision Linux and Windows virtual machines, GPU-backed instances, automated server backup and OS update management from the STACKIT portal, CLI, API, or Terraform. Workloads land in European cloud regions such as EU01 (Germany) and EU02 (Austria) on Schwarz Group–operated infrastructure rather than rented hyperscaler bare metal. Best for teams that need predictable EU residency for general compute and AI/ML training or inference on GPU shapes—confirm available instance families per region before migration.
STACKIT Kubernetes Engine (SKE)
Managed, CNCF-compliant Kubernetes with a highly available control plane, automated Kubernetes/OS upgrades, repair functions, pod and node autoscaling, optional temporary cluster shutdown, and automation via Terraform, SKE API, and CLI. Suited to cloud-native apps, stateful workloads on block storage, and ML pipelines that must stay in European regions. Not a self-hosted kubeadm replacement—you consume a managed service with STACKIT-controlled plane components.
Managed databases, messaging, and observability
Fully managed PostgreSQL Flex, MongoDB Flex, SQL Server Flex, MariaDB, Redis, OpenSearch, and RabbitMQ plus LogMe, Logs, and Observability stacks reduce ops load for application teams. Flex models emphasize automated maintenance, backups, and scaling inside the STACKIT cloud. Ideal when you want PaaS data services under the same German operator as your VMs/K8s—validate HA topology, backup retention, and region pairing for each service.
Confidential computing and key/secrets control
Confidential Server and Confidential Kubernetes options aim to protect data in use with hardware-backed isolation; Secrets Manager and Key Management Service handle secret storage/rotation and cryptographic operations. Useful for regulated or multi-tenant sensitive workloads beyond disk encryption alone. Confirm attestation models, supported node types, and which compliance reports cover these products.
EU colocation with hybrid path to public cloud
Racks, cages, and private rooms in Neckarsulm, Ellhofen, and Ostermiething facilities—with remote hands, carrier connectivity, and hybrid designs that keep non-migratable hardware next to STACKIT public cloud. Positions STACKIT for gradual cloud adoption without a pure forklift. Colocation is quote-driven and site certifications can vary by facility; request site data sheets early.
Object, block, file, backup, and archiving storage
S3-compatible object storage, high-performance block volumes, NFS file storage, backup storage, and audit-oriented archiving for retention workloads. Supports application data, VM disks, and compliance archives inside the same European footprint as compute. Check durability/replication claims and cross-region options against your RPO/RTO rather than assuming hyperscaler multi-region defaults.

Unomed Cloud PACS

Cloud DICOM archive (VNA-style)
Central archive for studies from in-house modalities and external institutes, with DICOM export so you can take the archive with you. Storage is billed as you grow; long-term statutory retention remains the customer's duty under Unomed's terms.
Zero-footprint browser viewer (OHIF default)
Open studies in the browser with nothing installed on the workstation. OHIF is the default; other viewers can be connected on request. Unomed's GTCs state the standard viewer is not authorised for diagnostic reporting.
PACS inbox with assisted patient matching
Inbound studies land in an inbox; Unomed suggests the matching patient (including fuzzy name matches) and a human confirms. Useful when institutes send studies that do not already carry a clean order from your record.
Share via messenger and guest links
Send studies to colleagues, referrers and patients through Unomed messenger. Recipients without an account get a time-limited guest link; registered users keep the thread in case chat instead of CDs or ad-hoc portals.
Cloud Connector, Radiology Bridge and Medical API
Connect DICOM modalities like a second destination printer, autoroute from an existing institute PACS via Radiology Bridge, or integrate via DICOMweb/Medical API. Keeps on-site PACS investments when you only need outbound routing to Unomed practices.
Overlay on existing practice software
Opens studies from the patient record in supported web-based Swiss practice systems without replacing the PIS. Vendor lists 16+ systems with several official partners; desktop-only software needs a feasibility discussion.

Assurance & compliance: STACKIT vs Unomed Cloud PACS
Assurance & compliance	STACKIT	Unomed Cloud PACS
Independent security attestation (BSI C5 / audits)	Vendor claimed Vendor claims BSI C5 Type 2 for a listed IaaS/storage product set; reports available on request (iso@digits.schwarz). Not a VPN-style no-logs audit.	Not found No public independent security audit report located on unomed.ch.
ISO 27001	Vendor claimed Certificates page claims ISO/IEC 27001 ISMS (with downloadable cert links) plus ISO 27017 and ISO 27018; also ISO 27001 based on IT baseline protection for named IaaS components.	Not found No ISO 27001 certificate or registry entry found on the official site.
SOC 2 / SOC 3 (ISAE 3000)	Vendor claimed Vendor states ISAE 3000 (SOC 2) and ISAE 3402 in addition to C5 Type 2; obtain current reports under NDA/request.	Not found No SOC 2/3 report referenced on public pages reviewed.
BSI C5 Type 2	Vendor claimed C5 Type 2 claimed for Compute Engine (incl. GPU), Windows/RHEL, server backup/update management, block/object/backup/file storage, archiving—not automatically every PaaS product.	Not listed
GDPR / EU data protection	Vendor claimed EU legal entity; vendor claims GDPR-aligned operation with processing in own DE/AT data centers and ISO 27018 claims for PII in the cloud.	Vendor claimed Swiss FADP (DSG) primary; privacy policy also cites GDPR bases. Confirm DPA/ABV for your use case.
US CLOUD Act exposure (indicative)	Partial German operator under Schwarz Digits / Schwarz Group; no known US parent; customer cloud claimed on group-owned EU DCs without named AWS/GCP/Azure data-plane hosts. Partial (not a clean bill): confirm AVV subprocessors and any non-EU support tools. Indicative only—not legal advice.	Partial Swiss entity / no known US parent, but AWS (S3 Zurich region, Rekognition Ireland) and Firebase appear in public technical/privacy materials. Not legal advice.
Data processing agreement (B2B)	Not found No self-serve public AVV/DPA URL confirmed during research; expect contract packaging—request AVV, TOMs, and subprocessor list in procurement.	Vendor claimed GTCs require an Auftragsbearbeitungsvertrag (ABV) when patient data is processed on behalf of the healthcare provider.
TISAX Level 3	Vendor claimed Vendor claims TISAX Level 3; verification via ENX portal (assessment ID ATA163-1 / scope ID SH938N per certificates page).	Not listed
EU AI Act	Not applicable Primary offering is IaaS/PaaS infrastructure; optional AI Model Serving and related data/AI products may need separate AI Act analysis if you deploy high-risk AI systems.	Not applicable PACS archive/viewer product; AI is used for assisted patient matching and other suite features, but this entry evaluates the imaging archive, not an AI-centric system.
Diagnostic viewer certification	Not listed	Partial Default OHIF viewer explicitly not for diagnosis per GTCs; certified third-party viewers optional.

Considerations & known limitations: STACKIT vs Unomed Cloud PACS
Considerations & known limitations	STACKIT	Unomed Cloud PACS
Narrower service map than US hyperscalers	Medium STACKIT covers core compute, K8s, databases, and storage, but global specialty services and third-party marketplace depth lag AWS/Azure/GCP. Practical impact: multi-cloud or lift-and-shift of complex hyperscaler architectures may need redesign.	Not listed
C5 Type 2 is product-scoped	Medium Attestation tables list specific IaaS/storage products. Teams assuming every managed database or PaaS SKU is C5 Type 2 covered without reading the scope can mis-state compliance. Practical impact: map each in-scope service before audits.	Not listed
Limited public subprocessor inventory	Low Marketing asserts own data centers and EU processing; a complete public subprocessor/support-tool list was not found on the pages reviewed. Practical impact: force AVV + subprocessor exhibits before production personal data.	Not listed
Retail-group operator concentration	Low Economic stability is a stated strength of Schwarz Group ownership, but roadmap and commercial leverage differ from pure-play clouds. Practical impact: negotiate exit, data export, and roadmap commitments explicitly.	Not listed
US-group cloud components in the data path	Not listed	Medium Even with Swiss HQ and claimed Swiss image hosting, AWS and Firebase endpoints appear in public privacy/CSP materials. Procurement should obtain the named subprocessor annex and assess CLOUD Act residual risk.
Default viewer not for diagnosis	Not listed	High If radiologists must report from the included viewer, Unomed alone is the wrong shortlist item unless a certified diagnostic viewer is contracted.
No public ISO/SOC or independent audit	Not listed	Medium Assurance currently rests on vendor policies, Swiss entity status and contractual ABV rather than published certificates.
Subprocessor list not published	Not listed	Medium Privacy policy says processors can be requested at any time but does not name hosting vendors on the page. Blockers for security questionnaires until the annex is shared.

Fit

STACKIT

Best fit when

Public-sector, healthcare, finance, or retail teams that require EU residency under a German operator with dual DE/AT regions
Platform teams standardizing on managed Kubernetes (SKE) plus VMs and managed databases in one European cloud
Organizations migrating gradually via colocation racks/cages in STACKIT facilities next to public cloud projects
Buyers that prioritize BSI C5 Type 2 and ISO 27001 family claims on core compute/storage over hyperscaler marketplace depth
Workloads that benefit from GPU compute, confidential computing options, or AI model serving inside the same sovereign stack

Poor fit when

Architectures that depend on many specialized AWS/Azure/GCP managed services or global multi-continent regions
Teams that must self-host the full cloud control plane rather than consume a managed public cloud
Simple single-VM or low-ops hobby hosting where a basic VPS provider is enough
Procurement that needs every PaaS product under the same C5 Type 2 table without reviewing scope gaps
Use cases requiring non-European data residency as a primary requirement

Consider instead when

When: You need a wider multi-country European region map and a large independent cloud portfolio
Consider: OVHcloud or Scaleway
Different ownership and product cultures; still not US hyperscaler breadth
When: Your workload is mainly simple German VMs/web hosting without managed K8s/PaaS depth
Consider: IONOS (or similar DE hosts)
Often simpler packaging for commodity compute
When: You require global regions, the largest third-party marketplace, or existing multi-cloud tooling locked to hyperscaler APIs
Consider: Amazon Web Services, Microsoft Azure, or Google Cloud Platform
Trade EU ownership of the operator for ecosystem scale; apply your own CLOUD Act / transfer analysis
When: Swiss or other non-DE sovereignty framing matters more than Schwarz Group scale
Consider: Exoscale
Smaller portfolio; different jurisdiction story

Unomed Cloud PACS

Best fit when

Swiss medical or dental practices that want cloud DICOM archive and sharing without an on-site PACS project
Teams that must open imaging from an existing web-based practice system rather than a second patient search
Institutes that need to autoroute studies to referring practices while keeping an existing PACS (Radiology Bridge)
Buyers who prioritise a Swiss contracting entity and vendor-claimed Swiss image residency under the FADP
Workflows that share studies with referrers or patients via links instead of CDs or one-off portals

Poor fit when

Organisations that require the included viewer to be a certified diagnostic/reporting workstation out of the box
Buyers that need a published named subprocessor list and independent ISO/SOC evidence before first sales call
Teams seeking a fully self-hosted open-source PACS they operate themselves
Hospitals needing a full RIS/PACS suite beyond practice-oriented cloud archive and sharing

Consider instead when

When: You need a European cloud PACS peer outside Switzerland or broader multi-country packaging
Consider: PostDICOM (Netherlands) or other EU cloud PACS vendors
Feature parity is not claimed; compare residency contracts and viewer certification directly.
When: You primarily need raw cloud object storage or hospital-grade imaging services on a hyperscaler
Consider: AWS or Azure health/imaging stacks with your own viewer and compliance design
More infrastructure flexibility; you own more of the clinical workflow glue.
When: You must keep all image data on premises under your sole operational control
Consider: Classic on-prem PACS plus a dedicated sharing portal
Unomed is cloud SaaS with a local connector, not a self-hosted Unomed server product.

Open questions for due diligence

STACKIT

Will STACKIT provide a signed AVV/DPA, current TOMs, and a full subprocessor list covering support, monitoring, and marketplace components?
Which of our target services (SKE, PostgreSQL Flex, Confidential Kubernetes, etc.) fall inside the latest C5 Type 2 and ISO reports?
What are the exact region availability, geo-redundancy options, and SLA credits for our workloads across EU01/EU02 (and any additional regions)?
What are exit, data export, and termination assistance terms for large object stores and managed databases?
For public-sector or KRITIS use cases: which additional attestations, clearance processes, or reference architectures are required?

Unomed Cloud PACS

Will Unomed provide the current named subprocessor list (hosting, backup, email, SMS, identity) under NDA or in the ABV annex?
Which exact Swiss data-centre operators and certifications cover the DICOM archive?
Is a CE-marked / certified diagnostic viewer required for your reporting workflow, and which third-party option will Unomed integrate?
What SLA, backup/RPO and export support apply to your Cloud PACS tier?